SC-100 Network Security Architecture 2

Question 1

An organization wants to implement micro-segmentation for its Azure workloads to limit lateral movement. Which Azure service best enables this at the workload level?

Accepted Answer

Application Security Groups (ASGs)

Answer

Application Security Groups allow you to group VMs logically and define NSG rules based on those groups, enabling micro-segmentation without managing IP addresses.

Question 2

Which Azure Private Link feature prevents data exfiltration by ensuring traffic to Azure PaaS services never traverses the public internet?

Accepted Answer

Private Endpoints

Answer

Private Endpoints assign a private IP from your VNet to an Azure PaaS service, keeping all traffic on the Microsoft backbone and preventing data exfiltration via the public internet.

Question 3

A security architect must ensure that all outbound internet traffic from Azure VMs is inspected and filtered. What is the recommended approach?

Accepted Answer

Deploy Azure Firewall and use User Defined Routes to force-tunnel traffic

Answer

Deploying Azure Firewall with UDRs (0.0.0.0/0 pointing to the firewall) forces all outbound internet traffic through centralized inspection and filtering.

Question 4

In a Zero Trust network model on Azure, which principle applies when a user accesses an internal application from a compliant corporate device?

Accepted Answer

Verify explicitly using identity, device health, and context before granting access

Answer

Zero Trust requires explicitly verifying identity, device compliance, and contextual signals every time—even from corporate devices—before granting access.

Question 5

Which Azure networking feature allows you to inspect and filter traffic between spokes in a hub-and-spoke topology without hairpinning through on-premises?

Accepted Answer

Azure Firewall deployed in the hub VNet

Answer

Azure Firewall in the hub VNet, combined with UDRs on spoke subnets, routes inter-spoke traffic through the firewall for inspection without requiring on-premises traversal.

(SC-100) Microsoft Cybersecurity Architect Expert Practice Test

(SC-100) Microsoft Cybersecurity Architect Expert Practice Test

SC-100 Network Security Architecture 2