SC-100 Practice Exam 63 — 20 Questions

Question 1

You are a security architect for a global financial services company that uses Microsoft 365 E5 and Azure. The company has 50,000 users across 10 regions. The security team needs to detect and respond to identity-based threats in real-time, automate remediation for compromised accounts, and meet regulatory requirements for audit logging. The following requirements must be met: (1) Detect risky sign-ins and user anomalies, (2) Automatically block sign-ins when risk level is high, (3) Provide a centralized dashboard for security analysts to investigate incidents, (4) Retain logs for at least one year for compliance, (5) Minimize false positives by using machine learning. You have the following services available: Microsoft Entra ID P2, Microsoft Sentinel, Microsoft Defender for Identity, Microsoft Purview, and Microsoft Intune. Which combination of services should you use to meet all requirements?

Accepted Answer

Microsoft Entra ID Protection (P2) and Microsoft Sentinel. Option D is correct because Microsoft Entra ID Protection (included in P2) detects risky sign-ins and user anomalies, and can automatically block high-risk sign-ins. Microsoft Sentinel ingests logs from Entra ID and other sources, provides a centralized SIEM dashboard for investigation, and retains logs for up to two years. Machine learning in both Entra ID Protection and Sentinel helps minimize false positives. Option A is wrong because Intune does not provide identity threat detection or centralized SIEM. Option B is wrong because Defender for Identity is for on-premises AD, not cloud-only identity. Option C is wrong because Purview is for data governance, not identity threat detection.

Answer

Microsoft Intune and Microsoft Defender for Cloud

Answer

Microsoft Defender for Identity and Microsoft Purview

Answer

Microsoft Purview and Microsoft Sentinel

Question 2

Your organization is a large healthcare provider that uses Microsoft 365 and Azure. You need to design a compliance solution that meets HIPAA requirements. The solution must automatically classify and protect electronic protected health information (ePHI) in Exchange Online, SharePoint Online, and OneDrive for Business. It must also provide reports on data access and sharing activities for auditors. The following requirements must be met: (1) Detect ePHI using built-in sensitive info types, (2) Apply encryption automatically to emails containing ePHI, (3) Prevent unauthorized sharing of ePHI in SharePoint, (4) Generate activity reports for auditors, (5) Use machine learning to improve classification accuracy. Which Microsoft Purview capabilities should you use?

Accepted Answer

Data Loss Prevention (DLP) and Audit. Option C is correct because Microsoft Purview Data Loss Prevention (DLP) can detect ePHI using HIPAA sensitive info types, automatically encrypt emails, and block unauthorized sharing in SharePoint. Audit logs in Purview provide activity reports. Machine learning in Purview Information Protection improves classification. Option A is wrong because Compliance Manager is for assessments, not protection. Option B is wrong because Information Protection alone does not prevent sharing. Option D is wrong because eDiscovery is for legal discovery, not real-time protection.

Answer

Information Protection and Insider Risk Management

Answer

Compliance Manager and eDiscovery

Answer

eDiscovery and Communication Compliance

Question 3

Your organization, Contoso Ltd., uses Microsoft 365 E5 licenses and has deployed Microsoft Sentinel in Azure. The security operations center (SOC) receives thousands of alerts daily from Microsoft Defender for Cloud, Microsoft Defender for Office 365, and Microsoft Defender for Endpoint. The SOC team is overwhelmed and needs to prioritize incidents effectively. You need to design a solution that uses Microsoft Sentinel to automatically classify incidents as true positive, false positive, or benign positive based on threat intelligence and analytics. Additionally, the solution should automatically close low-confidence false positive incidents after 24 hours if no analyst interaction occurs. You must minimize manual effort and ensure that critical incidents are escalated immediately. What should you do?

Accepted Answer

Create automation rules that trigger on incident creation to classify incidents using custom properties and run a playbook for escalation.. Option A is correct because automation rules with incident creation triggers can automatically classify and close incidents based on conditions, and playbooks can handle escalation. Option B is incorrect because workbooks are for visualization, not automated response. Option C is incorrect because analytics rules create incidents, not manage them. Option D is incorrect because watchlists are for reference, not automation.

Answer

Build a workbook that displays incident classification and assign analysts to review and close low-confidence incidents.

Answer

Use watchlists to define known false positive indicators and configure a playbook to run hourly to close matching incidents.

Answer

Modify the analytics rules to automatically close incidents based on a threshold of false positive indicators.

Question 4

Your organization is a large financial services company with a hybrid infrastructure consisting of on-premises servers and Azure IaaS. You are tasked with designing a security solution for infrastructure that meets the following requirements: - All administrative access to Azure resources must be just-in-time (JIT) and just-enough-access (JEA). - All on-premises servers must be managed centrally with consistent security policies. - All network traffic between on-premises and Azure must be encrypted and inspected for threats. - All privileged access must be monitored and audited. You have the following services available: Microsoft Entra ID, Microsoft Defender for Cloud, Azure Firewall, Azure Bastion, Microsoft Sentinel, Azure Arc, Azure Policy, Microsoft Defender for Identity, and Microsoft Entra Privileged Identity Management (PIM). Which combination of services should you use to meet all requirements?

Accepted Answer

Use Microsoft Entra PIM for JIT access, Azure Arc to extend Azure Policy to on-prem servers, Azure Firewall with threat intelligence for traffic inspection, and Microsoft Defender for Identity for monitoring privileged access.. Option A is correct: PIM provides JIT/JEA for Azure roles; Azure Arc enables management of on-prem servers with Azure Policy; Azure Firewall with threat intelligence can inspect encrypted traffic; Microsoft Defender for Identity monitors on-prem AD for privileged attacks. Option B is incorrect: Azure Bastion provides secure RDP/SSH but does not provide JIT/JEA. Option C is incorrect: Azure VPN Gateway does not inspect traffic. Option D is incorrect: Microsoft Sentinel is for SIEM, not JIT.

Answer

Use Azure Bastion for administrative access, Azure Automation for on-prem management, Azure VPN Gateway for encrypted traffic, and Microsoft Sentinel for monitoring.

Answer

Use Microsoft Sentinel for all aspects, including JIT via playbooks, Azure Arc for management, Azure Firewall for traffic, and Azure Policy for compliance.

Answer

Use Microsoft Entra roles with permanent assignments, Azure Site Recovery for on-premises management, Azure ExpressRoute for encrypted traffic, and Microsoft Defender for Cloud for monitoring.

Question 5

You are a security architect for a retail company that uses Microsoft 365 and Azure. The company has a large number of remote employees who use both company-managed and personal devices. You need to design a solution to ensure that only compliant devices can access corporate email (Exchange Online) and files (SharePoint Online). The company has Microsoft Intune and Microsoft Entra ID P1 licenses. You need to implement device-based conditional access. What should you do?

Accepted Answer

Enroll devices in Intune, create compliance policies, and configure Conditional Access policies in Entra ID to require compliant devices.. Option B is correct because Intune compliance policies define device health requirements, and Conditional Access policies enforce access based on compliance. Option A is wrong because app protection policies are for mobile application management (MAM) without device enrollment, but the requirement is device-based. Option C is wrong because device enrollment itself does not enforce compliance. Option D is wrong because Configuration Manager is for on-premises management, not cloud devices.

Answer

Deploy app protection policies (MAM) in Intune to protect data in Exchange Online and SharePoint Online.

Answer

Require all devices to be enrolled in Intune using automatic enrollment via Group Policy.

Answer

Use Microsoft Endpoint Configuration Manager to manage device compliance and integrate with Entra ID.

Question 6

You are a security architect for a large financial services company. The company has a hybrid identity infrastructure with on-premises Active Directory and Microsoft Entra ID (Azure AD). They have recently suffered a password spray attack that compromised several accounts. Management wants to implement a Zero Trust security model and has mandated the following requirements: 1. All user authentication must be protected by phishing-resistant MFA. 2. Legacy authentication protocols must be blocked. 3. All sign-in risks must be detected and automatically remediated. The current environment includes: - Microsoft 365 E5 licenses for all users. - Microsoft Entra ID P2 licenses. - On-premises Active Directory with password hash sync. - Azure AD Application Proxy for publishing on-premises apps. - A third-party VPN solution for remote access. You need to design a solution that meets the requirements. What should you do?

Accepted Answer

Deploy Windows Hello for Business for all users. Configure Conditional Access policies to block legacy authentication and require MFA for all cloud apps. Use Entra ID Protection to detect risky sign-ins and automatically require password change or block access.. Option A is correct because Windows Hello for Business is a phishing-resistant MFA method. Entra ID Conditional Access can block legacy authentication and enforce risk-based policies. Entra ID Protection detects sign-in risks and can automatically block or require password change. Option B is wrong because the Authenticator app (OATH TOTP) is not phishing-resistant (vulnerable to MFA fatigue). Option C is wrong because FIDO2 security keys are phishing-resistant but they are hardware tokens, not the recommended for all users; also the scenario doesn't mention hardware deployment. Option D is wrong because Azure AD MFA with phone call is not phishing-resistant.

Answer

Enable Azure AD MFA with phone call for all users. Use Conditional Access to block legacy authentication. Use Identity Protection to detect risks and require MFA again.

Answer

Enable Azure AD MFA with the Microsoft Authenticator app (OATH TOTP). Use Conditional Access to block legacy authentication and require MFA. Configure Identity Protection to alert on risky sign-ins.

Answer

Deploy FIDO2 security keys to all users. Configure Conditional Access to block legacy authentication. Use Identity Protection to detect risks and send alerts to the SOC.

Question 7

You are a security architect for a healthcare organization that is adopting Microsoft 365 and Azure. The organization must comply with HIPAA and has the following requirements: - All users must use multi-factor authentication (MFA) when accessing Microsoft 365 from outside the corporate network. - Mobile devices must be managed and must be compliant before accessing email. - Access to Azure virtual machines must be limited to specific admin users and must be audited. - All sensitive data stored in Azure SQL Database must be encrypted at rest and in transit. You have the following technologies: Microsoft Entra ID, Microsoft Intune, Azure SQL Database, Azure Policy, Azure Key Vault, Microsoft Defender for Cloud, and Azure Bastion. Which combination of services and configurations should you implement?

Accepted Answer

Configure Conditional Access policies for MFA, use Intune compliance policies for mobile devices, deploy Azure Bastion for VM access with audit logging, and enable TDE and enforce TLS for Azure SQL Database.. Option B is correct: Conditional Access with MFA for external access; Intune compliance policies for mobile devices; Azure Bastion for secure VM access with audit; Transparent Data Encryption (TDE) for at-rest encryption and TLS for in-transit. Option A is incorrect: Always Encrypted is for column-level encryption, but TDE is simpler for HIPAA. Option C is incorrect: Azure AD Application Proxy is not for VM access. Option D is incorrect: Azure Firewall does not provide audit for VM access.

Answer

Configure Conditional Access to require MFA only for external access, use Intune for mobile device management, deploy Always Encrypted for Azure SQL Database, and use Azure AD Application Proxy for VM access.

Answer

Configure Microsoft Entra PIM for MFA, use Intune for mobile devices, deploy Azure VPN Gateway for VM access, and enable Double Encryption for Azure SQL Database.

Answer

Use Azure AD Identity Protection for MFA, use Microsoft Endpoint Manager for device compliance, deploy Azure Firewall for VM access, and use Azure Key Vault for SQL encryption keys.

Question 8

You are the security architect for a company that has a hybrid identity infrastructure with Microsoft Entra ID (formerly Azure AD) and an on-premises Active Directory Domain Services (AD DS) forest. The company is planning to migrate several line-of-business (LOB) applications to Azure Virtual Machines. The applications currently use Windows Integrated Authentication (WIA) and rely on Kerberos delegation. You need to design a solution that allows the Azure VMs to authenticate on-premises users and access on-premises resources using Kerberos constrained delegation (KCD) without exposing on-premises-domain controllers to the internet. The solution must minimize latency and administrative overhead. You have configured Azure ExpressRoute for connectivity between the on-premises network and Azure. What should you do?

Accepted Answer

Deploy domain controllers as Azure VMs in the same virtual network as the application VMs. Configure the application VMs to use these domain controllers for authentication and KCD.. Option A is correct because deploying domain controllers as Azure VMs in the same virtual network as the application VMs allows them to use KCD with low latency, and ExpressRoute ensures secure connectivity without exposing on-premises DCs. Option B is wrong because Azure AD Domain Services provides managed domain services but does not support full KCD and may not meet all application requirements. Option C is wrong because using only ExpressRoute means the VMs would have to communicate with on-premises DCs over the WAN, potentially increasing latency. Option D is wrong because Azure AD Application Proxy is for publishing on-premises apps, not for authentication delegation.

Answer

Implement Azure AD Application Proxy to publish the applications and use Azure AD for authentication.

Answer

Use Azure AD Domain Services to provide domain join and KCD capabilities for the Azure VMs.

Answer

Configure the application VMs to use the on-premises domain controllers over ExpressRoute for authentication and KCD.

Question 9

Your organization is using Microsoft Sentinel to collect security logs from multiple sources, including Azure Activity Logs, Office 365 Audit Logs, and on-premises Windows Event Logs. You need to ensure that security incidents are automatically created when a user from a specific IP address attempts to access a sensitive application. You have already configured the data connectors. What should you create?

Accepted Answer

Create an analytics rule that triggers an incident when access from the IP is detected.. Option D is correct because an analytics rule in Microsoft Sentinel can be configured to alert on specific activities (e.g., access from a certain IP). Option A is wrong because a watchlist is a data source, not an alerting mechanism. Option B is wrong because a playbook is a response action, not an alert trigger. Option C is wrong because a workbook is a visualization tool.

Answer

Create a workbook to visualize the access attempts.

Answer

Create a watchlist containing the IP address and use it in a query.

Answer

Create a playbook that runs when a specific event occurs.

Question 10

Your organization is using Microsoft Defender for Cloud to manage security across multiple Azure subscriptions. You need to ensure that all virtual machines in the subscriptions are monitored by Defender for Cloud and that security alerts are sent to the security operations team. You also need to enforce that any new VMs are automatically onboarded to Defender for Cloud. You have a Log Analytics workspace in the central subscription. What should you do?

Accepted Answer

In Defender for Cloud, enable auto-provisioning for the Log Analytics agent at the management group level and specify the central workspace.. Option C is correct because enabling auto-provisioning of the Log Analytics agent at the management group scope ensures all VMs across subscriptions are monitored and new VMs are automatically onboarded. Option A is wrong because configuring only the workspace does not auto-provision. Option B is wrong because Azure Policy can enforce agent deployment, but auto-provisioning is simpler and more direct. Option D is wrong because enabling Defender for Cloud at the subscription level does not automatically install the agent.

Answer

Enable Defender for Cloud on each subscription and configure email notifications for alerts.

Answer

Assign an Azure Policy that deploys the Log Analytics agent to all VMs.

Answer

Create a Log Analytics workspace in each subscription and configure Defender for Cloud to use that workspace.

Question 11

You are designing a security solution for a small business that uses Azure App Services to host a web application. The business has the following requirements: - The web application must be protected against common web vulnerabilities like SQL injection and cross-site scripting (XSS). - All traffic to the application must be encrypted. - The solution should be cost-effective and require minimal management overhead. - The application must be able to scale automatically based on demand. Which Azure service should you use to meet these requirements?

Accepted Answer

Deploy Azure Application Gateway with Web Application Firewall (WAF) in front of the App Service.. Option A is correct: Azure Web Application Firewall (WAF) on Application Gateway protects against web vulnerabilities, provides TLS termination, and supports autoscaling. Option B is incorrect: Azure Front Door also provides WAF but is more expensive and suited for global scenarios. Option C is incorrect: Azure CDN does not include WAF. Option D is incorrect: Azure Firewall is a network firewall, not a web application firewall.

Answer

Use Azure Firewall to inspect traffic to the App Service.

Answer

Use Azure CDN with custom domain and HTTPS.

Answer

Deploy Azure Front Door with WAF policies.

Question 12

Your company, Fabrikam, is a global financial services firm that handles sensitive customer data. You are designing a security solution for a new customer-facing web application that processes credit card transactions. The application will be deployed on Azure Kubernetes Service (AKS) and will use Azure SQL Database for data storage. Compliance requirements include PCI DSS and GDPR. You need to ensure that data at rest and in transit is encrypted, and that access to the database is tightly controlled. You plan to use Azure Key Vault for managing encryption keys. Which combination of actions should you implement?

Accepted Answer

Enable TDE with a customer-managed key in Azure Key Vault, use Always Encrypted for sensitive columns, enforce TLS 1.2, and use Azure AD managed identities for authentication with a firewall rule to allow only the AKS cluster's outbound IP.. Option C is correct because it covers encryption in transit (TLS 1.2), encryption at rest (TDE and Always Encrypted), and access control with managed identities and firewall rules. Option A is wrong because TLS 1.0 is outdated and not PCI DSS compliant. Option B is wrong because Azure SQL Database does not support BYOK for TDE natively without Key Vault integration. Option D is wrong because application-level encryption alone does not meet compliance requirements for data at rest.

Answer

Enable TDE with a customer-managed key stored in the application's configuration file, enforce TLS 1.2, and use Azure AD authentication.

Answer

Implement application-level encryption for credit card data, enforce TLS 1.2, and use Azure AD managed identities with no database firewall rules.

Answer

Enable Transparent Data Encryption (TDE) with a service-managed key, enforce TLS 1.0, and use SQL authentication.

Question 13

Your organization uses Microsoft Defender for Cloud Apps to monitor shadow IT. You discover that employees are using a third-party file sharing app that is not sanctioned. The security team wants to block access to this app from managed devices and require authentication for unmanaged devices. You need to configure the appropriate controls in Defender for Cloud Apps. What should you do?

Accepted Answer

Create an access policy to block the app on unmanaged devices and require authentication on managed devices.. Option C is correct because it uses access policies to block unmanaged devices and require authentication, which aligns with the requirement. Option A is wrong because session policies monitor but do not block. Option B is wrong because app governance policies manage app permissions. Option D is wrong because DLP policies focus on data protection.

Answer

Create a session policy that monitors file uploads to the app.

Answer

Create an app governance policy to restrict the app's permissions.

Answer

Configure a DLP policy to prevent sharing of sensitive data through the app.

Question 14

Wide World Importers is deploying a critical line-of-business application on Azure Kubernetes Service (AKS). The application processes financial transactions and must meet SOX compliance. You need to design a security solution that includes: encryption of secrets (e.g., database connection strings) using Azure Key Vault, automatic certificate rotation for TLS termination, network isolation of the AKS cluster, and audit logging of all access to secrets. The solution should use a managed identity for the AKS cluster to access Key Vault. Which of the following designs meets the requirements?

Accepted Answer

Enable managed identity for the AKS cluster, integrate Key Vault with AKS using the Secrets Store CSI driver, deploy the cluster as a private cluster, and enable diagnostic settings on Key Vault to send logs to a Log Analytics workspace.. Option C is correct because it uses managed identity for secure secret access, Key Vault integration for secrets, private cluster for network isolation, and diagnostic settings for audit logging. Option A is wrong because private cluster is needed for network isolation, not just a private endpoint. Option B is wrong because secrets should be stored in Key Vault, not in Kubernetes secrets. Option D is wrong because service principal is less secure than managed identity, and Kubernetes secrets are not encrypted at rest by default.

Answer

Use a service principal for AKS to access Key Vault, store secrets as Kubernetes secrets, configure a private cluster, and enable audit logging on Key Vault.

Answer

Enable managed identity for the AKS cluster, store secrets in the cluster's native Kubernetes secrets, use a private endpoint for the AKS API server, and enable Azure Monitor for containers.

Answer

Use a service principal to access Key Vault, store secrets as encrypted Kubernetes secrets with a customer-managed key, deploy a public cluster with network policies, and enable Key Vault logging.

Question 15

Your organization, Contoso Ltd., is a multinational financial services company that handles sensitive customer financial data. They are migrating a critical loan origination application from on-premises to Azure Kubernetes Service (AKS). The application uses SQL Server on Azure VMs for data storage. Compliance requirements mandate encryption at rest and in transit, and data classification labels must be applied automatically to all financial documents stored in Azure Blob Storage. The security team wants to use Microsoft Defender for Cloud to monitor for misconfigurations and threats. You need to design a security solution for the application and data that meets these requirements. Which of the following actions should you take first?

Accepted Answer

Use Microsoft Entra Application Proxy to publish the loan origination application for remote access.. Option C is correct because Entra ID Application Proxy is designed for secure remote access to on-premises applications without a VPN, and it supports conditional access policies for the loan origination application. Option A is wrong because Azure Front Door is a global load balancer and CDN, not a secure remote access solution. Option B is wrong because Azure VPN Gateway creates site-to-site VPN, not per-user remote access. Option D is wrong because Microsoft Entra Domain Services provides domain services but not remote application access.

Answer

Deploy Azure Front Door with WAF policies in front of the loan origination application.

Answer

Configure Azure VPN Gateway to allow site-to-site VPN connections from employee home offices.

Answer

Deploy Microsoft Entra Domain Services to extend the on-premises domain to Azure for authentication.

Question 16

A healthcare organization is using Microsoft Purview to govern its data estate. They have multiple Azure Data Lake Storage accounts and Azure SQL Databases. They need to classify sensitive data such as patient health information (PHI) and apply protection automatically when data is exported from these sources to an external location. The organization also wants to prevent unauthorized users from accessing sensitive data in Azure SQL Database by using built-in security features. The compliance team requires that any access to sensitive data be logged and auditable. You need to design a solution that meets these requirements. What should you implement?

Accepted Answer

Use Microsoft Purview to scan and classify data. Auto-apply sensitivity labels. Implement Azure AD authentication and row-level security in Azure SQL Database. Enable auditing and send to Log Analytics.. Microsoft Purview can scan data sources and classify sensitive data. Sensitivity labels can be applied automatically based on classification. Azure SQL Database supports Azure AD authentication and row-level security to restrict access. Auditing logs can be sent to Log Analytics. Option B combines all these. Option A uses Azure Information Protection (now part of Purview) but does not cover SQL access control. Option C uses data masking which doesn't prevent access. Option D uses Defender for Cloud but not data classification.

Answer

Use Microsoft Purview to scan and classify data. Apply sensitivity labels manually. Configure Azure SQL Database firewall to block all but admin. Use Azure SQL auditing.

Answer

Use Microsoft Defender for Cloud to identify sensitive data. Implement Azure SQL Database always encrypted. Use Azure Monitor to log queries.

Answer

Use Microsoft Purview to classify data. Apply data masking in Azure SQL Database for PHI columns. Use Azure SQL Database threat detection.

Question 17

Your organization, Adatum, is migrating its on-premises applications to Azure. The applications include a legacy .NET Framework web app that uses Windows authentication and a modern ASP.NET Core API that uses OAuth 2.0. You need to design a secure solution for these applications using Azure App Service. The security requirements include: (1) enforce HTTPS only, (2) restrict access to the web app based on the user's corporate identity, (3) allow the API to access an Azure SQL Database using a managed identity. Which of the following is the correct design?

Accepted Answer

Configure both apps to enforce HTTPS only, configure the web app to use Microsoft Entra ID authentication, and configure the API to use a system-assigned managed identity to access Azure SQL Database.. Option D is correct because it meets all requirements: HTTPS only enforced, Microsoft Entra ID authentication for the web app, and managed identity for the API to access SQL Database. Option A is wrong because client certificates do not provide user-level authentication. Option B is wrong because the API should use managed identity, not connection strings. Option C is wrong because SQL authentication is less secure and does not use managed identity.

Answer

Configure the web app to use Windows authentication via Azure AD Domain Services, and the API to use SQL authentication with a managed identity.

Answer

Configure the web app to use Microsoft Entra ID authentication with a built-in policy, and the API to use a connection string with a username and password.

Answer

Configure the web app to require client certificates for authentication, and the API to use a connection string with SQL authentication.

Question 18

A government agency, Northwind, is deploying a sensitive application on Azure App Service Environment (ASE) v3. The application handles classified data and must meet FedRAMP High requirements. You need to design a security solution that includes: (1) encryption at rest for the app's content and configuration, (2) encryption in transit with TLS 1.2 or higher, (3) network isolation using VNet integration and private endpoints, (4) identity-based access to Azure SQL Database using managed identity, and (5) certificate management for custom domains using Azure Key Vault. Which of the following designs meets all requirements?

Accepted Answer

Deploy the app on an ASE v3 in a VNet, enforce HTTPS only with TLS 1.2, use a system-assigned managed identity to access Azure SQL Database, and configure TLS/SSL certificates from Azure Key Vault.. Option A is correct because ASE v3 is deployed in a VNet, providing network isolation. App Service can use managed identity for database access. TLS can be enforced in the app settings. Certificates can be imported from Key Vault. Option B is wrong because App Service on a public plan is not network isolated. Option C is wrong because VNet integration does not provide inbound isolation; private endpoint is needed. Option D is wrong because service principal is less secure than managed identity.

Answer

Deploy the app on a multi-tenant App Service plan, enforce HTTPS only with TLS 1.2, use a system-assigned managed identity to access Azure SQL Database, and configure TLS/SSL certificates from Azure Key Vault.

Answer

Deploy the app on an ASE v3 in a VNet, enforce HTTPS only with TLS 1.2, use a user-assigned managed identity to access Azure SQL Database, and configure TLS/SSL certificates from App Service certificates.

Answer

Deploy the app on an ASE v3 in a VNet, enforce HTTPS only with TLS 1.2, use a service principal to access Azure SQL Database, and configure TLS/SSL certificates from Azure Key Vault.

Question 19

Contoso, a healthcare provider, is deploying a new patient portal on Azure App Service that stores electronic health records (EHR) in Azure Cosmos DB for NoSQL. The solution must comply with HIPAA and HITRUST. You need to ensure that data is encrypted at rest and in transit, and that access is restricted based on user roles. Cosmos DB must be configured with a private endpoint to prevent public internet access. You plan to use Azure Key Vault to manage encryption keys. Additionally, the application will access Cosmos DB using a system-assigned managed identity. Which of the following is the most complete and secure design?

Accepted Answer

Enable encryption at rest using a customer-managed key in Azure Key Vault, enforce TLS 1.2, configure a private endpoint for Cosmos DB, and grant the managed identity access via Azure RBAC with a custom role that allows read/write to specific containers.. Option B is correct because it enables both encryption at rest (with CMK) and encryption in transit (TLS 1.2), uses private endpoints for network isolation, and implements Azure RBAC for granular access control. Option A is wrong because service-managed keys do not meet HIPAA requirements for key control, and firewall rules are less secure than private endpoints. Option C is wrong because RBAC with Cosmos DB built-in roles does not support custom role-based access for patient data. Option D is wrong because disabling encryption at rest is a security risk.

Answer

Enable encryption at rest using service-managed keys, enforce TLS 1.2, configure a service endpoint for Cosmos DB, and grant the managed identity access using Cosmos DB built-in roles (e.g., Cosmos DB Built-in Data Contributor).

Answer

Disable encryption at rest to improve performance, enforce TLS 1.2, configure a private endpoint, and use the managed identity with a read-write key in Azure Key Vault.

Answer

Enable encryption at rest using service-managed keys, enforce TLS 1.2, configure a firewall to allow only the App Service outbound IP, and use read-write keys in application settings.

Question 20

Your company, Lucerne Publishing, is migrating its on-premises SQL Server databases to Azure SQL Managed Instance. The databases contain sensitive customer data subject to GDPR. You need to design a security solution that includes: (1) Always Encrypted for sensitive columns, (2) dynamic data masking for non-privileged users, (3) auditing of all data access, and (4) encryption at rest using customer-managed keys stored in Azure Key Vault. Which of the following configurations should you implement?

Accepted Answer

Enable Always Encrypted for sensitive columns, configure dynamic data masking, enable Azure SQL auditing to a Log Analytics workspace, and enable TDE with a customer-managed key stored in Azure Key Vault.. Option B is correct because it includes all required features: Always Encrypted for column-level encryption, dynamic data masking, auditing via SQL Audit with Log Analytics, and TDE with CMK in Key Vault. Option A is wrong because TDE with service-managed keys does not meet CMK requirement. Option C is wrong because auditing via server-level audit is possible but not as integrated with Log Analytics. Option D is wrong because disabling TDE is not secure.

Answer

Enable Always Encrypted for sensitive columns, configure dynamic data masking, enable auditing via Azure Policy, and enable TDE with a customer-managed key stored in Azure Key Vault.

Answer

Enable Always Encrypted for sensitive columns, configure dynamic data masking, disable TDE to improve performance, and use row-level security to restrict access.

Answer

Enable Always Encrypted for sensitive columns, configure dynamic data masking, enable SQL Server auditing to Azure Blob Storage, and enable Transparent Data Encryption (TDE) with a service-managed key.