SC-100 Certification Practice Question #57

Question

Your company is preparing for cloud adoption.
You are designing security for Azure landing zones.
Which two preventative controls can you implement to increase the secure score? Each correct answer presents a complete solution.
NOTE: Each correct selection is worth one point.

Accepted Answer

The question asks for two **preventative** controls that **increase the secure score**. Both Azure WAF and Azure Firewall are network/application preventative controls that map to secure-score security controls in Defender for Cloud ("Protect applications against DDoS attacks" covers Azure WAF; "Restrict unauthorized network access" covers enabling Azure Firewall). Microsoft Sentinel (SIEM/detection) and PIM, while valuable landing-zone tools, are not items that move the Defender for Cloud secure score, and Defender for Cloud **alerts** are detective/responsive rather than preventative. The official Suggested Answer lists only D, but this is a choose-two question and the overwhelmingly upvoted community answer (AD, 90 votes, two Highly Voted comments totaling 73 👍) plus MS Learn fill in the second letter as A. Confidence is set at 86% (not higher) because the captured Suggested Answer shows only D and there is a vocal minority pushing PIM/Sentinel, but MS Learn clearly favors WAF + Firewall as the scored preventative controls.

More SC-100 practice questions