SC-100 Cloud Security Design 5

Question 1

A company must design a strategy to protect against distributed denial-of-service (DDoS) attacks targeting public-facing Azure resources. Which service provides always-on traffic monitoring and automatic attack mitigation with SLA guarantees?

Accepted Answer

Azure DDoS Protection Standard (now Network)

Answer

Azure DDoS Protection Standard (Network) provides always-on monitoring, adaptive tuning, attack telemetry, and SLA-backed automatic mitigation for volumetric, protocol, and application-layer attacks.

Question 2

An architect must ensure that secrets, certificates, and keys used by cloud applications are rotated automatically and that applications never hard-code credentials. Which Azure design pattern best addresses this?

Accepted Answer

Use Azure Key Vault references in App Service and enable automatic secret rotation with Event Grid triggers

Answer

Key Vault references allow App Service to fetch secrets dynamically, and Event Grid triggers on expiry events can invoke Azure Functions to rotate secrets automatically.

Question 3

During an SC-100 design engagement, a customer asks how to implement defense-in-depth for an internet-facing web application hosted on Azure. Which layered control set best represents a defense-in-depth approach?

Accepted Answer

Azure Front Door WAF + Application Gateway WAF + NSG + App Service authentication + Defender for App Service

Answer

Defense-in-depth stacks multiple controls across network, application, and identity layers — combining CDN-layer WAF, regional WAF, network segmentation, app-layer auth, and threat detection.

Question 4

A security architect reviews a design where developers use Azure Managed Identities to access Azure Key Vault from Azure Functions. What is the primary security advantage of this approach over service principal client secrets?

Accepted Answer

There are no credentials to manage, store, or rotate — Azure handles the identity lifecycle

Answer

Managed identities eliminate credential management entirely — there are no secrets to leak, rotate, or expire because Azure automatically issues and rotates tokens internally.

Question 5

An organization needs to design a solution to detect when sensitive data labeled as 'Highly Confidential' is shared externally via Microsoft Teams or SharePoint Online. Which Microsoft service provides this capability?

Accepted Answer

Microsoft Purview Data Loss Prevention (DLP) policies with sensitivity label conditions

Answer

Microsoft Purview DLP policies can detect and block sharing of content bearing specific sensitivity labels across Teams, SharePoint, and Exchange in real time.

(SC-100) Microsoft Cybersecurity Architect Expert Practice Test

(SC-100) Microsoft Cybersecurity Architect Expert Practice Test

SC-100 Cloud Security Design 5