SC-100 Application Security 4

Question 1

An organization wants to implement the STRIDE threat model for a new Azure-hosted application. Which STRIDE category does an attacker forging a user's identity token fall under?

Accepted Answer

Spoofing

Answer

Spoofing in STRIDE refers to an attacker falsely claiming another identity, such as forging or stealing authentication tokens.

Question 2

A security architect is designing a DevSecOps pipeline in Azure DevOps. At which stage should static application security testing (SAST) be integrated?

Accepted Answer

During the build stage to analyze source code before compilation

Answer

SAST analyzes source code or binaries and should run during the build stage to catch vulnerabilities as early as possible in the pipeline.

Question 3

You are architecting a solution where an Azure Function must access an Azure SQL Database without storing credentials anywhere. Which approach satisfies this requirement?

Accepted Answer

Use system-assigned managed identity and grant it db_datareader on the SQL database

Answer

A system-assigned managed identity eliminates credentials entirely by allowing the function to authenticate to SQL using its Entra ID identity.

Question 4

A multi-tenant application needs to ensure that tenant A cannot access tenant B's data even if they exploit an authorization bug. Which architectural pattern enforces this at the data layer?

Accepted Answer

Row-level security (RLS) in Azure SQL with tenant context filters

Answer

Row-level security in Azure SQL enforces data isolation at the database engine level, ensuring queries automatically filter to the correct tenant's data.

Question 5

An application team reports that their API is vulnerable to excessive data exposure, returning full object models when only partial data is needed. Which API security best practice addresses this?

Accepted Answer

Return only the fields required by the client using response filtering or DTOs

Answer

Returning only required fields (data minimization via DTOs or response filtering) directly mitigates OWASP API3 Excessive Data Exposure.

(SC-100) Microsoft Cybersecurity Architect Expert Practice Test

(SC-100) Microsoft Cybersecurity Architect Expert Practice Test

SC-100 Application Security 4