SC-100 Network Security Architecture 3 — Questions and Answers
Question 1: An organization uses ExpressRoute for hybrid connectivity. To protect against route injection attacks from the on-premises network, what should a security architect implement?
- BGP route filtering using route maps and prefix lists (Correct answer)
- Disable BGP and use static routes only
- Enable ExpressRoute FastPath for all connections
- Use Azure VPN Gateway instead of ExpressRoute
Correct answer: BGP route filtering using route maps and prefix lists
BGP route filtering with prefix lists and route maps ensures only authorized prefixes are accepted from on-premises, preventing malicious route injection.
Question 2: Which design pattern should a cybersecurity architect use to prevent a compromised workload in one Azure subscription from pivoting to resources in another subscription?
- Place all workloads in a single VNet with NSG segmentation
- Use separate VNets per subscription with no peering and enforce Azure Firewall for any cross-subscription traffic (Correct answer)
- Enable Azure AD Privileged Identity Management (PIM) for subscription access
- Deploy all workloads in the same resource group
Correct answer: Use separate VNets per subscription with no peering and enforce Azure Firewall for any cross-subscription traffic
Isolating subscriptions with separate VNets and routing any required cross-subscription traffic through Azure Firewall limits blast radius if one subscription is compromised.
Question 3: A company requires that its Azure Kubernetes Service (AKS) cluster nodes are not reachable from the public internet. Which configuration achieves this?
- Enable authorized IP ranges on the AKS API server
- Deploy a private AKS cluster with a private endpoint for the API server (Correct answer)
- Use network policies to block ingress on all ports
- Configure NSGs to deny all inbound traffic
Correct answer: Deploy a private AKS cluster with a private endpoint for the API server
A private AKS cluster removes the public endpoint from the API server and uses a private endpoint, ensuring cluster management traffic stays within the private network.
Question 4: In the SC-100 exam context, what is the primary purpose of Azure Network Watcher's Connection Monitor?
- To block malicious network connections automatically
- To continuously monitor network connectivity and latency between endpoints and alert on changes (Correct answer)
- To inspect packet payloads for sensitive data
- To enforce NSG rules on behalf of the security team
Correct answer: To continuously monitor network connectivity and latency between endpoints and alert on changes
Connection Monitor provides end-to-end connectivity monitoring, tracking reachability and round-trip time between sources and destinations, with alerting on degradation.
Question 5: A security architect needs to restrict access to Azure Storage accounts so only traffic from specific VNets is allowed. Which feature should be used?
- Azure Storage firewall with VNet service endpoints or private endpoints (Correct answer)
- Azure AD Conditional Access policies targeting storage
- NSG rules applied to the storage account subnet
- Azure Policy to deny public access at the management plane
Correct answer: Azure Storage firewall with VNet service endpoints or private endpoints
Azure Storage firewall rules combined with VNet service endpoints or private endpoints restrict data-plane access to traffic originating from authorized VNets only.
Question 6: Which approach best supports a 'never trust, always verify' model for server-to-server communication within an Azure VNet?
- Rely on VNet isolation and disable encryption between services
- Implement mutual TLS (mTLS) with certificate-based authentication between services (Correct answer)
- Use shared secrets stored in environment variables
- Allow all traffic within the VNet using permissive NSG rules
Correct answer: Implement mutual TLS (mTLS) with certificate-based authentication between services
Mutual TLS requires both client and server to authenticate with certificates, ensuring neither side implicitly trusts the other purely based on network location.
Question 7: An architect wants to centralize DNS resolution for Azure private endpoints across multiple VNets in a hub-and-spoke topology. What is the recommended solution?
- Configure custom DNS servers on each spoke VNet independently
- Deploy Azure Private DNS Resolver in the hub VNet with DNS forwarding rules (Correct answer)
- Use Azure Public DNS zones for all private endpoint records
- Hardcode private endpoint IP addresses in application configuration
Correct answer: Deploy Azure Private DNS Resolver in the hub VNet with DNS forwarding rules
Azure Private DNS Resolver in the hub provides centralized conditional forwarding, allowing all spoke VNets to resolve private endpoint DNS names without per-spoke configuration.
SC-100 Network Security Architecture 3
An organization uses ExpressRoute for hybrid connectivity.
To protect against route injection attacks from the on-premises network, what should a security architect implement?