SC-100 Network Security Architecture 5 ā Questions and Answers
Question 1: A security architect must prevent Azure Virtual Desktop (AVD) session hosts from initiating outbound connections to malicious domains. What is the most effective control?
- Apply NSG rules blocking all outbound traffic on port 443
- Route session host internet traffic through Azure Firewall with DNS proxy and FQDN-based application rules (Correct answer)
- Use Azure AD Conditional Access to restrict session host token issuance
- Enable Microsoft Defender Antivirus on session hosts only
Correct answer: Route session host internet traffic through Azure Firewall with DNS proxy and FQDN-based application rules
Azure Firewall with DNS proxy intercepts DNS queries from session hosts and enforces FQDN-based rules, blocking outbound connections to malicious or unauthorized domains.
Question 2: Which capability of Azure DDoS Protection Standard differentiates it from Basic protection?
- It protects on-premises servers connected via ExpressRoute
- It provides adaptive tuning, attack telemetry, alerts, and DDoS rapid response support for virtual network resources (Correct answer)
- It automatically scales NSG rules during an attack
- It replaces Azure Firewall during volumetric DDoS events
Correct answer: It provides adaptive tuning, attack telemetry, alerts, and DDoS rapid response support for virtual network resources
DDoS Protection Standard adds adaptive tuning per protected resource, rich attack telemetry/metrics, alerting, and access to the DDoS Rapid Response teamācapabilities absent in Basic.
Question 3: An architect is designing a secure API gateway pattern on Azure. Which layered control set best protects APIs from both external attacks and unauthorized internal consumers?
- Azure API Management with OAuth 2.0/OIDC validation, WAF on Application Gateway in front, and NSG restricting backend access to APIM only (Correct answer)
- Public API endpoints protected by API keys stored in client applications
- Azure Load Balancer with health probes and backend pool restrictions
- Azure CDN with geo-filtering and rate limiting
Correct answer: Azure API Management with OAuth 2.0/OIDC validation, WAF on Application Gateway in front, and NSG restricting backend access to APIM only
Layering WAF (perimeter), APIM with token validation (authentication/authorization), and NSG (backend isolation) provides defense-in-depth for API security.
Question 4: In Azure, what is the security purpose of enabling 'forced tunneling' for an Azure VPN Gateway connected to on-premises?
- To accelerate VPN throughput by using dedicated hardware paths
- To route all internet-bound traffic from Azure VMs back through on-premises for inspection before it exits to the internet (Correct answer)
- To force all VPN clients to use split tunneling
- To encrypt VM-to-VM traffic within the VNet
Correct answer: To route all internet-bound traffic from Azure VMs back through on-premises for inspection before it exits to the internet
Forced tunneling redirects all Azure VM internet traffic through the VPN gateway to on-premises, where existing security controls (proxies, firewalls, DLP) can inspect it before internet egress.
Question 5: A multi-tenant SaaS provider hosts customer workloads on Azure and must ensure complete network isolation between tenants. Which architecture best achieves this?
- Separate VNet per tenant with no peering and tenant-specific NSGs and private endpoints (Correct answer)
- Single shared VNet with tenant-specific subnets and NSG rules
- VLAN tagging within a shared subnet for logical separation
- Single resource group per tenant with RBAC restricting access
Correct answer: Separate VNet per tenant with no peering and tenant-specific NSGs and private endpoints
Separate VNets per tenant provide the strongest network isolation boundary; even if one tenant's workload is compromised, it cannot directly reach another tenant's VNet.
Question 6: Which Microsoft Defender for Cloud recommendation directly reduces the network attack surface of internet-facing Azure VMs?
- Enable disk encryption on all VMs
- Apply Just-in-Time (JIT) VM access to close management ports by default (Correct answer)
- Configure Azure Monitor Agent on all VMs
- Enable vulnerability assessment on all VMs
Correct answer: Apply Just-in-Time (JIT) VM access to close management ports by default
JIT VM access closes management ports (RDP/SSH) by default and opens them only for authorized users during approved time windows, dramatically reducing the internet-facing attack surface.
Question 7: When designing network security logging for compliance, which combination provides the most comprehensive view of network traffic and security events in Azure?
- NSG flow logs to Storage Account + Azure Firewall logs to Log Analytics + Traffic Analytics enabled (Correct answer)
- VM-level tcpdump captures stored locally on each VM
- Azure Activity Log only, capturing all subscription-level events
- Network Watcher packet captures triggered manually per incident
Correct answer: NSG flow logs to Storage Account + Azure Firewall logs to Log Analytics + Traffic Analytics enabled
NSG flow logs capture accept/deny decisions at the subnet level, Firewall logs capture application and threat events, and Traffic Analytics provides ML-enriched visualizationsātogether giving end-to-end visibility.
SC-100 Network Security Architecture 5
A security architect must prevent Azure Virtual Desktop (AVD) session hosts from initiating outbound connections to malicious domains.
What is the most effective control?