SC-100 Design security solutions for applications and data Practice Test 14 — 15 Questions

Question 1

Which THREE actions should you take to secure a CI/CD pipeline using Azure DevOps and GitHub?

Accepted Answer

Enable secret scanning in GitHub to detect leaked credentials. Option A is correct because enabling secret scanning in GitHub automatically detects committed credentials such as API keys and tokens, allowing them to be revoked before they can be exploited in the pipeline. Option D is correct because storing secrets in Azure Key Vault and referencing them through variable groups linked to Key Vault keeps credentials out of pipeline YAML and repository history, enforcing centralized access control and auditing. Option E is correct because branch protection rules in GitHub that require status checks prevent unreviewed or failing code from being merged, ensuring only validated commits reach the CI/CD pipeline. Option B is incorrect because running all pipeline tasks with administrative privileges violates least privilege and expands the blast radius of a compromised task. Option C is incorrect because disabling pull request code reviews removes a critical human verification gate and increases the risk of malicious or flawed code being deployed.

Answer

Run all pipeline tasks with administrative privileges

Answer

Disable pull request code reviews to speed deployment

Question 2

Which TWO Microsoft Purview features can be used to classify and label data in Microsoft 365?

Accepted Answer

Auto-labeling policies. Auto-labeling policies (C) are a Microsoft Purview Information Protection capability that automatically applies sensitivity labels to content by scanning items for sensitive data, so they directly classify and label data in Microsoft 365. Sensitive info types (E) are the pattern-based classifiers (for example, credit card or national ID patterns) that define what sensitive data looks like and are used by auto-labeling and other Purview rules to classify data. Retention policies (A) govern how long content is kept or deleted rather than classifying or labeling it, eDiscovery (B) is used for identifying and collecting content for legal cases, and Audit logs (D) record user and admin activity for investigation and compliance reporting, so none of these three perform classification or labeling.

Answer

Retention policies

Answer

eDiscovery

Answer

Audit logs

Question 3

Which THREE security controls should you implement to protect a web application against common OWASP Top 10 vulnerabilities?

Accepted Answer

Input validation on all user inputs. Input validation on all user inputs (B) is correct because it directly mitigates injection flaws such as SQL injection, command injection, and cross-site scripting (XSS) by rejecting or sanitizing untrusted data before it reaches interpreters or the browser. Content Security Policy (CSP) headers (C) are correct because they restrict which scripts, styles, and other resources the browser may load, providing defense-in-depth against XSS and data injection attacks listed in the OWASP Top 10. A Web Application Firewall (WAF) (D) is correct because it inspects HTTP/HTTPS traffic and blocks common attack patterns like SQLi, XSS, and path traversal, offering a compensating control for vulnerabilities that may not yet be patched in the application. Role-Based Access Control (A) and Multi-factor authentication (E) are valuable identity and access management controls, but they address authentication and authorization concerns rather than the broad set of injection, misconfiguration, and client-side vulnerabilities targeted by the OWASP Top 10, so they are not among the three required controls here.

Answer

Role-Based Access Control (RBAC)

Answer

Multi-factor authentication (MFA)

Question 4

Which TWO actions should you take to secure Azure Functions with HTTP triggers?

Accepted Answer

Enable App Service Authentication (EasyAuth). Option A is correct because enabling App Service Authentication (EasyAuth) on the Function App enforces identity verification via Microsoft Entra ID or other identity providers before requests reach the function, providing strong authentication for HTTP triggers. Option B is correct because configuring network restrictions (access restrictions / IP allowlists) on the Function App limits inbound HTTP traffic to trusted IP ranges, reducing exposure to unauthorized or malicious callers. Option C is wrong because setting the authorization level to anonymous removes the function key requirement and allows unauthenticated access, weakening security. Option D is wrong because Application Insights is a monitoring and telemetry service, not a security control. Option E is wrong because function keys alone are shared secrets that can be leaked and do not provide robust authentication or network-level protection.

Answer

Set authorization level to anonymous

Answer

Enable Application Insights

Answer

Use function keys only

Question 5

Your company is deploying a new AI-powered customer service chatbot using Azure OpenAI Service. The chatbot will access customer data stored in Azure Cosmos DB. The security team requires that all data in transit is encrypted, and that the chatbot only accesses data necessary for its function. Additionally, the chatbot must use managed identities to authenticate to Cosmos DB. You need to design the security architecture. Which combination of controls should you implement?

Accepted Answer

Enable TLS enforcement on Cosmos DB. Use a managed identity for the chatbot and assign the Cosmos DB Built-in Data Reader role. Configure the chatbot to authenticate using the managed identity.. It enforces TLS for data in transit, uses a managed identity for authentication, and assigns the Cosmos DB Built-in Data Reader role to implement least privilege access. Option A is incorrect because IP restrictions alone do not provide authentication and the Account Reader role does not allow data access. Option B is incorrect because using a connection string exposes secrets and the Contributor role grants excessive permissions. Option D is incorrect because it uses a service principal instead of a managed identity, which is a requirement.

Answer

Restrict network access to the chatbot's IP address. Use a system-assigned managed identity and assign the Cosmos DB Account Reader role.

Answer

Use a connection string with the Cosmos DB account key and enforce TLS 1.2. Grant the chatbot's managed identity contributor role.

Answer

Use Azure AD authentication with a service principal and assign the Cosmos DB Built-in Data Contributor role. Enforce TLS 1.2.

Question 6

Your organization, Adatum, is migrating its on-premises applications to Azure. The applications include a legacy .NET Framework web app that uses Windows authentication and a modern ASP.NET Core API that uses OAuth 2.0. You need to design a secure solution for these applications using Azure App Service. The security requirements include: (1) enforce HTTPS only, (2) restrict access to the web app based on the user's corporate identity, (3) allow the API to access an Azure SQL Database using a managed identity. Which of the following is the correct design?

Accepted Answer

Configure both apps to enforce HTTPS only, configure the web app to use Microsoft Entra ID authentication, and configure the API to use a system-assigned managed identity to access Azure SQL Database.. Option D is correct because it satisfies all three requirements: enabling HTTPS-only on both apps enforces TLS, configuring the web app with Microsoft Entra ID authentication restricts access based on corporate identity, and using a system-assigned managed identity lets the API authenticate to Azure SQL Database without storing credentials. Managed identity works with Azure SQL via Entra ID authentication, so no password is needed in the connection string. Option A is wrong because Microsoft Entra Domain Services-based Windows authentication is not the recommended App Service approach and SQL authentication with a managed identity is contradictory. Option B is wrong because a username/password connection string does not use managed identity. Option C is wrong because client certificates do not provide corporate identity-based access and SQL authentication does not meet the managed identity requirement.

Answer

Configure the web app to use Windows authentication via Azure AD Domain Services, and the API to use SQL authentication with a managed identity.

Answer

Configure the web app to use Microsoft Entra ID authentication with a built-in policy, and the API to use a connection string with a username and password.

Answer

Configure the web app to require client certificates for authentication, and the API to use a connection string with SQL authentication.

Question 7

Trey Research, a biotech firm, is developing a machine learning model on Azure Machine Learning that uses sensitive genomic data. The data is stored in Azure Blob Storage. The company requires that all data be encrypted at rest using customer-managed keys stored in Azure Key Vault, and that access to the storage account be restricted to the Azure Machine Learning workspace and specific data scientists via Azure AD authentication. Additionally, the storage account must be accessible only from the company's virtual network. Which of the following configurations should you implement?

Accepted Answer

Enable encryption at rest with a customer-managed key, configure a private endpoint for the storage account, and grant the Machine Learning workspace and data scientists access using Azure RBAC with the Storage Blob Data Contributor role.. It provides encryption at rest with a customer-managed key (CMK) stored in Azure Key Vault, a private endpoint to restrict access to the company's virtual network, and Azure RBAC with the Storage Blob Data Contributor role for both the Machine Learning workspace and data scientists, ensuring Microsoft Entra ID authentication. Option A is wrong because firewall rules using IP ranges are less secure than private endpoints, and granting access via storage account access keys bypasses Microsoft Entra ID authentication. Option B is wrong because it uses a service-managed key, which does not meet the customer-managed key requirement. Option D is wrong because a service endpoint is less secure than a private endpoint, and using a SAS token does not provide Microsoft Entra ID-based access control.

Answer

Enable encryption at rest with a customer-managed key, configure a firewall to allow the Machine Learning workspace's IP range, and grant data scientists access via storage account access keys.

Answer

Enable encryption at rest with a service-managed key, configure a private endpoint, and grant data scientists access using Azure RBAC with the Storage Blob Data Reader role.

Answer

Enable encryption at rest with a customer-managed key, configure a service endpoint for the storage account, and grant the Machine Learning workspace access using a SAS token.

Question 8

Wide World Importers is deploying a critical line-of-business application on Azure Kubernetes Service (AKS). The application processes financial transactions and must meet SOX compliance. You need to design a security solution that includes: encryption of secrets (e.g., database connection strings) using Azure Key Vault, automatic certificate rotation for TLS termination, network isolation of the AKS cluster, and audit logging of all access to secrets. The solution should use a managed identity for the AKS cluster to access Key Vault. Which of the following designs meets the requirements?

Accepted Answer

Enable managed identity for the AKS cluster, integrate Key Vault with AKS using the Secrets Store CSI driver, deploy the cluster as a private cluster, and enable diagnostic settings on Key Vault to send logs to a Log Analytics workspace.. Option A meets all requirements: using managed identity for AKS to access Key Vault (secure, no credentials), integrating Key Vault with AKS via the Secrets Store CSI driver (enables encryption and automatic certificate rotation), deploying as a private cluster (network isolation), and enabling diagnostic settings on Key Vault to send logs to Log Analytics (audit logging). This design leverages Azure-native integrations for security and compliance.

Answer

Use a service principal for AKS to access Key Vault, store secrets as Kubernetes secrets, configure a private cluster, and enable audit logging on Key Vault.

Answer

Enable managed identity for the AKS cluster, store secrets in the cluster's native Kubernetes secrets, use a private endpoint for the AKS API server, and enable Azure Monitor for containers.

Answer

Use a service principal to access Key Vault, store secrets as encrypted Kubernetes secrets with a customer-managed key, deploy a public cluster with network policies, and enable Key Vault logging.

Question 9

A startup, Alpine Ski House, is developing a mobile app that allows users to book ski lessons. The app communicates with an Azure Function App backend via REST APIs. The function app stores data in Azure Cosmos DB. The company wants to secure the API endpoints using OAuth 2.0 with Microsoft Entra ID and ensure that only authenticated users can invoke the functions. The function app should also use a managed identity to access Cosmos DB. Which of the following configurations should you implement?

Accepted Answer

Configure the function app to require authentication with Microsoft Entra ID, enforce HTTPS only, and use a system-assigned managed identity to access Cosmos DB.. It uses OAuth 2.0 with Entra ID for authentication, managed identity for database access, and enforces HTTPS. Option B is wrong because function keys are not secure for user authentication. Option C is wrong because client certificates do not provide user-level authentication. Option D is wrong because IP whitelisting is not a substitute for authentication.

Answer

Configure the function app to use function-level authorization keys, enforce HTTPS only, and use a connection string with a read-write key to access Cosmos DB.

Answer

Configure the function app to require client certificates, enforce HTTPS only, and use a managed identity to access Cosmos DB.

Answer

Configure the function app to use IP whitelisting, enforce HTTPS only, and use a managed identity to access Cosmos DB.

Question 10

Your company, Lucerne Publishing, is migrating its on-premises SQL Server databases to Azure SQL Managed Instance. The databases contain sensitive customer data subject to GDPR. You need to design a security solution that includes: (1) Always Encrypted for sensitive columns, (2) dynamic data masking for non-privileged users, (3) auditing of all data access, and (4) encryption at rest using customer-managed keys stored in Azure Key Vault. Which of the following configurations should you implement?

Accepted Answer

Enable Always Encrypted for sensitive columns, configure dynamic data masking, enable Azure SQL auditing to a Log Analytics workspace, and enable TDE with a customer-managed key stored in Azure Key Vault.. The correct configuration must satisfy all four requirements: Always Encrypted for sensitive columns, dynamic data masking for non-privileged users, auditing of all data access, and encryption at rest with customer-managed keys in Azure Key Vault. Option D meets all four by enabling Azure SQL auditing to a Log Analytics workspace and TDE with a customer-managed key stored in Azure Key Vault, alongside Always Encrypted and dynamic data masking.

Answer

Enable Always Encrypted for sensitive columns, configure dynamic data masking, enable auditing via Azure Policy, and enable TDE with a customer-managed key stored in Azure Key Vault.

Answer

Enable Always Encrypted for sensitive columns, configure dynamic data masking, disable TDE to improve performance, and use row-level security to restrict access.

Answer

Enable Always Encrypted for sensitive columns, configure dynamic data masking, enable SQL Server auditing to Azure Blob Storage, and enable Transparent Data Encryption (TDE) with a service-managed key.

Question 11

A government agency, Northwind, is deploying a sensitive application on Azure App Service Environment (ASE) v3. The application handles classified data and must meet FedRAMP High requirements. You need to design a security solution that includes: (1) encryption at rest for the app's content and configuration, (2) encryption in transit with TLS 1.2 or higher, (3) network isolation using VNet integration and private endpoints, (4) identity-based access to Azure SQL Database using managed identity, and (5) certificate management for custom domains using Azure Key Vault. Which of the following designs meets all requirements?

Accepted Answer

Deploy the app on an ASE v3 in a VNet, enforce HTTPS only with TLS 1.2, use a system-assigned managed identity to access Azure SQL Database, and configure TLS/SSL certificates from Azure Key Vault.. ASE v3 provides a fully isolated, single-tenant App Service environment deployed into a customer VNet, which is required for FedRAMP High and network isolation. It also correctly combines HTTPS-only with TLS 1.2, a system-assigned managed identity for passwordless Azure SQL authentication, and Key Vault for certificate management — all of which are supported natively in ASE v3. The other options either use multi-tenant App Service (not isolated) or substitute components that don't meet the full requirement set.

Answer

Deploy the app on a multi-tenant App Service plan, enforce HTTPS only with TLS 1.2, use a system-assigned managed identity to access Azure SQL Database, and configure TLS/SSL certificates from Azure Key Vault.

Answer

Deploy the app on an ASE v3 in a VNet, enforce HTTPS only with TLS 1.2, use a user-assigned managed identity to access Azure SQL Database, and configure TLS/SSL certificates from App Service certificates.

Answer

Deploy the app on an ASE v3 in a VNet, enforce HTTPS only with TLS 1.2, use a service principal to access Azure SQL Database, and configure TLS/SSL certificates from Azure Key Vault.

Question 12

Your organization is designing a security solution for a new web application that will be deployed on Azure App Service. The application will access an Azure SQL Database and an Azure Storage account. The security requirements include: (1) use managed identities for authentication, (2) encrypt data at rest and in transit, (3) restrict network access to the database and storage account to only the App Service, and (4) use Azure Key Vault for secrets management. Which TWO of the following should you implement?

Accepted Answer

Configure private endpoints for the SQL Database and Storage account.. Option B is correct because private endpoints assign a private IP address from your virtual network to the Azure SQL Database and Storage account, so those PaaS services are reachable only through the private link and public network access can be disabled, satisfying the requirement to restrict network access to only the App Service (when the App Service is VNet-integrated). Option C is correct because a system-assigned managed identity gives the App Service an identity in Microsoft Entra ID, allowing it to authenticate to Azure SQL Database and Storage without storing credentials, which directly fulfills the managed-identity authentication requirement. Option A is incorrect because using a storage account access key in a connection string relies on a shared secret rather than a managed identity and exposes a highly privileged key. Option D is incorrect because SAS tokens are shared secrets with delegated permissions, not managed-identity authentication, and they do not restrict network access to the App Service. Option E is incorrect because service endpoints only extend the VNet identity to the PaaS service over the Azure backbone; they do not give the SQL Database or Storage account a private IP, and the service still exposes a public endpoint, so they do not meet the strict 'only the App Service' network restriction as well as private endpoints do.

Answer

Configure the App Service to use a connection string with a storage account access key.

Answer

Use shared access signatures (SAS) for the App Service to access the Storage account.

Answer

Configure service endpoints for the SQL Database and Storage account.

Question 13

Your company, Fabrikam, is designing a solution to securely store and manage secrets (e.g., API keys, database passwords) for cloud applications. The solution must use Azure Key Vault and support automatic rotation of secrets. The applications will run on Azure VMs and Azure App Service. Which TWO of the following should you include in your design?

Accepted Answer

Implement automatic secret rotation using Key Vault with Event Grid and Azure Functions.. Option E is correct because managed identities for Azure resources let Azure VMs and App Service apps authenticate to Key Vault without storing any credentials in code or configuration, which is the recommended, most secure authentication method for this scenario. Option D is correct because Key Vault's secret rotation can be automated by emitting near-expiration events to Event Grid, which triggers an Azure Function to generate and write a new secret version back into Key Vault, satisfying the automatic rotation requirement. Option A is not appropriate because service principals with client secrets require you to store and manage a credential, reintroducing the secret-management problem managed identities solve. Option B is wrong because manual rotation via Azure Automation runbooks is not automatic rotation and adds operational overhead. Option C is wrong because storing secrets in application configuration files, even if encrypted with Key Vault, does not use Key Vault as the secret store and undermines centralized secure storage and rotation.

Answer

Use service principals with client secrets to authenticate to Key Vault.

Answer

Rotate secrets manually using Azure Automation runbooks on a schedule.

Answer

Store secrets in application configuration files encrypted with Azure Key Vault.

Question 14

A financial institution, Contoso Bank, is deploying a new application on Azure Kubernetes Service (AKS) that processes credit card transactions (PCI DSS). The application uses Azure SQL Database and Azure Redis Cache. You need to design a security solution that meets PCI DSS requirements. Which THREE of the following should you implement?

Accepted Answer

Deploy AKS as a private cluster with no public endpoint.. Option A is correct because deploying AKS as a private cluster with no public endpoint removes the API server's public exposure, ensuring all control-plane communication stays on the private network and reducing the PCI DSS attack surface. Option B is correct because Always Encrypted protects sensitive cardholder data columns in Azure SQL Database by keeping encryption keys outside the database engine, so even DBAs or compromised SQL instances cannot read plaintext data. Option D is correct because private endpoints for Azure SQL Database and Azure Cache for Redis route traffic over Azure Private Link, keeping data off the public internet and satisfying PCI DSS network segmentation and encryption-in-transit expectations. Option C is not among the required three because Azure RBAC for Kubernetes authorization is a general access-control hardening measure, not a PCI DSS-specific control for protecting cardholder data in this scenario. Option E is incorrect because disabling TLS on Azure Cache for Redis exposes data in transit and directly violates PCI DSS encryption requirements for cardholder data.

Answer

Enable Azure RBAC for Kubernetes authorization.

Answer

Disable TLS for Azure Cache for Redis to improve performance.

Question 15

A software company, Northwind, is developing a mobile app that uses Microsoft Entra ID for authentication. The app accesses an Azure Function App backend that stores data in Azure Cosmos DB. The company wants to implement a defense-in-depth security strategy. Which TWO of the following should you implement?

Accepted Answer

Use OAuth 2.0 with Microsoft Entra ID to secure the Azure Functions.. Option A is correct because using OAuth 2.0 with Microsoft Entra ID lets the Azure Functions validate the bearer tokens issued to the mobile app, providing strong, identity-based authentication and enabling fine-grained authorization through app roles or scopes in a defense-in-depth model. Option C is correct because configuring Azure Cosmos DB with a private endpoint (via Azure Private Link) removes the database from the public internet and restricts traffic to the virtual network, adding a network-layer control that complements the identity-layer protection. Option B is not appropriate because IP whitelisting is brittle for a mobile app whose users connect from many dynamic addresses and does not authenticate the caller. Option D is weaker than A because function-level authorization keys are shared secrets that are hard to rotate and do not provide user identity or scoped permissions. Option E is incorrect because TLS 1.0 is deprecated and insecure; TLS 1.2 or higher should be enforced.

Answer

Restrict access to the Azure Functions by IP whitelisting.

Answer

Use function-level authorization keys for the Azure Functions.

Answer

Enforce TLS 1.0 for all API calls.