SC-100 Design security solutions for applications and data Practice Test 13 — 15 Questions

Question 1

You are designing a secure CI/CD pipeline for a web application deployed to Azure Kubernetes Service (AKS). The security team requires that container images are scanned for vulnerabilities before deployment. Which two services should you integrate?

Accepted Answer

Microsoft Defender for Containers and Azure Container Registry. Option C is correct because Microsoft Defender for Containers integrates with ACR to scan images. Option A is wrong because Azure Policy can enforce rules but does not scan images. Option B is wrong because Azure DevOps does not scan images natively. Option D is wrong because Azure Key Vault stores secrets.

Answer

Azure DevOps and Azure Key Vault

Answer

Azure Policy and Azure DevOps

Answer

Azure Key Vault and Azure Container Registry

Question 2

A company uses Microsoft Sentinel to detect threats. They want to automatically send an email to the security team when a high-severity incident is created. What should they configure?

Accepted Answer

An analytics rule with an automated response. Option B is correct because analytics rules with automated responses can trigger a playbook to send email. Option A is wrong because workbooks are for visualization. Option C is wrong because watchlists are for reference data. Option D is wrong because hunting queries are for proactive threat hunting.

Answer

A workbook

Answer

A watchlist

Answer

A hunting query

Question 3

Your organization uses Microsoft Purview Data Loss Prevention (DLP) to protect sensitive data in Exchange Online. The compliance team wants to prevent users from sending emails containing Social Security numbers to external recipients. What should you configure?

Accepted Answer

Create a DLP policy with the condition 'Content contains sensitive info type' and action 'Block the message'. Option A is correct because a DLP policy can detect sensitive info types and block the email. Option B is wrong because sensitivity labels are for classification, not blocking. Option C is wrong because retention labels are for data retention. Option D is wrong because mail flow rules (transport rules) can do similar but DLP is the recommended approach.

Answer

Configure a retention label for emails

Answer

Create a mail flow rule in Exchange admin center

Answer

Apply a sensitivity label to all emails

Question 4

A company uses Azure Cosmos DB with Microsoft Defender for Cloud to protect its NoSQL database. The security team wants to audit all data plane operations for compliance. Which diagnostic setting should they enable?

Accepted Answer

DataPlaneRequests. Option C is correct because DataPlaneRequests logs contain all data plane operations. Option A is wrong because QueryRuntimeStatistics logs query execution stats, not operations. Option B is wrong because MongoRequests logs MongoDB operations only. Option D is wrong because PartitionKeyStatistics logs partition statistics.

Answer

MongoRequests

Answer

PartitionKeyStatistics

Answer

QueryRuntimeStatistics

Question 5

Which TWO data protection mechanisms should you implement to protect data at rest in Azure SQL Database?

Accepted Answer

Transparent Data Encryption (TDE). Options A and D are correct. TDE encrypts the database files, and Always Encrypted protects data in use and at rest by encrypting columns. Option B is wrong because Azure Firewall is a network security service. Option C is wrong because RBAC controls access, not encryption. Option E is wrong because Azure Policy enforces compliance but does not encrypt.

Answer

Azure Policy

Answer

Role-Based Access Control (RBAC)

Answer

Azure Firewall

Question 6

Which THREE actions should you take to secure a CI/CD pipeline using Azure DevOps and GitHub?

Accepted Answer

Enable secret scanning in GitHub to detect leaked credentials. Options A, D, and E are correct. Using secure variables, branch protection rules, and secret scanning are key security measures. Option B is wrong because disabling code review reduces security. Option C is wrong because running pipelines with admin privileges increases risk.

Answer

Run all pipeline tasks with administrative privileges

Answer

Disable pull request code reviews to speed deployment

Question 7

Which TWO Microsoft Purview features can be used to classify and label data in Microsoft 365?

Accepted Answer

Auto-labeling policies. Options B and C are correct. Sensitive info types define patterns to classify data, and auto-labeling policies apply labels automatically. Option A is wrong because eDiscovery is for discovery in legal cases. Option D is wrong because audit logs track activities. Option E is wrong because retention policies manage data retention.

Answer

Retention policies

Answer

eDiscovery

Answer

Audit logs

Question 8

Which THREE security controls should you implement to protect a web application against common OWASP Top 10 vulnerabilities?

Accepted Answer

Input validation on all user inputs. Options A, C, and D are correct. WAF protects against many OWASP threats, input validation prevents injection, and CSP mitigates XSS. Option B is wrong because RBAC manages access, not application layer attacks. Option E is wrong because MFA is an identity control.

Answer

Role-Based Access Control (RBAC)

Answer

Multi-factor authentication (MFA)

Question 9

Which TWO actions should you take to secure Azure Functions with HTTP triggers?

Accepted Answer

Enable App Service Authentication (EasyAuth). Options A and D are correct. Using easy auth (App Service Authentication) and restricting network access reduce attack surface. Option B is wrong because anonymous access is insecure. Option C is wrong because function keys only provide basic auth, not comprehensive security. Option E is wrong because Application Insights is for monitoring, not security.

Answer

Set authorization level to anonymous

Answer

Enable Application Insights

Answer

Use function keys only

Question 10

Your company is deploying a new AI-powered customer service chatbot using Azure OpenAI Service. The chatbot will access customer data stored in Azure Cosmos DB. The security team requires that all data in transit is encrypted, and that the chatbot only accesses data necessary for its function. Additionally, the chatbot must use managed identities to authenticate to Cosmos DB. You need to design the security architecture. Which combination of controls should you implement?

Accepted Answer

Enable TLS enforcement on Cosmos DB. Use a managed identity for the chatbot and assign the Cosmos DB Built-in Data Reader role. Configure the chatbot to authenticate using the managed identity.. Option B is correct because it includes all required controls: enforce TLS for data in transit, use managed identity for authentication, and implement least privilege access by granting only read access to the chatbot's identity. Option A is wrong because connection strings expose secrets. Option C is wrong because IP restrictions are not sufficient for authentication. Option D is wrong because it uses key-based authentication instead of managed identity.

Answer

Restrict network access to the chatbot's IP address. Use a system-assigned managed identity and assign the Cosmos DB Account Reader role.

Answer

Use a connection string with the Cosmos DB account key and enforce TLS 1.2. Grant the chatbot's managed identity contributor role.

Answer

Use Azure AD authentication with a service principal and assign the Cosmos DB Built-in Data Contributor role. Enforce TLS 1.2.

Question 11

Your organization uses Microsoft Defender for Cloud Apps to monitor shadow IT. You discover that employees are using a third-party file sharing app that is not sanctioned. The security team wants to block access to this app from managed devices and require authentication for unmanaged devices. You need to configure the appropriate controls in Defender for Cloud Apps. What should you do?

Accepted Answer

Create an access policy to block the app on unmanaged devices and require authentication on managed devices.. Option C is correct because it uses access policies to block unmanaged devices and require authentication, which aligns with the requirement. Option A is wrong because session policies monitor but do not block. Option B is wrong because app governance policies manage app permissions. Option D is wrong because DLP policies focus on data protection.

Answer

Create a session policy that monitors file uploads to the app.

Answer

Create an app governance policy to restrict the app's permissions.

Answer

Configure a DLP policy to prevent sharing of sensitive data through the app.

Question 12

Your company, Fabrikam, is a global financial services firm that handles sensitive customer data. You are designing a security solution for a new customer-facing web application that processes credit card transactions. The application will be deployed on Azure Kubernetes Service (AKS) and will use Azure SQL Database for data storage. Compliance requirements include PCI DSS and GDPR. You need to ensure that data at rest and in transit is encrypted, and that access to the database is tightly controlled. You plan to use Azure Key Vault for managing encryption keys. Which combination of actions should you implement?

Accepted Answer

Enable TDE with a customer-managed key in Azure Key Vault, use Always Encrypted for sensitive columns, enforce TLS 1.2, and use Azure AD managed identities for authentication with a firewall rule to allow only the AKS cluster's outbound IP.. Option C is correct because it covers encryption in transit (TLS 1.2), encryption at rest (TDE and Always Encrypted), and access control with managed identities and firewall rules. Option A is wrong because TLS 1.0 is outdated and not PCI DSS compliant. Option B is wrong because Azure SQL Database does not support BYOK for TDE natively without Key Vault integration. Option D is wrong because application-level encryption alone does not meet compliance requirements for data at rest.

Answer

Enable TDE with a customer-managed key stored in the application's configuration file, enforce TLS 1.2, and use Azure AD authentication.

Answer

Implement application-level encryption for credit card data, enforce TLS 1.2, and use Azure AD managed identities with no database firewall rules.

Answer

Enable Transparent Data Encryption (TDE) with a service-managed key, enforce TLS 1.0, and use SQL authentication.

Question 13

Contoso, a healthcare provider, is deploying a new patient portal on Azure App Service that stores electronic health records (EHR) in Azure Cosmos DB for NoSQL. The solution must comply with HIPAA and HITRUST. You need to ensure that data is encrypted at rest and in transit, and that access is restricted based on user roles. Cosmos DB must be configured with a private endpoint to prevent public internet access. You plan to use Azure Key Vault to manage encryption keys. Additionally, the application will access Cosmos DB using a system-assigned managed identity. Which of the following is the most complete and secure design?

Accepted Answer

Enable encryption at rest using a customer-managed key in Azure Key Vault, enforce TLS 1.2, configure a private endpoint for Cosmos DB, and grant the managed identity access via Azure RBAC with a custom role that allows read/write to specific containers.. Option B is correct because it enables both encryption at rest (with CMK) and encryption in transit (TLS 1.2), uses private endpoints for network isolation, and implements Azure RBAC for granular access control. Option A is wrong because service-managed keys do not meet HIPAA requirements for key control, and firewall rules are less secure than private endpoints. Option C is wrong because RBAC with Cosmos DB built-in roles does not support custom role-based access for patient data. Option D is wrong because disabling encryption at rest is a security risk.

Answer

Enable encryption at rest using service-managed keys, enforce TLS 1.2, configure a service endpoint for Cosmos DB, and grant the managed identity access using Cosmos DB built-in roles (e.g., Cosmos DB Built-in Data Contributor).

Answer

Disable encryption at rest to improve performance, enforce TLS 1.2, configure a private endpoint, and use the managed identity with a read-write key in Azure Key Vault.

Answer

Enable encryption at rest using service-managed keys, enforce TLS 1.2, configure a firewall to allow only the App Service outbound IP, and use read-write keys in application settings.

Question 14

A multinational retail company, Northwind Traders, is building a new e-commerce platform on Azure. The platform includes a public-facing API built on Azure API Management (APIM) that processes orders containing personal data (PII). The company uses Microsoft Entra ID for identity management. You need to design a security solution that protects the API from common web vulnerabilities (e.g., SQL injection, XSS) and ensures that only authenticated users with the appropriate role can place orders. Additionally, you need to log and monitor all API requests for security auditing. Which combination of services should you use?

Accepted Answer

Use Azure API Management with built-in WAF, configure OAuth 2.0 authorization with Microsoft Entra ID, and enable Azure Monitor and Log Analytics for logging and alerting.. Option C is correct because Azure Web Application Firewall (WAF) on APIM protects against OWASP top 10 threats, OAuth 2.0 with Entra ID provides authentication and authorization, and Azure Monitor and Log Analytics provide logging and monitoring. Option A is wrong because NSGs do not protect against application-layer attacks. Option B is wrong because IP whitelisting does not handle authentication/authorization. Option D is wrong because Application Gateway WAF is redundant if APIM WAF is used, and IP whitelisting is not suitable.

Answer

Use Azure Firewall to filter traffic, implement client certificate authentication in APIM, and use Azure Monitor for logging.

Answer

Use Azure Application Gateway with WAF in front of APIM, configure IP whitelisting on APIM, and enable diagnostic settings to send logs to a storage account.

Answer

Use Azure Front Door with WAF in front of APIM, configure IP whitelisting on APIM, and use Microsoft Sentinel for logging.

Question 15

Your organization, Adatum, is migrating its on-premises applications to Azure. The applications include a legacy .NET Framework web app that uses Windows authentication and a modern ASP.NET Core API that uses OAuth 2.0. You need to design a secure solution for these applications using Azure App Service. The security requirements include: (1) enforce HTTPS only, (2) restrict access to the web app based on the user's corporate identity, (3) allow the API to access an Azure SQL Database using a managed identity. Which of the following is the correct design?

Accepted Answer

Configure both apps to enforce HTTPS only, configure the web app to use Microsoft Entra ID authentication, and configure the API to use a system-assigned managed identity to access Azure SQL Database.. Option D is correct because it meets all requirements: HTTPS only enforced, Microsoft Entra ID authentication for the web app, and managed identity for the API to access SQL Database. Option A is wrong because client certificates do not provide user-level authentication. Option B is wrong because the API should use managed identity, not connection strings. Option C is wrong because SQL authentication is less secure and does not use managed identity.

Answer

Configure the web app to use Windows authentication via Azure AD Domain Services, and the API to use SQL authentication with a managed identity.

Answer

Configure the web app to use Microsoft Entra ID authentication with a built-in policy, and the API to use a connection string with a username and password.

Answer

Configure the web app to require client certificates for authentication, and the API to use a connection string with SQL authentication.