SC-100 Design a strategy for data and applications — Timed 15 Questions

Question 1

A company is designing a data protection strategy for Azure SQL Database. They need to ensure that backups are retained for 7 years to meet regulatory compliance. Which Azure feature should they use?

Accepted Answer

Long-Term Retention (LTR). Long-Term Retention (LTR) for Azure SQL Database allows you to retain full database backups for up to 10 years, which meets the 7-year regulatory compliance requirement. LTR is specifically designed for archival and compliance scenarios, storing backups in separate containers with configurable retention policies based on weekly, monthly, or yearly intervals.

Answer

Geo-redundant backup storage

Answer

Point-in-Time Restore

Answer

Active Geo-Replication

Question 2

A company deploys Azure App Service with a custom domain and SSL certificate. They want to enforce HTTPS only. Which configuration setting should they enable?

Accepted Answer

HTTPS Only. The 'HTTPS Only' setting in Azure App Service enforces that all incoming requests are redirected from HTTP to HTTPS, ensuring encrypted communication. This is achieved by returning a 301 redirect for any HTTP request, which aligns with the requirement to enforce HTTPS only.

Answer

Client Certificates

Answer

Minimum TLS Version

Answer

Custom Domain

Question 3

A company uses Azure Policy to audit storage accounts for secure transfer (HTTPS) enforcement. The policy is set to 'AuditIfNotExists' but compliance shows 0% non-compliant storage accounts even though some accounts have secure transfer disabled. What is the most likely cause?

Accepted Answer

The policy should use 'Audit' or 'Deny' effect instead of 'AuditIfNotExists'. The 'AuditIfNotExists' effect is designed to audit resources that do not have a specific extension or sub-resource (e.g., a diagnostic setting or an agent). For a policy that needs to check a property of the storage account itself (like secure transfer enabled), the correct effect is 'Audit' (or 'Deny'). 'AuditIfNotExists' will never flag a storage account as non-compliant for missing the secure transfer property because it is looking for the absence of a child resource, not a property misconfiguration.

Answer

The policy is in 'audit' mode and does not evaluate

Answer

The storage accounts are in a different region

Answer

The policy assignment scope does not include the non-compliant accounts

Question 4

A company is designing a microservices architecture on Azure Kubernetes Service (AKS). They need to secure communication between services using mutual TLS (mTLS). Which solution should they implement?

Accepted Answer

Istio service mesh. Istio service mesh is the correct solution because it provides a dedicated infrastructure layer for managing service-to-service communication, including automatic mutual TLS (mTLS) between microservices. Istio injects Envoy sidecar proxies into each pod, which handle encryption, authentication, and authorization without requiring application code changes. This enables zero-trust network security within the AKS cluster.

Answer

Azure Application Gateway

Answer

Azure Firewall

Answer

Azure API Management

Question 5

A company stores sensitive data in Azure Blob Storage. They want to prevent data exfiltration by blocking public access and restricting network access to only their on-premises data center via VPN. Which two features should they use?

Accepted Answer

Disable public access and configure a service endpoint with a firewall rule for the VPN subnet. Option C is correct because disabling public access ensures the storage account is not reachable from the internet, and configuring a service endpoint with a firewall rule for the VPN subnet restricts traffic to only the on-premises data center traffic arriving via the VPN. Service endpoints provide an optimized route over the Azure backbone, and the firewall rule explicitly allows the VPN subnet's IP range, preventing data exfiltration from unauthorized networks.

Answer

Enable firewall and add on-premises IP range

Answer

Disable public access and use RBAC

Question 6

A company uses Azure Key Vault to store secrets for their applications. They want to ensure that secrets can be automatically rotated when they are close to expiration. Which solution should they implement?

Accepted Answer

Use Key Vault event grid subscription to trigger an Azure Function for rotation. Option C is correct because Azure Key Vault can emit events via Event Grid when a secret is near expiration, and an Azure Function subscribed to that event can perform the rotation logic immediately. This event-driven approach ensures near-real-time rotation without polling, aligning with the requirement for automatic rotation close to expiration.

Answer

Use Azure DevOps release pipeline to rotate secrets

Answer

Use Azure Automation with a schedule to check expiration and rotate

Answer

Use Azure Logic Apps with a recurrence trigger to rotate secrets

Question 7

A company is migrating on-premises applications to Azure. They need to ensure that applications can use their existing Active Directory credentials for authentication. Which Azure service should they use?

Accepted Answer

Azure AD Domain Services. Azure AD Domain Services (Azure AD DS) provides managed domain services such as domain join, group policy, and Kerberos/NTLM authentication. This allows legacy on-premises applications that rely on Active Directory credentials to authenticate without needing to deploy and manage domain controllers in Azure. It bridges the gap by synchronizing identities from Azure AD and exposing traditional AD features over a virtual network.

Answer

Azure Active Directory

Answer

Azure AD Connect

Answer

Azure AD B2C

Question 8

A company wants to protect their Azure App Service web application from common web vulnerabilities like SQL injection and XSS. Which Azure service should they enable?

Accepted Answer

Azure Web Application Firewall (WAF) on Application Gateway. Azure Web Application Firewall (WAF) on Application Gateway is the correct choice because it provides centralized, inbound protection for web applications against common exploits such as SQL injection and cross-site scripting (XSS). WAF inspects HTTP/HTTPS traffic at the application layer (Layer 7) using OWASP Core Rule Sets (CRS) to block malicious payloads before they reach the App Service. This service is specifically designed to defend web workloads, unlike network-layer or generic firewall solutions.

Answer

Azure DDoS Protection

Answer

Azure Firewall

Answer

Azure Front Door with WAF

Question 9

A company is designing a data classification strategy for their Azure environment. They need to identify sensitive data stored in Azure SQL Database. Which TWO solutions should they consider?

Accepted Answer

Azure SQL Data Discovery & Classification. Azure SQL Data Discovery & Classification is correct because it is a native feature of Azure SQL Database that automatically discovers, classifies, and labels sensitive columns (e.g., credit card numbers, PII) directly within the database engine. It provides a built-in dashboard for auditing and monitoring classification status, making it the primary tool for identifying sensitive data stored in Azure SQL Database.

Answer

Azure Information Protection

Answer

Azure Purview

Answer

Azure Policy

Question 10

A company uses Azure Storage for sensitive data. They need to ensure that data is encrypted at rest and that encryption keys are managed by the customer (Customer-Managed Keys). Which THREE actions are required?

Accepted Answer

Create an Azure Key Vault to store the customer-managed key. Option B is correct because customer-managed keys (CMK) for Azure Storage encryption must be stored in an Azure Key Vault, which provides a secure, centralized repository for managing cryptographic keys. Without a Key Vault, the customer cannot control or rotate the encryption keys used by Storage Service Encryption (SSE).

Answer

Enable double encryption

Answer

Enable Azure Information Protection

Question 11

A company is designing a secure DevOps pipeline for deploying Azure App Service applications. They need to ensure that secrets are not exposed in source code. Which TWO practices should they implement?

Accepted Answer

Use Azure Key Vault references in App Service application settings. Option A is correct because Azure Key Vault references allow App Service to securely retrieve secrets (e.g., connection strings, API keys) at runtime without storing them in source code or configuration files. The reference syntax @Microsoft.KeyVault(SecretUri=https://myvault.vault.azure.net/secrets/mysecret/) is resolved by the App Service platform, ensuring secrets are never exposed in the repository or build artifacts.

Answer

Implement Git pre-commit hooks to scan for secrets

Answer

Store secrets in Azure DevOps library variable groups

Answer

Use Azure Policy to audit for secret exposure

Question 12

You are the security architect for Contoso Ltd., a company that runs a critical e-commerce application on Azure Kubernetes Service (AKS). The application consists of multiple microservices that communicate over HTTP. The application uses Azure SQL Database for transactional data and Azure Redis Cache for session state. Recently, a security audit revealed that several microservices are vulnerable to SQL injection attacks because they construct SQL queries by concatenating user input. Additionally, the Redis cache is exposed to the internet with no firewall rules, and the connection string is stored in plain text in the application configuration file. The development team is concerned about performance and wants to minimize changes to the codebase. You need to design a strategy to mitigate these vulnerabilities with minimal code changes. Which of the following is the best course of action?

Accepted Answer

Deploy Azure Web Application Firewall (WAF) on Application Gateway to protect against SQL injection, configure Azure Redis Cache with a private endpoint and disable public network access, and use Azure Key Vault with a managed identity to inject the Redis connection string into the application.. Option A is correct because it addresses all three vulnerabilities with minimal code changes: Azure WAF on Application Gateway provides network-layer SQL injection protection without modifying application code; configuring Azure Redis Cache with a private endpoint and disabling public network access secures the cache without code changes; and using Azure Key Vault with a managed identity injects the Redis connection string securely at runtime, eliminating plain-text storage without altering the application's configuration loading logic.

Answer

Enable Azure Web Application Firewall (WAF) on an Application Gateway in front of AKS to block SQL injection, move Redis to a private endpoint with a firewall rule, and use Azure Key Vault with a managed identity to inject the Redis connection string.

Answer

Move all SQL queries to stored procedures, enable Redis persistence with AOF, and store the connection string in a Kubernetes secret.

Answer

Refactor the microservices to use parameterized SQL queries, configure Azure Redis Cache firewall to allow only AKS node IPs, and store the connection string in Azure Key Vault with a managed identity.

Question 13

A company uses Azure App Service to host a web application that stores sensitive data in Azure SQL Database. The security team requires that data at rest in the database be encrypted using a customer-managed key stored in Azure Key Vault. The key must be rotated automatically every 90 days. What is the recommended approach to meet these requirements?

Accepted Answer

Enable TDE with customer-managed keys in Azure Key Vault and set a key rotation policy in Key Vault to rotate the key every 90 days.. Option C is correct because Transparent Data Encryption (TDE) with customer-managed keys (CMK) in Azure Key Vault meets the requirement for encrypting data at rest in Azure SQL Database using a key controlled by the customer. Azure Key Vault supports automatic key rotation policies that can be set to rotate the key every 90 days, satisfying the rotation requirement without manual intervention or application code changes.

Answer

Encrypt sensitive columns using cell-level encryption with keys stored in Azure Key Vault and rotate keys manually every 90 days.

Answer

Enable Transparent Data Encryption (TDE) with service-managed keys in Azure SQL Database.

Answer

Use Always Encrypted with column master keys stored in Azure Key Vault and configure key rotation in the application code.

Question 14

A multinational corporation is designing a data classification strategy for Microsoft 365. They have the following requirements: (1) Documents containing financial data must be labeled as 'Confidential' automatically. (2) Labels must be applied based on content patterns, such as credit card numbers. (3) The solution must work across Exchange Online, SharePoint Online, and OneDrive for Business. Which two components are essential?

Accepted Answer

Sensitivity labels in Microsoft Purview Information Protection. Sensitivity labels in Microsoft Purview Information Protection are the core technology for classifying and protecting data based on content patterns. They support automatic labeling via auto-labeling policies that scan for sensitive data types (e.g., credit card numbers) and can apply labels across Exchange Online, SharePoint Online, and OneDrive for Business. This directly meets all three requirements: automatic labeling, pattern-based detection, and cross-workload coverage.

Answer

Azure Information Protection (AIP) unified labeling client

Answer

Data Loss Prevention (DLP) policies in Microsoft 365 Security & Compliance Center

Answer

Retention policies in Microsoft 365 Compliance Center

Question 15

A security administrator applies the Azure Policy definition shown in the exhibit to a management group containing multiple subscriptions. After the policy is assigned, a development team reports they cannot create a new storage account in their subscription. What is the most likely cause?

Accepted Answer

The storage account was created with the 'Secure transfer required' setting disabled.. The Azure Policy definition in the exhibit likely includes an effect (e.g., 'Deny') that requires the 'Secure transfer required' setting to be enabled on storage accounts. When the development team attempts to create a storage account with this setting disabled, the policy denies the request, preventing the creation. This is the most direct cause because Azure Policy enforces compliance rules at resource creation time, and disabling secure transfer violates the policy's condition.

Answer

The storage account was created using an older API version that does not support Azure Policy enforcement.

Answer

The storage account was created in a region that does not support the premium tier.

Answer

The storage account was assigned a network security group (NSG) that blocks inbound HTTPS traffic.