SC-100 Network Security Architecture 2 — Questions and Answers
Question 1: An organization wants to implement micro-segmentation for its Azure workloads to limit lateral movement. Which Azure service best enables this at the workload level?
- Azure Firewall Premium
- Application Security Groups (ASGs) (Correct answer)
- Azure DDoS Protection Standard
- Azure Bastion
Correct answer: Application Security Groups (ASGs)
Application Security Groups allow you to group VMs logically and define NSG rules based on those groups, enabling micro-segmentation without managing IP addresses.
Question 2: Which Azure Private Link feature prevents data exfiltration by ensuring traffic to Azure PaaS services never traverses the public internet?
- Service Endpoints with service endpoint policies
- Private Endpoints (Correct answer)
- Azure Firewall DNAT rules
- VNet peering with gateway transit
Correct answer: Private Endpoints
Private Endpoints assign a private IP from your VNet to an Azure PaaS service, keeping all traffic on the Microsoft backbone and preventing data exfiltration via the public internet.
Question 3: A security architect must ensure that all outbound internet traffic from Azure VMs is inspected and filtered. What is the recommended approach?
- Configure NSG outbound deny rules on each subnet
- Deploy Azure Firewall and use User Defined Routes to force-tunnel traffic (Correct answer)
- Enable Azure DDoS Protection Standard on the VNet
- Use Azure Front Door with WAF policies
Correct answer: Deploy Azure Firewall and use User Defined Routes to force-tunnel traffic
Deploying Azure Firewall with UDRs (0.0.0.0/0 pointing to the firewall) forces all outbound internet traffic through centralized inspection and filtering.
Question 4: In a Zero Trust network model on Azure, which principle applies when a user accesses an internal application from a compliant corporate device?
- Implicit trust based on network location
- Verify explicitly using identity, device health, and context before granting access (Correct answer)
- Grant broad access once VPN authentication succeeds
- Trust all traffic originating from the corporate IP range
Correct answer: Verify explicitly using identity, device health, and context before granting access
Zero Trust requires explicitly verifying identity, device compliance, and contextual signals every time—even from corporate devices—before granting access.
Question 5: Which Azure networking feature allows you to inspect and filter traffic between spokes in a hub-and-spoke topology without hairpinning through on-premises?
- VNet peering with forwarded traffic
- Azure Firewall deployed in the hub VNet (Correct answer)
- Azure Route Server with BGP
- ExpressRoute Global Reach
Correct answer: Azure Firewall deployed in the hub VNet
Azure Firewall in the hub VNet, combined with UDRs on spoke subnets, routes inter-spoke traffic through the firewall for inspection without requiring on-premises traversal.
Question 6: A cybersecurity architect is designing network controls to protect sensitive data in transit between Azure services. What should be enforced?
- Use HTTP for internal service communication to reduce latency
- Enforce TLS 1.2 or higher for all data in transit and disable older protocols (Correct answer)
- Rely on VNet isolation alone without encryption
- Use self-signed certificates without certificate pinning
Correct answer: Enforce TLS 1.2 or higher for all data in transit and disable older protocols
Enforcing TLS 1.2+ ensures data in transit is encrypted with modern ciphers, protecting against interception even if network controls are bypassed.
Question 7: When using Azure Firewall Premium, which feature provides IDPS (Intrusion Detection and Prevention) capabilities?
- Application rules with FQDN filtering
- Network rules with IP groups
- Signature-based IDPS engine with alert and deny modes (Correct answer)
- DNS proxy with custom DNS servers
Correct answer: Signature-based IDPS engine with alert and deny modes
Azure Firewall Premium includes a signature-based IDPS engine that can detect and optionally block known threats based on threat intelligence signatures.
SC-100 Network Security Architecture 2
An organization wants to implement micro-segmentation for its Azure workloads to limit lateral movement.
Which Azure service best enables this at the workload level?