SC-100 Network Security Architecture 4 — Questions and Answers
Question 1: A security architect is evaluating Azure Web Application Firewall (WAF) deployment options. For global HTTP/S applications requiring the lowest latency WAF inspection, which service should host the WAF?
- Azure Application Gateway v2
- Azure Front Door with WAF policy (Correct answer)
- Azure API Management with policy expressions
- Azure Firewall Premium with TLS inspection
Correct answer: Azure Front Door with WAF policy
Azure Front Door delivers WAF inspection at Microsoft's global edge PoPs, minimizing latency by inspecting traffic close to the user before forwarding to origin.
Question 2: Which Azure Firewall feature helps reduce the administrative overhead of maintaining IP address-based rules for frequently changing service IPs?
- Application rules with wildcard FQDNs
- IP Groups that aggregate addresses into reusable objects
- Service tags representing Azure service IP ranges (Correct answer)
- Threat intelligence-based filtering
Correct answer: Service tags representing Azure service IP ranges
Service tags abstract Azure service IP ranges that Microsoft manages, so rules referencing service tags automatically stay current without manual IP list maintenance.
Question 3: An organization must ensure that all administrative access to Azure VMs uses encrypted, audited sessions without exposing RDP/SSH ports to the internet. Which service satisfies this requirement?
- Just-in-Time (JIT) VM access via Microsoft Defender for Cloud
- Azure Bastion with audit logs sent to Log Analytics (Correct answer)
- Network Security Groups allowing RDP from a specific admin IP
- Azure VPN Gateway with point-to-site VPN
Correct answer: Azure Bastion with audit logs sent to Log Analytics
Azure Bastion provides browser-based RDP/SSH over TLS without exposing VM ports publicly, and its session activity can be logged to Azure Monitor for audit purposes.
Question 4: When designing a secure network architecture for Azure SQL Database, which combination provides the strongest data-plane isolation?
- Public endpoint with firewall rules allowing corporate IP ranges
- Private endpoint with public network access disabled and Azure AD authentication enforced (Correct answer)
- Service endpoint without disabling public access
- VNet integration with read replicas in a secondary region
Correct answer: Private endpoint with public network access disabled and Azure AD authentication enforced
Combining a private endpoint with public network access disabled ensures all database traffic stays on private networks, and AAD authentication eliminates password-based credential risks.
Question 5: In a hybrid network design, what is the security advantage of using ExpressRoute over a site-to-site VPN for connecting on-premises to Azure?
- ExpressRoute uses IPsec encryption that VPN does not
- ExpressRoute traffic does not traverse the public internet, reducing exposure to internet-based threats (Correct answer)
- ExpressRoute provides higher bandwidth but the same security posture as VPN
- ExpressRoute automatically applies Azure Firewall policies to hybrid traffic
Correct answer: ExpressRoute traffic does not traverse the public internet, reducing exposure to internet-based threats
ExpressRoute routes traffic through a private, dedicated circuit via a connectivity provider, meaning it never traverses the public internet and avoids internet-based interception risks.
Question 6: A cybersecurity architect is designing controls to detect and respond to network-based threats across Azure subscriptions. Which Microsoft service provides unified network threat detection using ML-based analytics?
- Azure Network Watcher Traffic Analytics
- Microsoft Defender for Cloud with Defender for DNS and Defender for Resource Manager
- Microsoft Sentinel with Azure network data connectors and analytics rules (Correct answer)
- Azure Monitor Network Insights
Correct answer: Microsoft Sentinel with Azure network data connectors and analytics rules
Microsoft Sentinel ingests network telemetry across subscriptions and applies ML-based analytics rules to detect sophisticated threats and enable automated response.
Question 7: When implementing network security for an Azure landing zone, what does the 'policy-driven guardrails' approach mean for network configuration?
- Manually reviewing each network change request before deployment
- Using Azure Policy to automatically enforce and audit network security configurations across all subscriptions (Correct answer)
- Requiring developers to pass a network security certification before deploying resources
- Delegating all network decisions to the cloud provider
Correct answer: Using Azure Policy to automatically enforce and audit network security configurations across all subscriptions
Azure Policy guardrails automatically enforce compliant network configurations (e.g., requiring NSGs, denying public IPs) and audit drift across the entire landing zone estate.
SC-100 Network Security Architecture 4
A security architect is evaluating Azure Web Application Firewall (WAF) deployment options.
For global HTTP/S applications requiring the lowest latency WAF inspection, which service should host the WAF?