SC-100 Cloud Security Design 4

Question 1

A global company needs to design a solution that applies consistent security policies across Azure, AWS, and on-premises servers from a single pane of glass. Which Microsoft service enables this unified security management?

Accepted Answer

Azure Arc with Microsoft Defender for Cloud

Answer

Azure Arc extends Azure management to any infrastructure, and when combined with Defender for Cloud, provides unified CSPM and threat protection across multicloud and on-premises.

Question 2

During an SC-100 design review, an architect must recommend a control to prevent data stored in Azure Storage accounts from being publicly accessible across an entire management group. What is the most scalable approach?

Accepted Answer

Apply an Azure Policy assignment with Deny effect at the management group scope

Answer

Assigning an Azure Policy with Deny effect at the management group scope prevents any storage account from being created or modified to allow public access across all child subscriptions.

Question 3

A healthcare organization requires that all traffic between Azure subnets containing workloads with PHI must be logged for compliance auditing. Which Azure feature captures network flow data at the subnet level?

Accepted Answer

NSG Flow Logs sent to a Storage Account or Log Analytics

Answer

NSG Flow Logs record information about IP traffic flowing through Network Security Groups and can be sent to Storage or Log Analytics for retention and analysis.

Question 4

An architect needs to design a solution ensuring developers cannot deploy resources to production Azure subscriptions without passing a security review gate. Which governance feature enforces this without relying solely on manual processes?

Accepted Answer

Azure DevOps branch policies with security review stage in CI/CD pipeline

Answer

Azure DevOps branch policies combined with a mandatory security review stage in the CI/CD pipeline create an automated gate that blocks deployments without approval.

Question 5

A cybersecurity architect is designing data classification for cloud workloads. Which Microsoft service automatically discovers, classifies, and labels sensitive data stored in Azure SQL, Azure Blob Storage, and other data stores?

Accepted Answer

Microsoft Purview

Answer

Microsoft Purview provides automated data discovery, classification using built-in and custom sensitive information types, and labeling across Azure and multicloud data stores.

(SC-100) Microsoft Cybersecurity Architect Expert Practice Test

(SC-100) Microsoft Cybersecurity Architect Expert Practice Test

SC-100 Cloud Security Design 4