SC-100 Design a strategy for data and applications — 10 Questions

Question 1

A company is designing a data protection strategy for Azure SQL Database. They need to ensure that backups are retained for 7 years to meet regulatory compliance. Which Azure feature should they use?

Accepted Answer

Long-Term Retention (LTR). Long-Term Retention (LTR) for Azure SQL Database allows you to retain full database backups for up to 10 years, which meets the 7-year regulatory compliance requirement. LTR is specifically designed for archival and compliance scenarios, storing backups in separate containers with configurable retention policies based on weekly, monthly, or yearly intervals.

Answer

Geo-redundant backup storage

Answer

Point-in-Time Restore

Answer

Active Geo-Replication

Question 2

A company deploys Azure App Service with a custom domain and SSL certificate. They want to enforce HTTPS only. Which configuration setting should they enable?

Accepted Answer

HTTPS Only. The 'HTTPS Only' setting in Azure App Service enforces that all incoming requests are redirected from HTTP to HTTPS, ensuring encrypted communication. This is achieved by returning a 301 redirect for any HTTP request, which aligns with the requirement to enforce HTTPS only.

Answer

Client Certificates

Answer

Minimum TLS Version

Answer

Custom Domain

Question 3

A company uses Azure Policy to audit storage accounts for secure transfer (HTTPS) enforcement. The policy is set to 'AuditIfNotExists' but compliance shows 0% non-compliant storage accounts even though some accounts have secure transfer disabled. What is the most likely cause?

Accepted Answer

The policy should use 'Audit' or 'Deny' effect instead of 'AuditIfNotExists'. The 'AuditIfNotExists' effect is designed to audit resources that do not have a specific extension or sub-resource (e.g., a diagnostic setting or an agent). For a policy that needs to check a property of the storage account itself (like secure transfer enabled), the correct effect is 'Audit' (or 'Deny'). 'AuditIfNotExists' will never flag a storage account as non-compliant for missing the secure transfer property because it is looking for the absence of a child resource, not a property misconfiguration.

Answer

The policy is in 'audit' mode and does not evaluate

Answer

The storage accounts are in a different region

Answer

The policy assignment scope does not include the non-compliant accounts

Question 4

A company is designing a microservices architecture on Azure Kubernetes Service (AKS). They need to secure communication between services using mutual TLS (mTLS). Which solution should they implement?

Accepted Answer

Istio service mesh. Istio service mesh is the correct solution because it provides a dedicated infrastructure layer for managing service-to-service communication, including automatic mutual TLS (mTLS) between microservices. Istio injects Envoy sidecar proxies into each pod, which handle encryption, authentication, and authorization without requiring application code changes. This enables zero-trust network security within the AKS cluster.

Answer

Azure Application Gateway

Answer

Azure Firewall

Answer

Azure API Management

Question 5

A company stores sensitive data in Azure Blob Storage. They want to prevent data exfiltration by blocking public access and restricting network access to only their on-premises data center via VPN. Which two features should they use?

Accepted Answer

Disable public access and configure a service endpoint with a firewall rule for the VPN subnet. Option C is correct because disabling public access ensures the storage account is not reachable from the internet, and configuring a service endpoint with a firewall rule for the VPN subnet restricts traffic to only the on-premises data center traffic arriving via the VPN. Service endpoints provide an optimized route over the Azure backbone, and the firewall rule explicitly allows the VPN subnet's IP range, preventing data exfiltration from unauthorized networks.

Answer

Enable firewall and add on-premises IP range

Answer

Disable public access and use RBAC

Question 6

A company uses Azure Key Vault to store secrets for their applications. They want to ensure that secrets can be automatically rotated when they are close to expiration. Which solution should they implement?

Accepted Answer

Use Key Vault event grid subscription to trigger an Azure Function for rotation. Option C is correct because Azure Key Vault can emit events via Event Grid when a secret is near expiration, and an Azure Function subscribed to that event can perform the rotation logic immediately. This event-driven approach ensures near-real-time rotation without polling, aligning with the requirement for automatic rotation close to expiration.

Answer

Use Azure DevOps release pipeline to rotate secrets

Answer

Use Azure Automation with a schedule to check expiration and rotate

Answer

Use Azure Logic Apps with a recurrence trigger to rotate secrets

Question 7

A company is migrating on-premises applications to Azure. They need to ensure that applications can use their existing Active Directory credentials for authentication. Which Azure service should they use?

Accepted Answer

Azure AD Domain Services. Azure AD Domain Services (Azure AD DS) provides managed domain services such as domain join, group policy, and Kerberos/NTLM authentication. This allows legacy on-premises applications that rely on Active Directory credentials to authenticate without needing to deploy and manage domain controllers in Azure. It bridges the gap by synchronizing identities from Azure AD and exposing traditional AD features over a virtual network.

Answer

Azure Active Directory

Answer

Azure AD Connect

Answer

Azure AD B2C

Question 8

A company wants to protect their Azure App Service web application from common web vulnerabilities like SQL injection and XSS. Which Azure service should they enable?

Accepted Answer

Azure Web Application Firewall (WAF) on Application Gateway. Azure Web Application Firewall (WAF) on Application Gateway is the correct choice because it provides centralized, inbound protection for web applications against common exploits such as SQL injection and cross-site scripting (XSS). WAF inspects HTTP/HTTPS traffic at the application layer (Layer 7) using OWASP Core Rule Sets (CRS) to block malicious payloads before they reach the App Service. This service is specifically designed to defend web workloads, unlike network-layer or generic firewall solutions.

Answer

Azure DDoS Protection

Answer

Azure Firewall

Answer

Azure Front Door with WAF

Question 9

A company is designing a data classification strategy for their Azure environment. They need to identify sensitive data stored in Azure SQL Database. Which TWO solutions should they consider?

Accepted Answer

Azure SQL Data Discovery & Classification. Azure SQL Data Discovery & Classification is correct because it is a native feature of Azure SQL Database that automatically discovers, classifies, and labels sensitive columns (e.g., credit card numbers, PII) directly within the database engine. It provides a built-in dashboard for auditing and monitoring classification status, making it the primary tool for identifying sensitive data stored in Azure SQL Database.

Answer

Azure Information Protection

Answer

Azure Purview

Answer

Azure Policy

Question 10

A company uses Azure Storage for sensitive data. They need to ensure that data is encrypted at rest and that encryption keys are managed by the customer (Customer-Managed Keys). Which THREE actions are required?

Accepted Answer

Create an Azure Key Vault to store the customer-managed key. Option B is correct because customer-managed keys (CMK) for Azure Storage encryption must be stored in an Azure Key Vault, which provides a secure, centralized repository for managing cryptographic keys. Without a Key Vault, the customer cannot control or rotate the encryption keys used by Storage Service Encryption (SSE).

Answer

Enable double encryption

Answer

Enable Azure Information Protection