SC-100 Network Security Architecture 3

Question 1

An organization uses ExpressRoute for hybrid connectivity. To protect against route injection attacks from the on-premises network, what should a security architect implement?

Accepted Answer

BGP route filtering using route maps and prefix lists

Answer

BGP route filtering with prefix lists and route maps ensures only authorized prefixes are accepted from on-premises, preventing malicious route injection.

Question 2

Which design pattern should a cybersecurity architect use to prevent a compromised workload in one Azure subscription from pivoting to resources in another subscription?

Accepted Answer

Use separate VNets per subscription with no peering and enforce Azure Firewall for any cross-subscription traffic

Answer

Isolating subscriptions with separate VNets and routing any required cross-subscription traffic through Azure Firewall limits blast radius if one subscription is compromised.

Question 3

A company requires that its Azure Kubernetes Service (AKS) cluster nodes are not reachable from the public internet. Which configuration achieves this?

Accepted Answer

Deploy a private AKS cluster with a private endpoint for the API server

Answer

A private AKS cluster removes the public endpoint from the API server and uses a private endpoint, ensuring cluster management traffic stays within the private network.

Question 4

In the SC-100 exam context, what is the primary purpose of Azure Network Watcher's Connection Monitor?

Accepted Answer

To continuously monitor network connectivity and latency between endpoints and alert on changes

Answer

Connection Monitor provides end-to-end connectivity monitoring, tracking reachability and round-trip time between sources and destinations, with alerting on degradation.

Question 5

A security architect needs to restrict access to Azure Storage accounts so only traffic from specific VNets is allowed. Which feature should be used?

Accepted Answer

Azure Storage firewall with VNet service endpoints or private endpoints

Answer

Azure Storage firewall rules combined with VNet service endpoints or private endpoints restrict data-plane access to traffic originating from authorized VNets only.

(SC-100) Microsoft Cybersecurity Architect Expert Practice Test

(SC-100) Microsoft Cybersecurity Architect Expert Practice Test

SC-100 Network Security Architecture 3