SC-100 Application Security 2 — Questions and Answers
Question 1: A cybersecurity architect needs to ensure that secrets used by Azure App Service applications are rotated automatically without code changes. Which solution best meets this requirement?
- Store secrets in app settings and update them via Azure DevOps pipelines
- Use Azure Key Vault references in App Service configuration with managed identity (Correct answer)
- Encrypt secrets in appsettings.json and redeploy on rotation
- Use Azure Blob Storage to store secrets and read them at startup
Correct answer: Use Azure Key Vault references in App Service configuration with managed identity
Azure Key Vault references allow App Service to automatically fetch the latest secret version using a managed identity, enabling rotation without code changes.
Question 2: During an SC-100 design review, you must recommend a control to prevent insecure deserialization attacks in a .NET application hosted on Azure. What is the most effective architectural recommendation?
- Enable Azure DDoS Protection on the virtual network
- Use Azure API Management to validate JSON schemas before forwarding requests
- Apply input validation and avoid deserializing untrusted data using custom binders (Correct answer)
- Enable Microsoft Defender for App Service threat detection
Correct answer: Apply input validation and avoid deserializing untrusted data using custom binders
Insecure deserialization is best mitigated by never deserializing untrusted data and applying strict type controls and custom serialization binders.
Question 3: An organization wants to implement software composition analysis (SCA) in its Azure DevOps pipeline to identify open-source vulnerabilities. Which Microsoft service provides this capability natively?
- Microsoft Defender for DevOps (Correct answer)
- Azure Policy
- Microsoft Sentinel
- Azure Security Center Secure Score
Correct answer: Microsoft Defender for DevOps
Microsoft Defender for DevOps integrates with Azure DevOps and GitHub to provide SCA, secret scanning, and IaC security scanning within the pipeline.
Question 4: A security architect is designing OAuth 2.0 authorization for a multi-tenant SaaS application registered in Microsoft Entra ID. Which flow should be used for a server-side web application accessing Microsoft Graph on behalf of a signed-in user?
- Client credentials flow
- Device code flow
- Authorization code flow with PKCE (Correct answer)
- Resource owner password credentials flow
Correct answer: Authorization code flow with PKCE
The authorization code flow with PKCE is the recommended OAuth 2.0 flow for server-side web apps acting on behalf of a signed-in user.
Question 5: Your organization's application uses Azure Service Bus for inter-service messaging. Which security control should you recommend to prevent unauthorized services from publishing messages?
- Restrict access using Azure Service Bus Shared Access Signatures scoped to Send permission (Correct answer)
- Enable Microsoft Defender for Service Bus
- Place Service Bus behind an Azure Load Balancer
- Use Azure Monitor alerts to detect unauthorized publishers
Correct answer: Restrict access using Azure Service Bus Shared Access Signatures scoped to Send permission
Scoped Shared Access Signatures grant only the Send permission to authorized publishers, preventing unauthorized services from publishing messages.
Question 6: A developer team wants to prevent credential leaks in source code committed to Azure Repos. Which Microsoft Defender for DevOps feature addresses this concern?
- Dependency scanning
- Secret scanning (Correct answer)
- Container image scanning
- Infrastructure-as-code scanning
Correct answer: Secret scanning
Secret scanning in Microsoft Defender for DevOps detects credentials, API keys, and connection strings committed to repositories.
Question 7: When designing an application security architecture for a Zero Trust model, which principle most directly applies to API-to-API communication between microservices?
- Assume all internal network traffic is trusted
- Use mutual TLS (mTLS) to authenticate both client and server for each request (Correct answer)
- Rely on network segmentation with NSGs to control microservice communication
- Implement IP allowlisting between microservice endpoints
Correct answer: Use mutual TLS (mTLS) to authenticate both client and server for each request
Mutual TLS enforces identity verification on both sides of every connection, directly implementing Zero Trust's 'verify explicitly' principle for microservice communication.
SC-100 Application Security 2
A cybersecurity architect needs to ensure that secrets used by Azure App Service applications are rotated automatically without code changes.
Which solution best meets this requirement?