SC-100 Application Security 4 — Questions and Answers
Question 1: An organization wants to implement the STRIDE threat model for a new Azure-hosted application. Which STRIDE category does an attacker forging a user's identity token fall under?
- Tampering
- Repudiation
- Spoofing (Correct answer)
- Elevation of Privilege
Correct answer: Spoofing
Spoofing in STRIDE refers to an attacker falsely claiming another identity, such as forging or stealing authentication tokens.
Question 2: A security architect is designing a DevSecOps pipeline in Azure DevOps. At which stage should static application security testing (SAST) be integrated?
- During the release stage after deployment to production
- During the build stage to analyze source code before compilation (Correct answer)
- During the test stage after functional tests pass
- During the monitoring stage using runtime analysis
Correct answer: During the build stage to analyze source code before compilation
SAST analyzes source code or binaries and should run during the build stage to catch vulnerabilities as early as possible in the pipeline.
Question 3: You are architecting a solution where an Azure Function must access an Azure SQL Database without storing credentials anywhere. Which approach satisfies this requirement?
- Store credentials in Azure Key Vault and retrieve them at function startup
- Use system-assigned managed identity and grant it db_datareader on the SQL database (Correct answer)
- Use Azure AD pass-through authentication with a service account
- Embed credentials in the function app's connection string setting
Correct answer: Use system-assigned managed identity and grant it db_datareader on the SQL database
A system-assigned managed identity eliminates credentials entirely by allowing the function to authenticate to SQL using its Entra ID identity.
Question 4: A multi-tenant application needs to ensure that tenant A cannot access tenant B's data even if they exploit an authorization bug. Which architectural pattern enforces this at the data layer?
- Row-level security (RLS) in Azure SQL with tenant context filters (Correct answer)
- Separate Azure AD tenants for each customer
- Network isolation using VNet peering per tenant
- Azure RBAC roles assigned per tenant user
Correct answer: Row-level security (RLS) in Azure SQL with tenant context filters
Row-level security in Azure SQL enforces data isolation at the database engine level, ensuring queries automatically filter to the correct tenant's data.
Question 5: An application team reports that their API is vulnerable to excessive data exposure, returning full object models when only partial data is needed. Which API security best practice addresses this?
- Implement rate limiting on all API endpoints
- Return only the fields required by the client using response filtering or DTOs (Correct answer)
- Enable Azure API Management subscription keys
- Use HTTPS to encrypt all API responses
Correct answer: Return only the fields required by the client using response filtering or DTOs
Returning only required fields (data minimization via DTOs or response filtering) directly mitigates OWASP API3 Excessive Data Exposure.
Question 6: When configuring Microsoft Defender for APIs in Azure API Management, which threat does Defender primarily detect through behavioral analysis?
- SQL injection in database queries behind the API
- Anomalous API usage patterns indicating credential stuffing or scraping attacks (Correct answer)
- Misconfigured CORS headers on the API
- Expired TLS certificates on API endpoints
Correct answer: Anomalous API usage patterns indicating credential stuffing or scraping attacks
Defender for APIs uses ML-based behavioral analysis to detect anomalous patterns like unusual call volumes or sequences that indicate credential stuffing, scraping, or API abuse.
Question 7: A security architect must recommend controls to prevent Server-Side Request Forgery (SSRF) in an Azure-hosted web application. Which combination of controls is most effective?
- Enable Azure DDoS Protection and configure NSG inbound rules
- Validate and allowlist outbound URL destinations and use managed identity for internal service access (Correct answer)
- Deploy the app behind Azure Front Door and enable WAF
- Configure Content Security Policy headers and enable HSTS
Correct answer: Validate and allowlist outbound URL destinations and use managed identity for internal service access
SSRF is mitigated by validating all server-initiated outbound requests against an allowlist and using managed identities so internal services don't need embedded credentials.
SC-100 Application Security 4
An organization wants to implement the STRIDE threat model for a new Azure-hosted application.
Which STRIDE category does an attacker forging a user's identity token fall under?