SC-100 Cloud Security Design 4 — Questions and Answers
Question 1: A global company needs to design a solution that applies consistent security policies across Azure, AWS, and on-premises servers from a single pane of glass. Which Microsoft service enables this unified security management?
- Azure Arc with Microsoft Defender for Cloud (Correct answer)
- Azure Policy alone
- Microsoft Intune with Endpoint Manager
- Azure Monitor with custom dashboards
Correct answer: Azure Arc with Microsoft Defender for Cloud
Azure Arc extends Azure management to any infrastructure, and when combined with Defender for Cloud, provides unified CSPM and threat protection across multicloud and on-premises.
Question 2: During an SC-100 design review, an architect must recommend a control to prevent data stored in Azure Storage accounts from being publicly accessible across an entire management group. What is the most scalable approach?
- Manually configure each storage account's public access setting
- Apply an Azure Policy assignment with Deny effect at the management group scope (Correct answer)
- Use Microsoft Defender for Storage alerts to remediate after the fact
- Require storage account owners to attest quarterly in Access Reviews
Correct answer: Apply an Azure Policy assignment with Deny effect at the management group scope
Assigning an Azure Policy with Deny effect at the management group scope prevents any storage account from being created or modified to allow public access across all child subscriptions.
Question 3: A healthcare organization requires that all traffic between Azure subnets containing workloads with PHI must be logged for compliance auditing. Which Azure feature captures network flow data at the subnet level?
- Azure Firewall diagnostic logs
- NSG Flow Logs sent to a Storage Account or Log Analytics (Correct answer)
- Azure Network Watcher packet capture only
- Azure Monitor activity logs
Correct answer: NSG Flow Logs sent to a Storage Account or Log Analytics
NSG Flow Logs record information about IP traffic flowing through Network Security Groups and can be sent to Storage or Log Analytics for retention and analysis.
Question 4: An architect needs to design a solution ensuring developers cannot deploy resources to production Azure subscriptions without passing a security review gate. Which governance feature enforces this without relying solely on manual processes?
- Azure DevOps branch policies with security review stage in CI/CD pipeline (Correct answer)
- Azure Role-Based Access Control with read-only production roles for developers
- Azure Cost Management budgets
- Azure Blueprints subscription-level locks only
Correct answer: Azure DevOps branch policies with security review stage in CI/CD pipeline
Azure DevOps branch policies combined with a mandatory security review stage in the CI/CD pipeline create an automated gate that blocks deployments without approval.
Question 5: A cybersecurity architect is designing data classification for cloud workloads. Which Microsoft service automatically discovers, classifies, and labels sensitive data stored in Azure SQL, Azure Blob Storage, and other data stores?
- Microsoft Purview (Correct answer)
- Microsoft Defender for Cloud data sensitivity features only
- Azure Information Protection scanner (classic)
- Microsoft Endpoint DLP only
Correct answer: Microsoft Purview
Microsoft Purview provides automated data discovery, classification using built-in and custom sensitive information types, and labeling across Azure and multicloud data stores.
Question 6: When designing cloud workload protection, an architect evaluates using Microsoft Defender for Servers Plan 2. Which capability is exclusively available in Plan 2 but not Plan 1?
- Microsoft Defender Antivirus integration
- Just-in-time VM access
- File Integrity Monitoring (FIM) and 500 MB of free Log Analytics data (Correct answer)
- Basic vulnerability assessment via Qualys
Correct answer: File Integrity Monitoring (FIM) and 500 MB of free Log Analytics data
Defender for Servers Plan 2 includes File Integrity Monitoring and 500 MB of free Log Analytics ingestion per server per day, which are not included in Plan 1.
Question 7: An organization wants to ensure that its cloud security architecture satisfies the shared responsibility model for Azure PaaS services. For Azure App Service, which security responsibility remains with the customer?
- Patching the underlying host OS and hypervisor
- Securing application code, authentication configuration, and data inputs (Correct answer)
- Managing physical datacenter security
- Maintaining the App Service runtime and middleware patches
Correct answer: Securing application code, authentication configuration, and data inputs
For Azure PaaS services like App Service, Microsoft manages the infrastructure; customers are responsible for their application code, authentication design, and data protection.
SC-100 Cloud Security Design 4
A global company needs to design a solution that applies consistent security policies across Azure, AWS, and on-premises servers from a single pane of glass.
Which Microsoft service enables this unified security management?