SC-100 Cloud Security Design 5 — Questions and Answers
Question 1: A company must design a strategy to protect against distributed denial-of-service (DDoS) attacks targeting public-facing Azure resources. Which service provides always-on traffic monitoring and automatic attack mitigation with SLA guarantees?
- Azure Firewall Premium with IDPS
- Azure DDoS Protection Standard (now Network) (Correct answer)
- Azure Application Gateway WAF v2
- Azure Front Door WAF rules only
Correct answer: Azure DDoS Protection Standard (now Network)
Azure DDoS Protection Standard (Network) provides always-on monitoring, adaptive tuning, attack telemetry, and SLA-backed automatic mitigation for volumetric, protocol, and application-layer attacks.
Question 2: An architect must ensure that secrets, certificates, and keys used by cloud applications are rotated automatically and that applications never hard-code credentials. Which Azure design pattern best addresses this?
- Store credentials in Azure App Configuration as plain-text values
- Use Azure Key Vault references in App Service and enable automatic secret rotation with Event Grid triggers (Correct answer)
- Embed credentials in ARM templates stored in a private Git repository
- Use Azure AD service principal client secrets rotated manually quarterly
Correct answer: Use Azure Key Vault references in App Service and enable automatic secret rotation with Event Grid triggers
Key Vault references allow App Service to fetch secrets dynamically, and Event Grid triggers on expiry events can invoke Azure Functions to rotate secrets automatically.
Question 3: During an SC-100 design engagement, a customer asks how to implement defense-in-depth for an internet-facing web application hosted on Azure. Which layered control set best represents a defense-in-depth approach?
- Azure Front Door WAF + Application Gateway WAF + NSG + App Service authentication + Defender for App Service (Correct answer)
- Public IP with DDoS Standard only
- Azure Firewall + single NSG rule
- TLS termination at the load balancer only
Correct answer: Azure Front Door WAF + Application Gateway WAF + NSG + App Service authentication + Defender for App Service
Defense-in-depth stacks multiple controls across network, application, and identity layers — combining CDN-layer WAF, regional WAF, network segmentation, app-layer auth, and threat detection.
Question 4: A security architect reviews a design where developers use Azure Managed Identities to access Azure Key Vault from Azure Functions. What is the primary security advantage of this approach over service principal client secrets?
- Managed identities support more granular RBAC than service principals
- There are no credentials to manage, store, or rotate — Azure handles the identity lifecycle (Correct answer)
- Managed identities bypass Conditional Access policies for faster access
- Managed identities allow cross-tenant access without federation
Correct answer: There are no credentials to manage, store, or rotate — Azure handles the identity lifecycle
Managed identities eliminate credential management entirely — there are no secrets to leak, rotate, or expire because Azure automatically issues and rotates tokens internally.
Question 5: An organization needs to design a solution to detect when sensitive data labeled as 'Highly Confidential' is shared externally via Microsoft Teams or SharePoint Online. Which Microsoft service provides this capability?
- Microsoft Purview Communication Compliance
- Microsoft Purview Data Loss Prevention (DLP) policies with sensitivity label conditions (Correct answer)
- Microsoft Defender for Cloud Apps with session controls only
- Azure Information Protection scanner for on-premises
Correct answer: Microsoft Purview Data Loss Prevention (DLP) policies with sensitivity label conditions
Microsoft Purview DLP policies can detect and block sharing of content bearing specific sensitivity labels across Teams, SharePoint, and Exchange in real time.
Question 6: An architect is designing an incident response capability for a cloud environment. Which Microsoft Sentinel feature allows the security team to automate enrichment of security alerts with threat intelligence and trigger response actions without human intervention?
- Analytics rules with KQL queries
- Automation rules and Playbooks (Logic Apps) (Correct answer)
- Workbooks for visualization
- Data connectors for log ingestion
Correct answer: Automation rules and Playbooks (Logic Apps)
Automation rules in Sentinel trigger Logic App Playbooks automatically, enabling orchestrated enrichment (e.g., VirusTotal lookups) and response actions (e.g., blocking an IP) without manual steps.
Question 7: A cybersecurity architect must design a solution where access to Azure management operations (e.g., deleting resources, modifying security settings) requires a second approval factor beyond the user's standard MFA. Which control achieves this?
- Require MFA for all users via Conditional Access
- Configure Azure AD PIM with approval workflows for Azure resource privileged roles (Correct answer)
- Enable Microsoft Entra ID Protection risk policies
- Apply resource locks (CanNotDelete) to all resources
Correct answer: Configure Azure AD PIM with approval workflows for Azure resource privileged roles
Azure AD PIM requires explicit activation, justification, and optionally a second approver for privileged Azure resource roles, adding a human approval gate beyond standard MFA.
SC-100 Cloud Security Design 5
A company must design a strategy to protect against distributed denial-of-service (DDoS) attacks targeting public-facing Azure resources.
Which service provides always-on traffic monitoring and automatic attack mitigation with SLA guarantees?