SC-100 Application Security 5 — Questions and Answers
Question 1: An organization is implementing a Zero Trust application access strategy. Which Microsoft solution enables clientless browser-based access to internal web apps without a VPN?
- Azure VPN Gateway with point-to-site configuration
- Microsoft Entra Application Proxy (Correct answer)
- Azure Bastion for application tunneling
- Azure ExpressRoute with private peering
Correct answer: Microsoft Entra Application Proxy
Microsoft Entra Application Proxy provides secure, clientless remote access to on-premises web applications through the browser without requiring a VPN.
Question 2: During code review of an Azure Function, you discover it constructs LDAP queries using unsanitized user input. Which vulnerability does this represent?
- XML External Entity (XXE) injection
- LDAP injection (Correct answer)
- Command injection
- Path traversal
Correct answer: LDAP injection
Constructing LDAP queries with unsanitized user input exposes the application to LDAP injection, which can bypass authentication or expose directory data.
Question 3: A cybersecurity architect needs to ensure that third-party JavaScript libraries used in an Azure Static Web App cannot exfiltrate data to unknown domains. Which HTTP security header enforces this?
- X-Frame-Options
- Content-Security-Policy with connect-src directive (Correct answer)
- Referrer-Policy
- Permissions-Policy
Correct answer: Content-Security-Policy with connect-src directive
The Content-Security-Policy header's connect-src directive restricts which domains JavaScript (including third-party scripts) can make network connections to.
Question 4: An architect is designing the identity model for a new microservices application. Each service needs to call other services without user context. Which OAuth 2.0 flow is appropriate?
- Authorization code flow
- On-behalf-of (OBO) flow
- Client credentials flow (Correct answer)
- Implicit flow
Correct answer: Client credentials flow
The client credentials flow is designed for machine-to-machine authentication where a service authenticates using its own identity, not on behalf of a user.
Question 5: A security architect is reviewing the AppLocker/WDAC policies for application control on developer workstations. Which Microsoft Defender feature provides similar application control for containerized workloads on AKS?
- Microsoft Defender for Containers image scanning
- Azure Policy add-on for AKS enforcing allowed image registries (Correct answer)
- Kubernetes network policies for pod communication
- Azure Monitor container insights
Correct answer: Azure Policy add-on for AKS enforcing allowed image registries
Azure Policy for AKS can enforce that only images from approved registries are deployed, acting as application control for containerized workloads.
Question 6: Your organization's threat model identifies that attackers may attempt to enumerate valid usernames through a login API by analyzing response times. Which design pattern mitigates this timing attack?
- Implement account lockout after 5 failed attempts
- Return identical response times and messages for valid and invalid usernames using constant-time comparison (Correct answer)
- Require CAPTCHA on all login attempts
- Use Azure AD B2C for all authentication flows
Correct answer: Return identical response times and messages for valid and invalid usernames using constant-time comparison
Constant-time comparison and uniform response messages prevent attackers from distinguishing valid from invalid usernames based on timing or response content differences.
Question 7: A security architect must recommend a method for securely transmitting sensitive claim data between a relying party and identity provider without exposing it in the browser URL. Which token type and binding should be used?
- Use an implicit flow ID token returned in the URL fragment
- Use an authorization code exchanged for tokens via a back-channel HTTPS POST (Correct answer)
- Use a SAML assertion embedded in the HTML form POST body over HTTP
- Use a refresh token stored in sessionStorage and sent in headers
Correct answer: Use an authorization code exchanged for tokens via a back-channel HTTPS POST
The authorization code flow exchanges a short-lived code for tokens via a back-channel server-to-server HTTPS POST, keeping sensitive claims out of the browser URL or history.
SC-100 Application Security 5
An organization is implementing a Zero Trust application access strategy.
Which Microsoft solution enables clientless browser-based access to internal web apps without a VPN?