SC-100 Application Security 3

Question 1

An architect must design a solution to protect Azure API Management endpoints from OWASP Top 10 threats. Which Azure service should be placed in front of API Management?

Accepted Answer

Azure Application Gateway with WAF v2

Answer

Azure Application Gateway with WAF v2 provides OWASP Core Rule Set protection at Layer 7, directly in front of API Management.

Question 2

A security architect is evaluating token validation in an application using Microsoft Entra ID. Which claim in a JWT access token should be validated to confirm the token was issued for the correct audience?

Accepted Answer

aud (audience)

Answer

The 'aud' claim identifies the intended recipient of the token; failing to validate it allows tokens issued for other apps to be accepted.

Question 3

During a threat model review for a containerized application on AKS, which control specifically prevents privilege escalation by a compromised container?

Accepted Answer

Enable Azure Policy for AKS to disallow privileged containers

Answer

Azure Policy for AKS can enforce pod security standards that prevent containers from running as privileged, blocking privilege escalation paths.

Question 4

An organization uses Azure Static Web Apps to host a single-page application. Which security header should the architect configure to prevent clickjacking attacks?

Accepted Answer

X-Frame-Options

Answer

The X-Frame-Options header (or CSP frame-ancestors directive) prevents the page from being embedded in iframes on other domains, mitigating clickjacking.

Question 5

A cybersecurity architect needs to enforce that all Azure App Service deployments use HTTPS only and TLS 1.2 minimum. What is the most efficient way to enforce this at scale across multiple subscriptions?

Accepted Answer

Use Azure Policy with built-in definitions for HTTPS-only and minimum TLS version

Answer

Azure Policy built-in definitions can audit and enforce HTTPS-only and minimum TLS version settings across all App Services in multiple subscriptions from a single assignment.

(SC-100) Microsoft Cybersecurity Architect Expert Practice Test

(SC-100) Microsoft Cybersecurity Architect Expert Practice Test

SC-100 Application Security 3