SC-100 Cloud Security Design 3

Question 1

A security architect is designing a solution for a financial services company that needs to prevent data exfiltration from Azure PaaS services such as Azure SQL and Azure Storage. Which feature enforces that traffic to these services only flows through the customer's virtual network?

Accepted Answer

Private Link and Private Endpoints

Answer

Private Link and Private Endpoints expose PaaS services on a private IP within the customer's VNet, preventing any traffic from traversing the public internet.

Question 2

An organization is adopting a Cloud Security Posture Management (CSPM) approach. Which Microsoft service is specifically designed for CSPM and provides agentless vulnerability assessment across Azure, AWS, and GCP?

Accepted Answer

Microsoft Defender for Cloud (CSPM tier)

Answer

Microsoft Defender for Cloud's Defender CSPM tier provides agentless scanning, attack path analysis, and posture management across multicloud environments.

Question 3

A cybersecurity architect must design a strategy to protect APIs exposed via Azure API Management. Which combination of controls best addresses OWASP API Security Top 10 threats?

Accepted Answer

WAF policy on API Management + OAuth 2.0 + rate limiting

Answer

Combining a WAF policy with OAuth 2.0 authentication and rate limiting addresses injection attacks, broken authentication, and resource exhaustion threats.

Question 4

When designing cloud security for containers on Azure Kubernetes Service (AKS), which control prevents privileged container escalation at the Kubernetes admission level?

Accepted Answer

Azure Policy add-on for AKS with built-in pod security policies

Answer

The Azure Policy add-on for AKS enforces built-in Gatekeeper constraints (like disallowing privileged pods) at admission time before workloads run.

Question 5

An architect is evaluating logging strategies for a cloud environment. Which Azure service should serve as the central cloud-native SIEM and SOAR platform for threat detection, investigation, and automated response?

Accepted Answer

Microsoft Sentinel

Answer

Microsoft Sentinel is Microsoft's cloud-native SIEM and SOAR platform that aggregates logs, detects threats with analytics rules, and automates response via playbooks.

(SC-100) Microsoft Cybersecurity Architect Expert Practice Test

(SC-100) Microsoft Cybersecurity Architect Expert Practice Test

SC-100 Cloud Security Design 3