SC-100 Application Security 5

Question 1

An organization is implementing a Zero Trust application access strategy. Which Microsoft solution enables clientless browser-based access to internal web apps without a VPN?

Accepted Answer

Microsoft Entra Application Proxy

Answer

Microsoft Entra Application Proxy provides secure, clientless remote access to on-premises web applications through the browser without requiring a VPN.

Question 2

During code review of an Azure Function, you discover it constructs LDAP queries using unsanitized user input. Which vulnerability does this represent?

Accepted Answer

LDAP injection

Answer

Constructing LDAP queries with unsanitized user input exposes the application to LDAP injection, which can bypass authentication or expose directory data.

Question 3

A cybersecurity architect needs to ensure that third-party JavaScript libraries used in an Azure Static Web App cannot exfiltrate data to unknown domains. Which HTTP security header enforces this?

Accepted Answer

Content-Security-Policy with connect-src directive

Answer

The Content-Security-Policy header's connect-src directive restricts which domains JavaScript (including third-party scripts) can make network connections to.

Question 4

An architect is designing the identity model for a new microservices application. Each service needs to call other services without user context. Which OAuth 2.0 flow is appropriate?

Accepted Answer

Client credentials flow

Answer

The client credentials flow is designed for machine-to-machine authentication where a service authenticates using its own identity, not on behalf of a user.

Question 5

A security architect is reviewing the AppLocker/WDAC policies for application control on developer workstations. Which Microsoft Defender feature provides similar application control for containerized workloads on AKS?

Accepted Answer

Azure Policy add-on for AKS enforcing allowed image registries

Answer

Azure Policy for AKS can enforce that only images from approved registries are deployed, acting as application control for containerized workloads.

(SC-100) Microsoft Cybersecurity Architect Expert Practice Test

(SC-100) Microsoft Cybersecurity Architect Expert Practice Test

SC-100 Application Security 5