SC-100 Design security solutions for applications and data Practice Test 13 — 15 Questions

Question 1

Your company, Fabrikam, is designing a solution to securely store and manage secrets (e.g., API keys, database passwords) for cloud applications. The solution must use Azure Key Vault and support automatic rotation of secrets. The applications will run on Azure VMs and Azure App Service. Which TWO of the following should you include in your design?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Implement automatic secret rotation using Key Vault with Event Grid and Azure Functions.. Key Vault can integrate with Event Grid and Azure Functions to automatically rotate secrets when they are near expiration. Option E is correct because managed identities allow Azure VMs and App Service to authenticate to Key Vault without storing credentials, eliminating the need for service principals or client secrets. Option A is wrong because using service principals with client secrets still requires managing those secrets, which defeats the purpose of secure secret storage. Option B is wrong because manual rotation using Azure Automation runbooks is not automatic and requires custom scripting and scheduling. Option C is wrong because storing secrets in application configuration files, even if encrypted, introduces additional complexity and risk compared to using Key Vault directly.

Answer

Use service principals with client secrets to authenticate to Key Vault.

Answer

Rotate secrets manually using Azure Automation runbooks on a schedule.

Answer

Store secrets in application configuration files encrypted with Azure Key Vault.

Question 2

A financial institution, Contoso Bank, is deploying a new application on Azure Kubernetes Service (AKS) that processes credit card transactions (PCI DSS). The application uses Azure SQL Database and Azure Redis Cache. You need to design a security solution that meets PCI DSS requirements. Which THREE of the following should you implement?

Accepted Answer

Deploy AKS as a private cluster with no public endpoint.. To meet PCI DSS requirements for the described application, the following measures are necessary: Option A is correct because deploying AKS as a private cluster with no public endpoint isolates the cluster from the internet, reducing the attack surface and meeting network segmentation requirements. Option B is correct because Always Encrypted for sensitive columns (e.g., credit card data) ensures data is encrypted at rest and in transit between the application and database, protecting cardholder data. Option D is correct because using private endpoints for Azure SQL Database and Azure Cache for Redis ensures that traffic to these services stays within the Microsoft network and avoids exposure to the public internet, fulfilling network isolation controls. Option C is incorrect because Azure RBAC for Kubernetes authorization manages access control but does not directly address PCI DSS requirements for data protection or network segmentation; it is a complementary security measure but not a primary requirement. Option E is incorrect because disabling TLS for Azure Cache for Redis would allow unencrypted communication, which violates PCI DSS encryption-in-transit requirements; TLS must be enforced.

Answer

Enable Azure RBAC for Kubernetes authorization.

Answer

Disable TLS for Azure Cache for Redis to improve performance.

Question 3

A software company, Northwind, is developing a mobile app that uses Microsoft Entra ID for authentication. The app accesses an Azure Function App backend that stores data in Azure Cosmos DB. The company wants to implement a defense-in-depth security strategy. Which TWO of the following should you implement?

Accepted Answer

Use OAuth 2.0 with Microsoft Entra ID to secure the Azure Functions.. OAuth 2.0 with Microsoft Entra ID provides proper user authentication and authorization for the mobile app to access Azure Functions, aligning with defense-in-depth. Option C is correct because configuring Azure Cosmos DB with a private endpoint ensures data is accessed only over a private network, reducing exposure to the public internet. Options B (IP whitelisting) provides network-level security but not user authentication, so it is insufficient. Option D (function-level keys) is not user-specific and is intended for service-to-service calls, not user authentication. Option E is incorrect because TLS 1.0 is deprecated and insecure; TLS 1.2 or higher should be enforced.

Answer

Restrict access to the Azure Functions by IP whitelisting.

Answer

Use function-level authorization keys for the Azure Functions.

Answer

Enforce TLS 1.0 for all API calls.

Question 4

Your organization, Contoso Ltd., is a multinational financial services company that handles sensitive customer financial data. They are migrating a critical loan origination application from on-premises to Azure Kubernetes Service (AKS). The application uses SQL Server on Azure VMs for data storage. Compliance requirements mandate encryption at rest and in transit, and data classification labels must be applied automatically to all financial documents stored in Azure Blob Storage. The security team wants to use Microsoft Defender for Cloud to monitor for misconfigurations and threats. You need to design a security solution for the application and data that meets these requirements. Which of the following actions should you take first?

Accepted Answer

Deploy Azure Front Door with WAF policies in front of the loan origination application.. Deploying Azure Front Door with WAF policies is the first action that directly addresses multiple requirements: it enforces HTTPS for encryption in transit, integrates with Microsoft Defender for Cloud for monitoring web application threats and misconfigurations, and provides a scalable entry point for the loan origination application. While data classification for Blob Storage and encryption at rest are separate tasks, securing the front door is a critical initial step in the migration. Option A (Application Proxy) is for remote access, which is not required. Option C (VPN Gateway) provides site-to-site connectivity, not relevant for application security. Option D (Domain Services) extends authentication but does not address the specified security controls.

Answer

Use Microsoft Entra Application Proxy to publish the loan origination application for remote access.

Answer

Configure Azure VPN Gateway to allow site-to-site VPN connections from employee home offices.

Answer

Deploy Microsoft Entra Domain Services to extend the on-premises domain to Azure for authentication.

Question 5

Your organization is deploying a new line-of-business application on Azure App Service. The app must authenticate users from Microsoft Entra ID and also access a downstream API that requires a client secret. You need to recommend the most secure method for managing the client secret. What should you use?

Accepted Answer

Store the secret in Azure Key Vault and use a Key Vault reference in App Service.. Azure Key Vault provides secure storage for secrets and certificates, and App Service can reference them via managed identity or Key Vault references. Option A is wrong because the Azure AD app registration manifest is for application configuration and should not be used to store secrets; instead, use the 'Certificates & secrets' section. Option B is wrong because App Service application settings are less secure and can be accessed through the portal, lacking the fine-grained access control and auditing of Key Vault. Option D is wrong because storing the secret in code exposes it to source control and accidental disclosure.

Answer

Store the secret in the Azure AD app registration manifest.

Answer

Store the secret in an App Service application setting.

Answer

Store the secret in the application code as a constant.

Question 6

You are designing an API management solution using Azure API Management. The security team requires that all API calls must be authenticated using OAuth 2.0 and that only specific Azure AD applications can access the APIs. Additionally, the solution must support rate limiting and IP filtering. What should you configure?

Accepted Answer

Configure OAuth 2.0 in Azure API Management, use validate-jwt policy to restrict to specific Azure AD apps, and add rate-limit and ip-filter policies. It fully addresses all requirements: it uses OAuth 2.0 with Azure AD for authentication, the 'validate-jwt' policy restricts access to specific Azure AD applications, and the 'rate-limit' and 'ip-filter' policies satisfy the rate limiting and IP filtering requirements. Option A is incorrect because client certificate authentication is not OAuth 2.0. Option B is incorrect because API key authentication is less secure and does not allow restricting to specific Azure AD apps. Option C is incorrect because while it uses OAuth 2.0 and validate-jwt, it does not include the required rate limiting and IP filtering policies.

Answer

Set up client certificate authentication and map certificates to Azure AD apps

Answer

Enable API key authentication and restrict access using subscription keys

Answer

Use OAuth 2.0 with Azure AD and configure inbound policies to validate JWTs

Question 7

You are designing a secure access strategy for Azure App Service web applications. The requirements are: use Azure AD for authentication, restrict access to specific IP ranges, and require multi-factor authentication (MFA) for all users. Which two components should you configure? (Choose two.)

Accepted Answer

Configure Azure App Service authentication with Microsoft Entra ID. Options B and C are correct. Azure App Service authentication can be configured to use Microsoft Entra ID for user authentication, and a Conditional Access policy can enforce MFA and restrict IP ranges. Option A is incorrect because applying an NSG to the App Service subnet is not the direct method for IP restriction; IP restrictions can be configured directly in the App Service settings. Option D is incorrect because Azure Firewall is a network-level firewall and does not handle user authentication or application-level access control. Option E is incorrect because registering the application is a prerequisite but not a component that directly enforces access rules.

Answer

Apply a network security group (NSG) to the App Service subnet

Answer

Deploy Azure Firewall to filter inbound traffic

Answer

Register the application in Microsoft Entra ID

Question 8

A company uses Microsoft Defender for Cloud to secure their Azure workloads. They need to ensure that all Azure SQL databases have threat detection enabled. Which TWO actions should they take? (Choose two.)

Accepted Answer

Enable Azure Defender for SQL at the subscription level. The 'SQL servers on machines' plan applies to SQL Server instances on Azure VMs (IaaS), not to Azure SQL Database (PaaS). Option B is correct: enabling Azure Defender for SQL at the subscription level automatically enables threat detection for all Azure SQL databases in that subscription. Option C is incorrect: SQL Vulnerability Assessment identifies vulnerabilities but does not enable threat detection. Option D is correct: enabling Advanced Threat Protection on each SQL server individually also ensures threat detection for all databases on that server, though it is less efficient than subscription-level enablement. Option E is incorrect: SQL auditing is for compliance and auditing, not threat detection.

Answer

Enable Microsoft Defender for Cloud's 'SQL servers on machines' plan

Answer

Configure SQL Vulnerability Assessment

Answer

Configure SQL auditing on each database

Question 9

A company is designing a data classification strategy using Microsoft Purview. They need to automatically classify and protect sensitive data stored in Azure Blob Storage. Which TWO capabilities should they use? (Choose TWO.)

Accepted Answer

Sensitivity labels. The correct options are A and D. Sensitivity labels (A) can be applied to automatically classify and protect sensitive data, including in Azure Blob Storage. Microsoft Purview Data Map (D) provides auto-discovery and classification of data assets. Option B (DLP policies) is primarily for endpoint and Microsoft 365 workloads, not for Azure Blob. Option C (Information Barriers) is for restricting communication, not data classification. Option E (Azure Policy) is for governance, not data classification or protection.

Answer

Data Loss Prevention (DLP) policies

Answer

Information Barriers

Answer

Azure Policy

Question 10

A financial services company uses Microsoft Sentinel for SIEM. They need to detect potential data exfiltration from their Azure SQL Database. Which THREE data sources should they connect to Sentinel to achieve this? (Choose THREE.)

Accepted Answer

Azure Network Watcher NSG flow logs. Azure SQL Database audit logs (Option D) capture detailed information about database queries and operations, which can help detect unauthorized data access. Azure Activity Logs (Option E) provide visibility into management-plane events such as changes to database configurations or firewall rules. Network Security Group (NSG) flow logs (Option C) show network traffic patterns to and from Azure SQL Database, enabling the detection of abnormal data transfer volume or patterns indicative of exfiltration. Options A and B are incorrect: Microsoft Defender for Cloud alerts provide security recommendations and alerts but not raw data exfiltration details; Azure AD sign-in logs focus on user authentication events, not database operations.

Answer

Microsoft Defender for Cloud alerts

Answer

Azure AD sign-in logs

Question 11

Your organization is implementing a secure DevOps pipeline for Azure. You need to ensure that secrets (e.g., API keys) are not stored in source code and that access to production resources is controlled. Which THREE practices should you implement?

Accepted Answer

Use Azure Key Vault to store secrets and retrieve them at deployment time. The correct answers are B, C, and E. Azure Key Vault is the recommended service for storing secrets securely. Using Azure DevOps variable groups linked to Key Vault allows secrets to be referenced without exposing them in pipeline code. Managed identities provide a secure way for Azure resources to authenticate to Key Vault without storing credentials. Option A is incorrect because storing secrets in Azure DevOps pipeline variables with encryption is less secure than using Key Vault, as secrets may still be exposed in logs or exportable. Option D is incorrect because storing secrets in a configuration file in a private Git repository is insecure; even if encrypted, the key management is challenging and secrets can be accidentally exposed.

Answer

Store secrets in Azure DevOps pipeline variables with encryption enabled

Answer

Store secrets in a configuration file in a private Git repository

Question 12

A company is designing a secure API for a customer-facing application that will handle sensitive personal data. They need to ensure that only authorized client applications can call the API and that the identity of the end-user is verified. Which of the following should they implement?

Accepted Answer

OAuth 2.0 with client credentials and OpenID Connect. OAuth 2.0 with client credentials grant authenticates the client application, while OpenID Connect extends OAuth 2.0 to verify the end-user's identity. Together, they satisfy both requirements: only authorized clients can call the API and the end-user's identity is confirmed. Option A (HTTP Basic Authentication) transmits credentials in plaintext and does not support user identity verification beyond the client. Option C (JWT bearer tokens) is a token format, not a full authentication protocol; it lacks client authentication and user verification on its own. Option D (API keys) only authenticate the client, not the user, and are typically used for simple access control.

Answer

HTTP Basic Authentication

Answer

JWT bearer tokens

Answer

API keys

Question 13

A financial services company is deploying a new application on Azure Kubernetes Service (AKS). The application must meet PCI DSS compliance requirements, which mandate encryption of data at rest and in transit, as well as network segmentation. The application will use Azure SQL Database. What is the MOST secure approach to meet these requirements?

Accepted Answer

Use Azure Policy to enforce encryption and network policies in AKS, and enable TDE and Always Encrypted for Azure SQL Database.. It leverages Azure Policy to enforce encryption and network policies at the cluster level, while Azure SQL Database's TDE and Always Encrypted provide encryption at rest and in transit. This combination meets PCI DSS requirements for data encryption and network segmentation in AKS. Option A is wrong because App Service Environment is not used for AKS; the question specifies AKS. Option B is wrong because Service Endpoints do not encrypt traffic and provide limited segmentation compared to private endpoints. Option C is wrong because Azure Firewall is a network firewall and does not enforce encryption or network policies within the AKS cluster.

Answer

Deploy the application in an Azure App Service Environment (ASE) with a private endpoint and enable SQL Server encryption.

Answer

Use Azure Service Endpoints for the AKS cluster and enable Transparent Data Encryption (TDE) on Azure SQL Database.

Answer

Deploy Azure Firewall in front of the AKS cluster and enable SSL/TLS termination at the firewall for all incoming traffic.

Question 14

You are designing a solution to protect a web application hosted on Azure App Service. The application uses Azure SQL Database and stores sensitive customer data. You need to ensure that the data is encrypted at rest and in transit, and that the application is protected from common web attacks. Which TWO of the following should you implement?

Accepted Answer

Enforce TLS for Azure SQL Database connections. Enforce TLS for Azure SQL Database connections ensures data in transit is encrypted, meeting the encryption requirement. Option D: Azure Web Application Firewall (WAF) on Azure Front Door protects against common web attacks like SQL injection and XSS. Option A is incorrect because Azure Private Link provides private connectivity but does not directly protect against web attacks or encrypt data in transit. Option C is incorrect because Network Security Groups (NSGs) filter network traffic but do not provide encryption or web application protection. Option E is incorrect because Azure DDoS Protection Standard protects against network-layer attacks, not specifically web application attacks.

Answer

Azure Private Link for App Service

Answer

Network Security Groups (NSGs) on the subnet

Answer

Azure DDoS Protection Standard

Question 15

Your company uses Microsoft Defender for Cloud to secure Azure workloads. You need to ensure that all storage accounts have the 'Secure transfer required' setting enabled. What should you use?

Accepted Answer

Azure Policy. Azure Policy can audit and enforce the 'Secure transfer required' setting across all storage accounts. Option A (RBAC) is incorrect because RBAC controls access permissions, not resource configuration. Option B (Azure Blueprints) is deprecated and not the direct solution for this requirement. Option C (Microsoft Defender for Cloud regulatory compliance dashboard) provides visibility but does not enforce settings.

Answer

Azure role-based access control (RBAC)

Answer

Azure Blueprints

Answer

Microsoft Defender for Cloud regulatory compliance dashboard