SC-100 Network Security Architecture 4

Question 1

A security architect is evaluating Azure Web Application Firewall (WAF) deployment options. For global HTTP/S applications requiring the lowest latency WAF inspection, which service should host the WAF?

Accepted Answer

Azure Front Door with WAF policy

Answer

Azure Front Door delivers WAF inspection at Microsoft's global edge PoPs, minimizing latency by inspecting traffic close to the user before forwarding to origin.

Question 2

Which Azure Firewall feature helps reduce the administrative overhead of maintaining IP address-based rules for frequently changing service IPs?

Accepted Answer

Service tags representing Azure service IP ranges

Answer

Service tags abstract Azure service IP ranges that Microsoft manages, so rules referencing service tags automatically stay current without manual IP list maintenance.

Question 3

An organization must ensure that all administrative access to Azure VMs uses encrypted, audited sessions without exposing RDP/SSH ports to the internet. Which service satisfies this requirement?

Accepted Answer

Azure Bastion with audit logs sent to Log Analytics

Answer

Azure Bastion provides browser-based RDP/SSH over TLS without exposing VM ports publicly, and its session activity can be logged to Azure Monitor for audit purposes.

Question 4

When designing a secure network architecture for Azure SQL Database, which combination provides the strongest data-plane isolation?

Accepted Answer

Private endpoint with public network access disabled and Azure AD authentication enforced

Answer

Combining a private endpoint with public network access disabled ensures all database traffic stays on private networks, and AAD authentication eliminates password-based credential risks.

Question 5

In a hybrid network design, what is the security advantage of using ExpressRoute over a site-to-site VPN for connecting on-premises to Azure?

Accepted Answer

ExpressRoute traffic does not traverse the public internet, reducing exposure to internet-based threats

Answer

ExpressRoute routes traffic through a private, dedicated circuit via a connectivity provider, meaning it never traverses the public internet and avoids internet-based interception risks.

(SC-100) Microsoft Cybersecurity Architect Expert Practice Test

(SC-100) Microsoft Cybersecurity Architect Expert Practice Test

SC-100 Network Security Architecture 4