SC-100 Cloud Security Design 2

Question 1

A company wants to enforce that all Azure VMs in a subscription must use managed disks and must not have public IP addresses. Which Azure service should the cybersecurity architect use to implement these requirements at scale?

Accepted Answer

Azure Policy with Deny effects

Answer

Azure Policy with Deny effects prevents non-compliant resources from being created, enforcing configuration standards across the subscription.

Question 2

An organization needs to provide privileged access to Azure resources only when needed and wants to require approval and justification for access. Which feature of Azure AD should be implemented?

Accepted Answer

Azure AD Privileged Identity Management (PIM)

Answer

Azure AD PIM enables just-in-time privileged access with approval workflows and justification requirements for Azure resources.

Question 3

A cloud architect is designing a multi-tenant SaaS application on Azure. To ensure customer data isolation, which approach best aligns with the Microsoft Zero Trust model?

Accepted Answer

Separate virtual networks per tenant with NSG rules

Answer

Separate virtual networks per tenant with NSGs provide network-level isolation, aligning with Zero Trust's principle of segmenting access explicitly.

Question 4

An architect must design a solution to detect and respond to anomalous sign-in activity across a hybrid Azure AD environment. Which service provides risk-based conditional access combined with identity threat detection?

Accepted Answer

Azure AD Identity Protection

Answer

Azure AD Identity Protection detects risky sign-ins and users and can enforce risk-based Conditional Access policies to block or require MFA.

Question 5

A company must encrypt data at rest in Azure Blob Storage using keys that never leave their on-premises HSM. Which encryption option should the architect recommend?

Accepted Answer

Customer-provided keys (CPK) per request

Answer

Customer-provided keys (CPK) allow the customer to supply their own encryption key per request so the key never persists in Azure.

(SC-100) Microsoft Cybersecurity Architect Expert Practice Test

(SC-100) Microsoft Cybersecurity Architect Expert Practice Test

SC-100 Cloud Security Design 2