SC-100 Design security solutions for applications and data Practice Test 12 — 15 Questions

Question 1

A company uses Azure Cosmos DB with Microsoft Defender for Cloud to protect its NoSQL database. The security team wants to audit all data plane operations for compliance. Which diagnostic setting should they enable?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

DataPlaneRequests. DataPlaneRequests logs contain all data plane operations on the Azure Cosmos DB account, including read, write, delete, and query requests. Option A is wrong because MongoRequests logs only MongoDB API-specific operations, not all data plane operations. Option B is wrong because PartitionKeyStatistics logs partition key statistics, not operations. Option C is wrong because QueryRuntimeStatistics logs query execution statistics, not operations.

Answer

MongoRequests

Answer

PartitionKeyStatistics

Answer

QueryRuntimeStatistics

Question 2

Which TWO data protection mechanisms should you implement to protect data at rest in Azure SQL Database?

Accepted Answer

Transparent Data Encryption (TDE). Options A (Transparent Data Encryption) and E (Always Encrypted) are correct. TDE encrypts the database files at rest, while Always Encrypted protects sensitive columns at rest and in use by encrypting them with client-side keys. Option B (Azure Policy) is a governance tool, not an encryption mechanism. Option C (Role-Based Access Control) manages permissions, not encryption. Option D (Azure Firewall) is a network security service and does not protect data at rest.

Answer

Azure Policy

Answer

Role-Based Access Control (RBAC)

Answer

Azure Firewall

Question 3

Which THREE actions should you take to secure a CI/CD pipeline using Azure DevOps and GitHub?

Accepted Answer

Enable secret scanning in GitHub to detect leaked credentials. Options A, D, and E are correct. Secret scanning (A) detects leaked credentials, storing secrets in Azure Key Vault (D) provides secure secret management, and branch protection rules (E) enforce checks before merging. Option B is wrong because running with administrative privileges increases the attack surface and risk of privilege escalation. Option C is wrong because disabling pull request code reviews reduces oversight and can allow vulnerabilities to be merged.

Answer

Run all pipeline tasks with administrative privileges

Answer

Disable pull request code reviews to speed deployment

Question 4

Which TWO Microsoft Purview features can be used to classify and label data in Microsoft 365?

Accepted Answer

Auto-labeling policies. Options C and E are correct. Sensitive info types define patterns to identify sensitive data, enabling classification. Auto-labeling policies automatically apply sensitivity labels based on those patterns. Option A is incorrect because retention policies manage data retention periods, not classification or labeling. Option B is incorrect because eDiscovery is used for legal discovery, not classification. Option D is incorrect because audit logs track activities but do not classify or label data.

Answer

Retention policies

Answer

eDiscovery

Answer

Audit logs

Question 5

Which THREE security controls should you implement to protect a web application against common OWASP Top 10 vulnerabilities?

Accepted Answer

Input validation on all user inputs. Options B, C, and D are correct. Input validation (B) prevents injection attacks like SQL injection and XSS. Content Security Policy (C) headers mitigate XSS by restricting resource loading. A Web Application Firewall (D) blocks common OWASP threats such as SQL injection and XSS. Option A is incorrect because RBAC manages authorization, not application layer attacks. Option E is incorrect because MFA is an identity control, not a direct defense against OWASP vulnerabilities.

Answer

Role-Based Access Control (RBAC)

Answer

Multi-factor authentication (MFA)

Question 6

Which TWO actions should you take to secure Azure Functions with HTTP triggers?

Accepted Answer

Enable App Service Authentication (EasyAuth). Options A and B are correct. Enabling App Service Authentication (EasyAuth) provides built-in authentication for Azure Functions, ensuring only authenticated users can trigger the function. Configuring network restrictions to allow only specific IP ranges limits access to trusted sources, reducing the attack surface. Option C is incorrect because setting authorization level to anonymous allows anyone to trigger the function without authentication, which is insecure. Option D is incorrect because Application Insights is a monitoring and diagnostics tool, not a security control. Option E is incorrect because relying solely on function keys provides only basic authentication and lacks robust security features like token validation or integration with identity providers.

Answer

Set authorization level to anonymous

Answer

Enable Application Insights

Answer

Use function keys only

Question 7

Your company is deploying a new AI-powered customer service chatbot using Azure OpenAI Service. The chatbot will access customer data stored in Azure Cosmos DB. The security team requires that all data in transit is encrypted, and that the chatbot only accesses data necessary for its function. Additionally, the chatbot must use managed identities to authenticate to Cosmos DB. You need to design the security architecture. Which combination of controls should you implement?

Accepted Answer

Enable TLS enforcement on Cosmos DB. Use a managed identity for the chatbot and assign the Cosmos DB Built-in Data Reader role. Configure the chatbot to authenticate using the managed identity.. It enforces TLS for data in transit, uses a managed identity for authentication, and assigns the Cosmos DB Built-in Data Reader role to implement least privilege access. Option A is incorrect because IP restrictions alone do not provide authentication and the Account Reader role does not allow data access. Option B is incorrect because using a connection string exposes secrets and the Contributor role grants excessive permissions. Option D is incorrect because it uses a service principal instead of a managed identity, which is a requirement.

Answer

Restrict network access to the chatbot's IP address. Use a system-assigned managed identity and assign the Cosmos DB Account Reader role.

Answer

Use a connection string with the Cosmos DB account key and enforce TLS 1.2. Grant the chatbot's managed identity contributor role.

Answer

Use Azure AD authentication with a service principal and assign the Cosmos DB Built-in Data Contributor role. Enforce TLS 1.2.

Question 8

Your organization uses Microsoft Defender for Cloud Apps to monitor shadow IT. You discover that employees are using a third-party file sharing app that is not sanctioned. The security team wants to block access to this app from managed devices and require authentication for unmanaged devices. You need to configure the appropriate controls in Defender for Cloud Apps. What should you do?

Accepted Answer

Create an access policy to block the app on unmanaged devices and require authentication on managed devices.. It uses access policies to block unmanaged devices and require authentication, which aligns with the requirement. Option A is wrong because session policies monitor but do not block. Option B is wrong because app governance policies manage app permissions. Option D is wrong because DLP policies focus on data protection.

Answer

Create a session policy that monitors file uploads to the app.

Answer

Create an app governance policy to restrict the app's permissions.

Answer

Configure a DLP policy to prevent sharing of sensitive data through the app.

Question 9

A multinational retail company, Northwind Traders, is building a new e-commerce platform on Azure. The platform includes a public-facing API built on Azure API Management (APIM) that processes orders containing personal data (PII). The company uses Microsoft Entra ID for identity management. You need to design a security solution that protects the API from common web vulnerabilities (e.g., SQL injection, XSS) and ensures that only authenticated users with the appropriate role can place orders. Additionally, you need to log and monitor all API requests for security auditing. Which combination of services should you use?

Accepted Answer

Use Azure API Management with built-in WAF, configure OAuth 2.0 authorization with Microsoft Entra ID, and enable Azure Monitor and Log Analytics for logging and alerting.. Azure API Management (APIM) can integrate with Azure Web Application Firewall (WAF) via Application Gateway or Front Door to protect against OWASP top 10 threats like SQL injection and XSS. However, APIM itself does not have a built-in WAF; but in this option, it is implied that WAF is applied at the APIM level (typically via policy or integration). More importantly, OAuth 2.0 authorization with Microsoft Entra ID ensures that only authenticated users with the appropriate role can place orders, and enabling Azure Monitor and Log Analytics provides comprehensive logging, monitoring, and alerting for security auditing. Option A is wrong because Azure Firewall operates at the network layer and does not protect against application-layer attacks, client certificate authentication provides transport security but not authorization, and Azure Monitor alone lacks the query and alerting capabilities of Log Analytics. Option C is wrong because IP whitelisting does not authenticate users or enforce role-based access, and sending logs to a storage account does not enable real-time monitoring or alerting. Option D is wrong because IP whitelisting is insufficient for authentication/authorization, and while Azure Front Door with WAF provides some protection, the lack of OAuth 2.0 and Entra ID integration means authorization is not properly enforced; also, Microsoft Sentinel is a SIEM and not primarily a logging destination for API requests.

Answer

Use Azure Firewall to filter traffic, implement client certificate authentication in APIM, and use Azure Monitor for logging.

Answer

Use Azure Application Gateway with WAF in front of APIM, configure IP whitelisting on APIM, and enable diagnostic settings to send logs to a storage account.

Answer

Use Azure Front Door with WAF in front of APIM, configure IP whitelisting on APIM, and use Microsoft Sentinel for logging.

Question 10

Your organization, Adatum, is migrating its on-premises applications to Azure. The applications include a legacy .NET Framework web app that uses Windows authentication and a modern ASP.NET Core API that uses OAuth 2.0. You need to design a secure solution for these applications using Azure App Service. The security requirements include: (1) enforce HTTPS only, (2) restrict access to the web app based on the user's corporate identity, (3) allow the API to access an Azure SQL Database using a managed identity. Which of the following is the correct design?

Accepted Answer

Configure both apps to enforce HTTPS only, configure the web app to use Microsoft Entra ID authentication, and configure the API to use a system-assigned managed identity to access Azure SQL Database.. It meets all requirements: HTTPS only enforced, Microsoft Entra ID authentication for the web app, and managed identity for the API to access Azure SQL Database. Option A is wrong because Windows authentication via Azure AD Domain Services is not the recommended approach for user authentication in App Service; instead, Microsoft Entra ID authentication should be used. Additionally, the API in option A uses SQL authentication, not managed identity. Option B is wrong because the API should use managed identity, not connection strings. Option C is wrong because SQL authentication is less secure and does not use managed identity.

Answer

Configure the web app to use Windows authentication via Azure AD Domain Services, and the API to use SQL authentication with a managed identity.

Answer

Configure the web app to use Microsoft Entra ID authentication with a built-in policy, and the API to use a connection string with a username and password.

Answer

Configure the web app to require client certificates for authentication, and the API to use a connection string with SQL authentication.

Question 11

Trey Research, a biotech firm, is developing a machine learning model on Azure Machine Learning that uses sensitive genomic data. The data is stored in Azure Blob Storage. The company requires that all data be encrypted at rest using customer-managed keys stored in Azure Key Vault, and that access to the storage account be restricted to the Azure Machine Learning workspace and specific data scientists via Azure AD authentication. Additionally, the storage account must be accessible only from the company's virtual network. Which of the following configurations should you implement?

Accepted Answer

Enable encryption at rest with a customer-managed key, configure a private endpoint for the storage account, and grant the Machine Learning workspace and data scientists access using Azure RBAC with the Storage Blob Data Contributor role.. It provides encryption at rest with a customer-managed key (CMK) stored in Azure Key Vault, a private endpoint to restrict access to the company's virtual network, and Azure RBAC with the Storage Blob Data Contributor role for both the Machine Learning workspace and data scientists, ensuring Azure AD authentication. Option A is wrong because firewall rules using IP ranges are less secure than private endpoints, and granting access via storage account access keys bypasses Azure AD authentication. Option B is wrong because it uses a service-managed key, which does not meet the customer-managed key requirement. Option D is wrong because a service endpoint is less secure than a private endpoint, and using a SAS token does not provide Azure AD-based access control.

Answer

Enable encryption at rest with a customer-managed key, configure a firewall to allow the Machine Learning workspace's IP range, and grant data scientists access via storage account access keys.

Answer

Enable encryption at rest with a service-managed key, configure a private endpoint, and grant data scientists access using Azure RBAC with the Storage Blob Data Reader role.

Answer

Enable encryption at rest with a customer-managed key, configure a service endpoint for the storage account, and grant the Machine Learning workspace access using a SAS token.

Question 12

A startup, Alpine Ski House, is developing a mobile app that allows users to book ski lessons. The app communicates with an Azure Function App backend via REST APIs. The function app stores data in Azure Cosmos DB. The company wants to secure the API endpoints using OAuth 2.0 with Microsoft Entra ID and ensure that only authenticated users can invoke the functions. The function app should also use a managed identity to access Cosmos DB. Which of the following configurations should you implement?

Accepted Answer

Configure the function app to require authentication with Microsoft Entra ID, enforce HTTPS only, and use a system-assigned managed identity to access Cosmos DB.. It uses OAuth 2.0 with Entra ID for authentication, managed identity for database access, and enforces HTTPS. Option B is wrong because function keys are not secure for user authentication. Option C is wrong because client certificates do not provide user-level authentication. Option D is wrong because IP whitelisting is not a substitute for authentication.

Answer

Configure the function app to use function-level authorization keys, enforce HTTPS only, and use a connection string with a read-write key to access Cosmos DB.

Answer

Configure the function app to require client certificates, enforce HTTPS only, and use a managed identity to access Cosmos DB.

Answer

Configure the function app to use IP whitelisting, enforce HTTPS only, and use a managed identity to access Cosmos DB.

Question 13

Your company, Lucerne Publishing, is migrating its on-premises SQL Server databases to Azure SQL Managed Instance. The databases contain sensitive customer data subject to GDPR. You need to design a security solution that includes: (1) Always Encrypted for sensitive columns, (2) dynamic data masking for non-privileged users, (3) auditing of all data access, and (4) encryption at rest using customer-managed keys stored in Azure Key Vault. Which of the following configurations should you implement?

Accepted Answer

Enable Always Encrypted for sensitive columns, configure dynamic data masking, enable Azure SQL auditing to a Log Analytics workspace, and enable TDE with a customer-managed key stored in Azure Key Vault.. It includes all required features: Always Encrypted for column-level encryption, dynamic data masking, Azure SQL auditing to a Log Analytics workspace (which integrates with Azure Monitor for centralized auditing), and TDE using customer-managed keys (CMK) stored in Azure Key Vault to meet the encryption-at-rest requirement. Option A is incorrect because it mentions enabling auditing via Azure Policy, which is not the standard auditing method for Azure SQL Managed Instance; instead, Azure SQL auditing to Log Analytics is needed. Also, TDE with a customer-managed key must be explicitly configured. Option B is incorrect because disabling TDE would compromise encryption at rest, and row-level security is not required. Option C is incorrect because TDE with a service-managed key does not fulfill the customer-managed key requirement.

Answer

Enable Always Encrypted for sensitive columns, configure dynamic data masking, enable auditing via Azure Policy, and enable TDE with a customer-managed key stored in Azure Key Vault.

Answer

Enable Always Encrypted for sensitive columns, configure dynamic data masking, disable TDE to improve performance, and use row-level security to restrict access.

Answer

Enable Always Encrypted for sensitive columns, configure dynamic data masking, enable SQL Server auditing to Azure Blob Storage, and enable Transparent Data Encryption (TDE) with a service-managed key.

Question 14

A software company, SouthRidge, is deploying a multi-tier application on Azure Virtual Machines. The web tier runs IIS, the application tier runs a .NET application, and the data tier runs SQL Server. You need to ensure that all traffic between tiers is encrypted, and that the application tier can access the database using a managed identity. The solution should also include a web application firewall (WAF) to protect the web tier from common attacks. Which of the following designs should you use?

Accepted Answer

Use IPsec encryption between tiers, deploy Azure Application Gateway with WAF in front of the web tier, and use a managed identity for the application tier to access SQL Server.. It provides encryption between tiers via IPsec, WAF for web protection, and managed identity for database access. Option A is wrong because application-level encryption is complex and not standard. Option B is wrong because SSL/TLS termination at the load balancer means traffic inside the VNet is unencrypted. Option C is wrong because the web tier should not have direct database access; application tier should.

Answer

Use application-level encryption between tiers, deploy Azure Application Gateway with WAF in front of the web tier, and use a service principal to access SQL Server.

Answer

Use SSL/TLS termination at the Azure Load Balancer, deploy Azure Front Door with WAF, and use a managed identity for the web tier to access SQL Server.

Answer

Use IPsec encryption between tiers, deploy Azure Application Gateway with WAF, and use a managed identity for the web tier to access SQL Server.

Question 15

A hospital, Contoso Health, is deploying an Azure API Management (APIM) instance to expose healthcare APIs that comply with HIPAA. The APIs are hosted on Azure Functions and Azure Logic Apps. You need to design a security solution that includes: (1) authentication and authorization using Microsoft Entra ID, (2) protection against OWASP top 10 threats, (3) encryption of sensitive data in transit and at rest, and (4) logging and monitoring of all API calls. Which THREE of the following should you implement?

Accepted Answer

Configure OAuth 2.0 authorization with Microsoft Entra ID in APIM.. The stem requires four security capabilities: (1) authentication/authorization with Microsoft Entra ID, (2) protection against OWASP Top 10, (3) encryption in transit and at rest, and (4) logging and monitoring. Option B fulfills capability 1, Option D fulfills capability 2, and Option E fulfills capability 4. Encryption (capability 3) is already provided by Azure APIM via TLS for transit and Azure Storage Service Encryption for at rest, so it does not require a separate selection from the listed options. Option A does not provide user authentication/authorization, and Option C provides client certificate authentication but does not satisfy the Entra ID-based authentication requirement and is not needed for encryption. Therefore, the correct selections are B, D, and E.

Answer

Configure IP whitelisting on APIM to restrict access to known IP addresses.

Answer

Configure mutual TLS (mTLS) authentication with client certificates.