SC-100 Application Security 3 — Questions and Answers
Question 1: An architect must design a solution to protect Azure API Management endpoints from OWASP Top 10 threats. Which Azure service should be placed in front of API Management?
- Azure Firewall Premium
- Azure Application Gateway with WAF v2 (Correct answer)
- Azure Front Door with Azure CDN
- Azure Traffic Manager
Correct answer: Azure Application Gateway with WAF v2
Azure Application Gateway with WAF v2 provides OWASP Core Rule Set protection at Layer 7, directly in front of API Management.
Question 2: A security architect is evaluating token validation in an application using Microsoft Entra ID. Which claim in a JWT access token should be validated to confirm the token was issued for the correct audience?
- iss (issuer)
- aud (audience) (Correct answer)
- sub (subject)
- nbf (not before)
Correct answer: aud (audience)
The 'aud' claim identifies the intended recipient of the token; failing to validate it allows tokens issued for other apps to be accepted.
Question 3: During a threat model review for a containerized application on AKS, which control specifically prevents privilege escalation by a compromised container?
- Enable Azure Policy for AKS to disallow privileged containers (Correct answer)
- Use Azure Defender for Containers to scan images
- Configure network policies to restrict egress from pods
- Apply Azure RBAC roles to the AKS cluster
Correct answer: Enable Azure Policy for AKS to disallow privileged containers
Azure Policy for AKS can enforce pod security standards that prevent containers from running as privileged, blocking privilege escalation paths.
Question 4: An organization uses Azure Static Web Apps to host a single-page application. Which security header should the architect configure to prevent clickjacking attacks?
- Strict-Transport-Security
- Content-Security-Policy
- X-Frame-Options (Correct answer)
- X-Content-Type-Options
Correct answer: X-Frame-Options
The X-Frame-Options header (or CSP frame-ancestors directive) prevents the page from being embedded in iframes on other domains, mitigating clickjacking.
Question 5: A cybersecurity architect needs to enforce that all Azure App Service deployments use HTTPS only and TLS 1.2 minimum. What is the most efficient way to enforce this at scale across multiple subscriptions?
- Configure each App Service manually via the Azure portal
- Use Azure Policy with built-in definitions for HTTPS-only and minimum TLS version (Correct answer)
- Deploy an Azure Automation runbook that checks settings weekly
- Add a custom script in each application's startup command
Correct answer: Use Azure Policy with built-in definitions for HTTPS-only and minimum TLS version
Azure Policy built-in definitions can audit and enforce HTTPS-only and minimum TLS version settings across all App Services in multiple subscriptions from a single assignment.
Question 6: In an SC-100 scenario, an application stores session tokens in browser localStorage. What attack vector does this expose, and what is the recommended alternative?
- CSRF attacks; use SameSite=Strict cookies instead
- XSS attacks; use HttpOnly cookies to store session tokens instead (Correct answer)
- SQL injection; use parameterized queries instead
- SSRF attacks; use a managed identity instead
Correct answer: XSS attacks; use HttpOnly cookies to store session tokens instead
LocalStorage is accessible to JavaScript, making tokens vulnerable to XSS theft; HttpOnly cookies are inaccessible to scripts, mitigating this risk.
Question 7: Which Microsoft service provides a centralized view of security recommendations for application workloads across Azure, including secure score improvements for app security posture?
- Microsoft Sentinel
- Microsoft Defender for Cloud (Correct answer)
- Azure Monitor
- Microsoft Entra ID Protection
Correct answer: Microsoft Defender for Cloud
Microsoft Defender for Cloud provides a unified secure score and actionable security recommendations for application and infrastructure workloads in Azure.
SC-100 Application Security 3
An architect must design a solution to protect Azure API Management endpoints from OWASP Top 10 threats.
Which Azure service should be placed in front of API Management?