SC-100 Cloud Security Design 2 — Questions and Answers
Question 1: A company wants to enforce that all Azure VMs in a subscription must use managed disks and must not have public IP addresses. Which Azure service should the cybersecurity architect use to implement these requirements at scale?
- Azure Security Center Recommendations
- Azure Policy with Deny effects (Correct answer)
- Azure Blueprints Locks
- Microsoft Defender for Cloud Alerts
Correct answer: Azure Policy with Deny effects
Azure Policy with Deny effects prevents non-compliant resources from being created, enforcing configuration standards across the subscription.
Question 2: An organization needs to provide privileged access to Azure resources only when needed and wants to require approval and justification for access. Which feature of Azure AD should be implemented?
- Conditional Access Policies
- Azure AD Privileged Identity Management (PIM) (Correct answer)
- Azure AD Identity Protection
- Microsoft Entra Access Reviews
Correct answer: Azure AD Privileged Identity Management (PIM)
Azure AD PIM enables just-in-time privileged access with approval workflows and justification requirements for Azure resources.
Question 3: A cloud architect is designing a multi-tenant SaaS application on Azure. To ensure customer data isolation, which approach best aligns with the Microsoft Zero Trust model?
- Separate virtual networks per tenant with NSG rules (Correct answer)
- Single shared database with row-level security only
- Shared compute with tenant ID filtering in application code
- Single resource group with RBAC per tenant
Correct answer: Separate virtual networks per tenant with NSG rules
Separate virtual networks per tenant with NSGs provide network-level isolation, aligning with Zero Trust's principle of segmenting access explicitly.
Question 4: An architect must design a solution to detect and respond to anomalous sign-in activity across a hybrid Azure AD environment. Which service provides risk-based conditional access combined with identity threat detection?
- Microsoft Defender for Endpoint
- Azure AD Identity Protection (Correct answer)
- Microsoft Sentinel with UEBA
- Microsoft Defender for Cloud Apps
Correct answer: Azure AD Identity Protection
Azure AD Identity Protection detects risky sign-ins and users and can enforce risk-based Conditional Access policies to block or require MFA.
Question 5: A company must encrypt data at rest in Azure Blob Storage using keys that never leave their on-premises HSM. Which encryption option should the architect recommend?
- Microsoft-managed keys (MMK)
- Customer-managed keys (CMK) with Azure Key Vault
- Customer-provided keys (CPK) per request (Correct answer)
- Azure Disk Encryption with BitLocker
Correct answer: Customer-provided keys (CPK) per request
Customer-provided keys (CPK) allow the customer to supply their own encryption key per request so the key never persists in Azure.
Question 6: When designing a cloud workload protection strategy for SC-100, which Microsoft Defender for Cloud feature continuously assesses Azure resources against security benchmarks and provides a prioritized list of remediation actions?
- Adaptive Application Controls
- Secure Score (Correct answer)
- Just-in-Time VM Access
- Workflow Automation
Correct answer: Secure Score
Secure Score aggregates security assessments against Microsoft Cloud Security Benchmark and ranks remediation actions by impact.
Question 7: An architect is designing secure connectivity between an on-premises datacenter and Azure workloads. The requirements specify that traffic must not traverse the public internet. Which connectivity option best meets this requirement?
- Site-to-Site VPN over the internet
- Azure ExpressRoute with private peering (Correct answer)
- Azure VPN Gateway with IKEv2
- Azure Front Door with WAF
Correct answer: Azure ExpressRoute with private peering
Azure ExpressRoute with private peering establishes a dedicated private connection between on-premises networks and Azure that bypasses the public internet.
SC-100 Cloud Security Design 2
A company wants to enforce that all Azure VMs in a subscription must use managed disks and must not have public IP addresses.
Which Azure service should the cybersecurity architect use to implement these requirements at scale?