SC-100 Cloud Security Design 3 — Questions and Answers
Question 1: A security architect is designing a solution for a financial services company that needs to prevent data exfiltration from Azure PaaS services such as Azure SQL and Azure Storage. Which feature enforces that traffic to these services only flows through the customer's virtual network?
- Private Link and Private Endpoints (Correct answer)
- Service Tags on NSGs
- Azure Firewall FQDN filtering
- VNet Service Endpoints with NSG rules
Correct answer: Private Link and Private Endpoints
Private Link and Private Endpoints expose PaaS services on a private IP within the customer's VNet, preventing any traffic from traversing the public internet.
Question 2: An organization is adopting a Cloud Security Posture Management (CSPM) approach. Which Microsoft service is specifically designed for CSPM and provides agentless vulnerability assessment across Azure, AWS, and GCP?
- Microsoft Sentinel
- Microsoft Defender for Cloud (CSPM tier) (Correct answer)
- Azure Security Center (free tier)
- Microsoft Defender for Endpoint
Correct answer: Microsoft Defender for Cloud (CSPM tier)
Microsoft Defender for Cloud's Defender CSPM tier provides agentless scanning, attack path analysis, and posture management across multicloud environments.
Question 3: A cybersecurity architect must design a strategy to protect APIs exposed via Azure API Management. Which combination of controls best addresses OWASP API Security Top 10 threats?
- WAF policy on API Management + OAuth 2.0 + rate limiting (Correct answer)
- NSG rules on subnet + basic authentication only
- Azure Firewall + IP allowlist only
- DDoS Protection Standard + TLS 1.2 only
Correct answer: WAF policy on API Management + OAuth 2.0 + rate limiting
Combining a WAF policy with OAuth 2.0 authentication and rate limiting addresses injection attacks, broken authentication, and resource exhaustion threats.
Question 4: When designing cloud security for containers on Azure Kubernetes Service (AKS), which control prevents privileged container escalation at the Kubernetes admission level?
- Azure Policy add-on for AKS with built-in pod security policies (Correct answer)
- Network Policy with Calico
- Azure Defender for Kubernetes alerts only
- Container image scanning in ACR
Correct answer: Azure Policy add-on for AKS with built-in pod security policies
The Azure Policy add-on for AKS enforces built-in Gatekeeper constraints (like disallowing privileged pods) at admission time before workloads run.
Question 5: An architect is evaluating logging strategies for a cloud environment. Which Azure service should serve as the central cloud-native SIEM and SOAR platform for threat detection, investigation, and automated response?
- Azure Monitor Log Analytics
- Microsoft Sentinel (Correct answer)
- Microsoft Defender for Cloud
- Azure Event Hubs
Correct answer: Microsoft Sentinel
Microsoft Sentinel is Microsoft's cloud-native SIEM and SOAR platform that aggregates logs, detects threats with analytics rules, and automates response via playbooks.
Question 6: A company must meet the requirement that no single administrator can approve their own access to production encryption keys stored in Azure Key Vault. Which access control design satisfies this requirement?
- Enable soft-delete and purge protection only
- Implement Key Vault RBAC with separate Key Vault Crypto Officer and approver roles bound to different users (Correct answer)
- Use managed identities for all applications accessing Key Vault
- Enable Key Vault firewall to restrict access by IP
Correct answer: Implement Key Vault RBAC with separate Key Vault Crypto Officer and approver roles bound to different users
Assigning the Key Vault Crypto Officer role and approval responsibility to different individuals enforces separation of duties for key management.
Question 7: An architect is designing a secure landing zone on Azure. According to the Microsoft Cloud Adoption Framework security best practices, which element should be deployed in the connectivity subscription to inspect and filter traffic between spoke VNets and the internet?
- Azure DDoS Protection Standard on each spoke
- Centralized Azure Firewall Premium in a hub VNet (Correct answer)
- NSG flow logs with Traffic Analytics
- Azure Front Door with WAF in each spoke
Correct answer: Centralized Azure Firewall Premium in a hub VNet
The hub-spoke model places a centralized Azure Firewall Premium in the hub VNet to inspect all east-west and north-south traffic, including internet-bound flows.
SC-100 Cloud Security Design 3
A security architect is designing a solution for a financial services company that needs to prevent data exfiltration from Azure PaaS services such as Azure SQL and Azure Storage.
Which feature enforces that traffic to these services only flows through the customer's virtual network?