How should I use these Design a strategy for data and applications practice questions?

Read each scenario carefully and choose your answer before revealing the explanation. Then check why your choice was right or wrong. Repeat until the reasoning feels automatic.

SC-100 · topic practice

Design a strategy for data and applications practice questions

Q: Can I practise just Design a strategy for data and applications questions in a focused session?

Yes — use the session launcher on this page to start a 10-, 20-, 30- or 50-question session drawn entirely from the Design a strategy for data and applications domain.

Practise Microsoft Cybersecurity Architect Design a strategy for data and applications practice questions — original exam-style scenarios with answer choices, explanations, and analysis of common mistakes.

Courseiva uses original exam-style practice questions designed for learning and revision. The goal is to understand the concepts, recognise exam patterns, and improve through explanations — not memorise copied exam dumps.

Reviewed byJohnson Ajibi· MSc IT Security

20 questionsDomain: Design a strategy for data and applications

Practice 10 questions Browse domain →

What the exam tests

What to know about Design a strategy for data and applications

Design a strategy for data and applications questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Watch out for

Common Design a strategy for data and applications exam traps

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Practice set

Design a strategy for data and applications questions

20 questions · select your answer, then reveal the explanation

Question 1mediummultiple choice

Read the full Design a strategy for data and applications explanation →

A company is designing a data protection strategy for Azure SQL Database. They need to ensure that backups are retained for 7 years to meet regulatory compliance. Which Azure feature should they use?

Trap 1: Geo-redundant backup storage

Does not extend retention period.

Trap 2: Point-in-Time Restore

PITR max retention is 35 days.

Trap 3: Active Geo-Replication

Used for read-scale, not backup retention.

Study all Design a strategy for data and applications common traps →

A
Geo-redundant backup storage
Why wrong: Does not extend retention period.
B
Long-Term Retention (LTR)
LTR retains backups for up to 10 years.
C
Point-in-Time Restore
Why wrong: PITR max retention is 35 days.
D
Active Geo-Replication
Why wrong: Used for read-scale, not backup retention.

Full breakdown with real-world context →

Question 2easymultiple choice

Read the full Design a strategy for data and applications explanation →

A company deploys Azure App Service with a custom domain and SSL certificate. They want to enforce HTTPS only. Which configuration setting should they enable?

Trap 1: Client Certificates

For mutual authentication.

Trap 2: Minimum TLS Version

Controls allowed TLS version, not redirect.

Trap 3: Custom Domain

Just binds domain.

Study all Design a strategy for data and applications common traps →

A
HTTPS Only
Enforces HTTPS redirect.
B
Client Certificates
Why wrong: For mutual authentication.
C
Minimum TLS Version
Why wrong: Controls allowed TLS version, not redirect.
D
Custom Domain
Why wrong: Just binds domain.

Full breakdown with real-world context →

Question 3hardmultiple choice

Read the full Design a strategy for data and applications explanation →

A company uses Azure Policy to audit storage accounts for secure transfer (HTTPS) enforcement. The policy is set to 'AuditIfNotExists' but compliance shows 0% non-compliant storage accounts even though some accounts have secure transfer disabled. What is the most likely cause?

Trap 1: The policy is in 'audit' mode and does not evaluate

Audit mode evaluates compliance.

Trap 2: The storage accounts are in a different region

Region does not affect compliance.

Trap 3: The policy assignment scope does not include the non-compliant…

Scope would affect which accounts are evaluated.

Study all Design a strategy for data and applications common traps →

A
The policy is in 'audit' mode and does not evaluate
Why wrong: Audit mode evaluates compliance.
B
The policy should use 'Audit' or 'Deny' effect instead of 'AuditIfNotExists'
AuditIfNotExists is for existence of a resource, not property.
C
The storage accounts are in a different region
Why wrong: Region does not affect compliance.
D
The policy assignment scope does not include the non-compliant accounts
Why wrong: Scope would affect which accounts are evaluated.

Full breakdown with real-world context →

Question 4mediummultiple choice

Read the full Design a strategy for data and applications explanation →

A company is designing a microservices architecture on Azure Kubernetes Service (AKS). They need to secure communication between services using mutual TLS (mTLS). Which solution should they implement?

Trap 1: Azure Application Gateway

For inbound HTTP load balancing.

Trap 2: Azure Firewall

For network traffic filtering.

Trap 3: Azure API Management

For API gateway, not internal service mesh.

Study all Design a strategy for data and applications common traps →

A
Azure Application Gateway
Why wrong: For inbound HTTP load balancing.
B
Azure Firewall
Why wrong: For network traffic filtering.
C
Azure API Management
Why wrong: For API gateway, not internal service mesh.
D
Istio service mesh
Provides mTLS for microservices.

Full breakdown with real-world context →

Question 5easymulti select

Read the full VPN explanation →

A company stores sensitive data in Azure Blob Storage. They want to prevent data exfiltration by blocking public access and restricting network access to only their on-premises data center via VPN. Which two features should they use?

Trap 1: Enable firewall and add on-premises IP range

On-premises traffic appears as VPN public IP, not internal IP range.

Trap 2: Disable public access and use RBAC

RBAC controls identity, not network.

Study all Design a strategy for data and applications common traps →

A
Enable firewall and add on-premises IP range
Why wrong: On-premises traffic appears as VPN public IP, not internal IP range.
B
Disable public access and use RBAC
Why wrong: RBAC controls identity, not network.
C
Disable public access and configure a service endpoint with a firewall rule for the VPN subnet
Service endpoint restricts to subnet, firewall blocks other traffic.
D
Disable public access and configure a private endpoint
Private endpoint uses private IP, but VPN is needed for connectivity.

Full breakdown with real-world context →

Question 6hardmultiple choice

Read the full Design a strategy for data and applications explanation →

A company uses Azure Key Vault to store secrets for their applications. They want to ensure that secrets can be automatically rotated when they are close to expiration. Which solution should they implement?

Trap 1: Use Azure DevOps release pipeline to rotate secrets

Not designed for automatic rotation.

Trap 2: Use Azure Automation with a schedule to check expiration and rotate

Polling-based, not automatic.

Trap 3: Use Azure Logic Apps with a recurrence trigger to rotate secrets

Polling-based, not event-driven.

Study all Design a strategy for data and applications common traps →

A
Use Azure DevOps release pipeline to rotate secrets
Why wrong: Not designed for automatic rotation.
B
Use Azure Automation with a schedule to check expiration and rotate
Why wrong: Polling-based, not automatic.
C
Use Key Vault event grid subscription to trigger an Azure Function for rotation
Event-driven rotation on secret expiration.
D
Use Azure Logic Apps with a recurrence trigger to rotate secrets
Why wrong: Polling-based, not event-driven.

Full breakdown with real-world context →

Question 7mediummultiple choice

Read the full Design a strategy for data and applications explanation →

A company is migrating on-premises applications to Azure. They need to ensure that applications can use their existing Active Directory credentials for authentication. Which Azure service should they use?

Trap 1: Azure Active Directory

Does not support LDAP or Kerberos directly.

Trap 2: Azure AD Connect

Syncs identities, not domain services.

Trap 3: Azure AD B2C

For consumer identity.

Study all Design a strategy for data and applications common traps →

A
Azure AD Domain Services
Provides LDAP, Kerberos, NTLM.
B
Azure Active Directory
Why wrong: Does not support LDAP or Kerberos directly.
C
Azure AD Connect
Why wrong: Syncs identities, not domain services.
D
Azure AD B2C
Why wrong: For consumer identity.

Full breakdown with real-world context →

Question 8easymultiple choice

Read the full Design a strategy for data and applications explanation →

A company wants to protect their Azure App Service web application from common web vulnerabilities like SQL injection and XSS. Which Azure service should they enable?

Trap 1: Azure DDoS Protection

Protects against DDoS, not application attacks.

Trap 2: Azure Firewall

Network-level filtering.

Trap 3: Azure Front Door with WAF

Also provides WAF but Application Gateway is more common for single app.

Study all Design a strategy for data and applications common traps →

A
Azure DDoS Protection
Why wrong: Protects against DDoS, not application attacks.
B
Azure Firewall
Why wrong: Network-level filtering.
C
Azure Front Door with WAF
Why wrong: Also provides WAF but Application Gateway is more common for single app.
D
Azure Web Application Firewall (WAF) on Application Gateway
Protects against SQL injection, XSS, etc.

Full breakdown with real-world context →

Question 9hardmulti select

Read the full Design a strategy for data and applications explanation →

A company is designing a data classification strategy for their Azure environment. They need to identify sensitive data stored in Azure SQL Database. Which TWO solutions should they consider?

Trap 1: Azure Information Protection

For files and emails.

Trap 2: Azure Purview

Data catalog, not SQL-native classification.

Trap 3: Azure Policy

For resource compliance.

Study all Design a strategy for data and applications common traps →

A
Azure Information Protection
Why wrong: For files and emails.
B
Azure SQL Data Discovery & Classification
Built-in classification for SQL DB.
C
Azure Purview
Why wrong: Data catalog, not SQL-native classification.
D
SQL Vulnerability Assessment
Includes data discovery.
E
Azure Policy
Why wrong: For resource compliance.

Full breakdown with real-world context →

Question 10mediummulti select

Read the full Design a strategy for data and applications explanation →

A company uses Azure Storage for sensitive data. They need to ensure that data is encrypted at rest and that encryption keys are managed by the customer (Customer-Managed Keys). Which THREE actions are required?

Trap 1: Enable double encryption

Optional, not required for CMK.

Trap 2: Enable Azure Information Protection

Not related to storage encryption.

Study all Design a strategy for data and applications common traps →

A
Enable double encryption
Why wrong: Optional, not required for CMK.
B
Create an Azure Key Vault to store the customer-managed key
Key Vault required for CMK.
C
Assign RBAC role to storage account to access Key Vault
Needed for key access.
D
Enable Azure Information Protection
Why wrong: Not related to storage encryption.
E
Enable Storage Service Encryption (SSE) with customer-managed keys
SSE with CMK is required.

Full breakdown with real-world context →

Question 11easymulti select

Read the full Design a strategy for data and applications explanation →

A company is designing a secure DevOps pipeline for deploying Azure App Service applications. They need to ensure that secrets are not exposed in source code. Which TWO practices should they implement?

Trap 1: Implement Git pre-commit hooks to scan for secrets

Not a built-in Azure solution.

Trap 2: Store secrets in Azure DevOps library variable groups

Variables are not encrypted at rest.

Trap 3: Use Azure Policy to audit for secret exposure

Policy does not scan code.

Study all Design a strategy for data and applications common traps →

A
Use Azure Key Vault references in App Service application settings
Secrets retrieved at runtime from Key Vault.
B
Implement Git pre-commit hooks to scan for secrets
Why wrong: Not a built-in Azure solution.
C
Store secrets in Azure DevOps library variable groups
Why wrong: Variables are not encrypted at rest.
D
Use Azure Policy to audit for secret exposure
Why wrong: Policy does not scan code.
E
Use Azure Key Vault variables in Azure DevOps release pipelines
Variables linked to Key Vault secrets.

Full breakdown with real-world context →

Question 12hardmultiple choice

Read the full NAT/PAT explanation →

You are the security architect for Contoso Ltd., a company that runs a critical e-commerce application on Azure Kubernetes Service (AKS). The application consists of multiple microservices that communicate over HTTP. The application uses Azure SQL Database for transactional data and Azure Redis Cache for session state. Recently, a security audit revealed that several microservices are vulnerable to SQL injection attacks because they construct SQL queries by concatenating user input. Additionally, the Redis cache is exposed to the internet with no firewall rules, and the connection string is stored in plain text in the application configuration file. The development team is concerned about performance and wants to minimize changes to the codebase. You need to design a strategy to mitigate these vulnerabilities with minimal code changes. Which of the following is the best course of action?

Trap 1: Enable Azure Web Application Firewall (WAF) on an Application…

WAF protects against SQL injection without code changes, private endpoint secures Redis, but firewall rule is redundant. Key Vault integration is correct.

Trap 2: Move all SQL queries to stored procedures, enable Redis persistence…

Stored procedures require code changes, Redis persistence does not address exposure, Kubernetes secrets are not encrypted at rest.

Trap 3: Refactor the microservices to use parameterized SQL queries,…

Requires code changes for SQL, and Redis firewall with node IPs may not be static.

Study all Design a strategy for data and applications common traps →

A
Deploy Azure Web Application Firewall (WAF) on Application Gateway to protect against SQL injection, configure Azure Redis Cache with a private endpoint and disable public network access, and use Azure Key Vault with a managed identity to inject the Redis connection string into the application.
WAF blocks SQL injection without code changes, private endpoint secures Redis, Key Vault with managed identity protects secrets.
B
Enable Azure Web Application Firewall (WAF) on an Application Gateway in front of AKS to block SQL injection, move Redis to a private endpoint with a firewall rule, and use Azure Key Vault with a managed identity to inject the Redis connection string.
Why wrong: WAF protects against SQL injection without code changes, private endpoint secures Redis, but firewall rule is redundant. Key Vault integration is correct.
C
Move all SQL queries to stored procedures, enable Redis persistence with AOF, and store the connection string in a Kubernetes secret.
Why wrong: Stored procedures require code changes, Redis persistence does not address exposure, Kubernetes secrets are not encrypted at rest.
D
Refactor the microservices to use parameterized SQL queries, configure Azure Redis Cache firewall to allow only AKS node IPs, and store the connection string in Azure Key Vault with a managed identity.
Why wrong: Requires code changes for SQL, and Redis firewall with node IPs may not be static.

Full breakdown with real-world context →

Question 13mediummultiple choice

Read the full Design a strategy for data and applications explanation →

A company uses Azure App Service to host a web application that stores sensitive data in Azure SQL Database. The security team requires that data at rest in the database be encrypted using a customer-managed key stored in Azure Key Vault. The key must be rotated automatically every 90 days. What is the recommended approach to meet these requirements?

Trap 1: Encrypt sensitive columns using cell-level encryption with keys…

Cell-level encryption requires manual rotation and does not scale well.

Trap 2: Enable Transparent Data Encryption (TDE) with service-managed keys…

Service-managed keys do not allow customer control or automatic rotation.

Trap 3: Use Always Encrypted with column master keys stored in Azure Key…

Always Encrypted requires application-level handling and does not support automatic key rotation without custom logic.

Study all Design a strategy for data and applications common traps →

A
Encrypt sensitive columns using cell-level encryption with keys stored in Azure Key Vault and rotate keys manually every 90 days.
Why wrong: Cell-level encryption requires manual rotation and does not scale well.
B
Enable Transparent Data Encryption (TDE) with service-managed keys in Azure SQL Database.
Why wrong: Service-managed keys do not allow customer control or automatic rotation.
C
Enable TDE with customer-managed keys in Azure Key Vault and set a key rotation policy in Key Vault to rotate the key every 90 days.
TDE with customer-managed keys supports automatic rotation via Key Vault lifecycle policies.
D
Use Always Encrypted with column master keys stored in Azure Key Vault and configure key rotation in the application code.
Why wrong: Always Encrypted requires application-level handling and does not support automatic key rotation without custom logic.

Full breakdown with real-world context →

Question 14hardmulti select

Read the full NAT/PAT explanation →

A multinational corporation is designing a data classification strategy for Microsoft 365. They have the following requirements: (1) Documents containing financial data must be labeled as 'Confidential' automatically. (2) Labels must be applied based on content patterns, such as credit card numbers. (3) The solution must work across Exchange Online, SharePoint Online, and OneDrive for Business. Which two components are essential?

Trap 1: Azure Information Protection (AIP) unified labeling client

AIP client is on-premises and not required for cloud scenarios.

Trap 2: Data Loss Prevention (DLP) policies in Microsoft 365 Security &…

DLP policies enforce actions but do not apply labels automatically.

Trap 3: Retention policies in Microsoft 365 Compliance Center

Retention policies manage data lifecycle, not classification.

Study all Design a strategy for data and applications common traps →

A
Azure Information Protection (AIP) unified labeling client
Why wrong: AIP client is on-premises and not required for cloud scenarios.
B
Sensitivity labels in Microsoft Purview Information Protection
Sensitivity labels are the core classification mechanism.
C
Data Loss Prevention (DLP) policies in Microsoft 365 Security & Compliance Center
Why wrong: DLP policies enforce actions but do not apply labels automatically.
D
Retention policies in Microsoft 365 Compliance Center
Why wrong: Retention policies manage data lifecycle, not classification.
E
Auto-labeling policies in Microsoft Purview Compliance Portal
Auto-labeling applies sensitivity labels based on content patterns.

Full breakdown with real-world context →

Question 15mediummultiple choice

Read the full Design a strategy for data and applications explanation →

A security administrator applies the Azure Policy definition shown in the exhibit to a management group containing multiple subscriptions. After the policy is assigned, a development team reports they cannot create a new storage account in their subscription. What is the most likely cause?

Exhibit

Refer to the exhibit.

{
  "policyRule": {
    "if": {
      "allOf": [
        {
          "field": "type",
          "equals": "Microsoft.Storage/storageAccounts"
        },
        {
          "field": "Microsoft.Storage/storageAccounts/supportsHttpsTrafficOnly",
          "equals": "false"
        }
      ]
    },
    "then": {
      "effect": "deny"
    }
  }
}

Trap 1: The storage account was created using an older API version that…

Azure Policy works with all API versions.

Trap 2: The storage account was created in a region that does not support…

The policy does not restrict based on tier or region.

Trap 3: The storage account was assigned a network security group (NSG)…

The policy does not check NSGs.

Study all Design a strategy for data and applications common traps →

A
The storage account was created using an older API version that does not support Azure Policy enforcement.
Why wrong: Azure Policy works with all API versions.
B
The storage account was created in a region that does not support the premium tier.
Why wrong: The policy does not restrict based on tier or region.
C
The storage account was assigned a network security group (NSG) that blocks inbound HTTPS traffic.
Why wrong: The policy does not check NSGs.
D
The storage account was created with the 'Secure transfer required' setting disabled.
The policy denies storage accounts where 'supportsHttpsTrafficOnly' is false, meaning secure transfer is not enabled.

Full breakdown with real-world context →

Question 16easymultiple choice

Read the full Design a strategy for data and applications explanation →

A company is designing an application architecture using Azure Kubernetes Service (AKS) and Azure Cosmos DB. The application requires that secrets (database connection strings) be injected into pods securely without storing them in the container image. The solution must minimize management overhead. What is the recommended approach?

Trap 1: Store secrets in a Kubernetes ConfigMap and reference them in the…

ConfigMaps are not designed for secrets and are not encrypted.

Trap 2: Define secrets in a Kubernetes Secret object and reference them in…

Kubernetes Secrets are base64 encoded but not encrypted by default and require RBAC management.

Trap 3: Hardcode the connection string in an environment variable in the…

This exposes secrets in plaintext and is insecure.

Study all Design a strategy for data and applications common traps →

A
Store secrets in a Kubernetes ConfigMap and reference them in the deployment YAML.
Why wrong: ConfigMaps are not designed for secrets and are not encrypted.
B
Use Azure Key Vault Provider for Secrets Store CSI Driver to mount secrets as volumes in pods.
This provides secure, managed secret injection with automatic rotation.
C
Define secrets in a Kubernetes Secret object and reference them in the pod spec.
Why wrong: Kubernetes Secrets are base64 encoded but not encrypted by default and require RBAC management.
D
Hardcode the connection string in an environment variable in the deployment manifest.
Why wrong: This exposes secrets in plaintext and is insecure.

Full breakdown with real-world context →

Question 17easymultiple choice

Read the full Design a strategy for data and applications explanation →

A company uses Azure SQL Database and needs to implement column-level encryption for a column containing social security numbers (SSNs). The encryption must use a customer-managed key stored in Azure Key Vault. The application queries this column using parameterized queries. Which technology should be used?

Trap 1: Dynamic Data Masking (DDM)

DDM masks data for unauthorized users but does not encrypt it.

Trap 2: Row-Level Security (RLS)

RLS restricts row access but does not encrypt columns.

Trap 3: Transparent Data Encryption (TDE) with customer-managed keys

TDE encrypts the database at rest, not individual columns.

Study all Design a strategy for data and applications common traps →

A
Dynamic Data Masking (DDM)
Why wrong: DDM masks data for unauthorized users but does not encrypt it.
B
Row-Level Security (RLS)
Why wrong: RLS restricts row access but does not encrypt columns.
C
Transparent Data Encryption (TDE) with customer-managed keys
Why wrong: TDE encrypts the database at rest, not individual columns.
D
Always Encrypted with secure enclaves
Always Encrypted provides column-level encryption and supports rich queries with secure enclaves.

Full breakdown with real-world context →

Question 18hardmultiple choice

Read the full Design a strategy for data and applications explanation →

A company is planning to use Azure Logic Apps to integrate multiple SaaS applications. The workflow will process sensitive customer data and must comply with data residency requirements, ensuring that data does not leave a specific Azure region. The solution must minimize latency. What is the recommended deployment strategy?

Trap 1: Use Azure API Management to route traffic to Logic Apps in the…

API Management does not enforce data residency for Logic Apps.

Trap 2: Deploy Logic Apps using the Standard plan in the required region.

Standard plan is single-tenant but still uses Azure global infrastructure; not guaranteed data residency.

Trap 3: Deploy Logic Apps using the Consumption plan in the required region.

Consumption plan runs in multi-tenant environment; storage may be replicated across regions.

Study all Design a strategy for data and applications common traps →

A
Use Azure API Management to route traffic to Logic Apps in the required region.
Why wrong: API Management does not enforce data residency for Logic Apps.
B
Deploy Logic Apps using the Standard plan in the required region.
Why wrong: Standard plan is single-tenant but still uses Azure global infrastructure; not guaranteed data residency.
C
Deploy Logic Apps using the Consumption plan in the required region.
Why wrong: Consumption plan runs in multi-tenant environment; storage may be replicated across regions.
D
Provision an Integration Service Environment (ISE) in the required region and deploy Logic Apps into it.
ISE provides dedicated storage and compute, ensuring data stays within the region.

Full breakdown with real-world context →

Question 19mediumdrag order

Read the full Design a strategy for data and applications explanation →

Order the steps to respond to a Microsoft Defender for Cloud security alert.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 20mediumdrag order

Read the full Design a strategy for data and applications explanation →

Order the steps to perform a disaster recovery failover of an Azure VM to a secondary region using Azure Site Recovery.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Continue with 20-question session →

Free account

Track your progress over time

Create a free account to save your results and see which topics improve across sessions.

Focused Design a strategy for data and applications sessions

Start a Design a strategy for data and applications only practice session

Every question in these sessions is drawn from the Design a strategy for data and applications domain — nothing else.

10 questions 20 questions 30 questions 50 questions

Browse all Design a strategy for data and applications questions →Mixed SC-100 session

Frequently asked questions

What does the SC-100 exam test about Design a strategy for data and applications?: Design a strategy for data and applications questions test whether you can apply the concept in context, not just recognise a definition.
How should I use these practice questions?: Select your answer before revealing the explanation. Then read why each option is right or wrong — this active recall approach builds retention far faster than re-reading notes.
Can I practise just Design a strategy for data and applications questions in a focused session?: Yes — the session launcher on this page draws every question from the Design a strategy for data and applications domain. Use a 10-question session first to gauge your baseline, then move to 20 or 30 once the weak spots are clear.
Where can I practise other SC-100 topics?: Use the topic links above to move to related areas, or go back to the SC-100 question bank to see all topics.
Are these real exam questions or dumps?: These are original practice questions written to test the same concepts the SC-100 exam covers. They are not copied from any real exam or dump site.

Design a strategy for data and applications only

10 questions 20 questions 30 questions 50 questions

Mixed SC-100 session

Track your progress

A free account saves results across sessions and highlights which topics need work.

Study resources

All SC-100 questions Design a strategy for data and applications domain overview SC-100 exam guide

Exam traps to avoid

▸Answering from memory before reading the full scenario.
▸Missing a constraint such as cost, availability, security, scope or command context.
▸Choosing a broad answer when the question asks for the most specific fix.
▸Ignoring why the wrong options are tempting.

Design a strategy for data and applications practice questions

What to know about Design a strategy for data and applications

Common Design a strategy for data and applications exam traps

Design a strategy for data and applications questions

A company is designing a data protection strategy for Azure SQL Database. They need to ensure that backups are retained for 7 years to meet regulatory compliance. Which Azure feature should they use?

A company deploys Azure App Service with a custom domain and SSL certificate. They want to enforce HTTPS only. Which configuration setting should they enable?

A company uses Azure Policy to audit storage accounts for secure transfer (HTTPS) enforcement. The policy is set to 'AuditIfNotExists' but compliance shows 0% non-compliant storage accounts even though some accounts have secure transfer disabled. What is the most likely cause?

A company is designing a microservices architecture on Azure Kubernetes Service (AKS). They need to secure communication between services using mutual TLS (mTLS). Which solution should they implement?

A company stores sensitive data in Azure Blob Storage. They want to prevent data exfiltration by blocking public access and restricting network access to only their on-premises data center via VPN. Which two features should they use?

A company uses Azure Key Vault to store secrets for their applications. They want to ensure that secrets can be automatically rotated when they are close to expiration. Which solution should they implement?

A company is migrating on-premises applications to Azure. They need to ensure that applications can use their existing Active Directory credentials for authentication. Which Azure service should they use?

A company wants to protect their Azure App Service web application from common web vulnerabilities like SQL injection and XSS. Which Azure service should they enable?

A company is designing a data classification strategy for their Azure environment. They need to identify sensitive data stored in Azure SQL Database. Which TWO solutions should they consider?

A company uses Azure Storage for sensitive data. They need to ensure that data is encrypted at rest and that encryption keys are managed by the customer (Customer-Managed Keys). Which THREE actions are required?

A company is designing a secure DevOps pipeline for deploying Azure App Service applications. They need to ensure that secrets are not exposed in source code. Which TWO practices should they implement?

A security administrator applies the Azure Policy definition shown in the exhibit to a management group containing multiple subscriptions. After the policy is assigned, a development team reports they cannot create a new storage account in their subscription. What is the most likely cause?

Exhibit

Order the steps to respond to a Microsoft Defender for Cloud security alert.

Order the steps to perform a disaster recovery failover of an Azure VM to a secondary region using Azure Site Recovery.

Track your progress over time

Start a Design a strategy for data and applications only practice session

Related SC-100 topic practice pages

Design solutions that align with security best practices and priorities practice questions

Design security operations, identity, and compliance capabilities practice questions

Design security solutions for infrastructure practice questions

Design a Zero Trust strategy and architecture practice questions

Design security solutions for applications and data practice questions

Evaluate GRC and security operations strategies practice questions

Design security for infrastructure practice questions