SC-100 Network Security Architecture 5

Question 1

A security architect must prevent Azure Virtual Desktop (AVD) session hosts from initiating outbound connections to malicious domains. What is the most effective control?

Accepted Answer

Route session host internet traffic through Azure Firewall with DNS proxy and FQDN-based application rules

Answer

Azure Firewall with DNS proxy intercepts DNS queries from session hosts and enforces FQDN-based rules, blocking outbound connections to malicious or unauthorized domains.

Question 2

Which capability of Azure DDoS Protection Standard differentiates it from Basic protection?

Accepted Answer

It provides adaptive tuning, attack telemetry, alerts, and DDoS rapid response support for virtual network resources

Answer

DDoS Protection Standard adds adaptive tuning per protected resource, rich attack telemetry/metrics, alerting, and access to the DDoS Rapid Response team—capabilities absent in Basic.

Question 3

An architect is designing a secure API gateway pattern on Azure. Which layered control set best protects APIs from both external attacks and unauthorized internal consumers?

Accepted Answer

Azure API Management with OAuth 2.0/OIDC validation, WAF on Application Gateway in front, and NSG restricting backend access to APIM only

Answer

Layering WAF (perimeter), APIM with token validation (authentication/authorization), and NSG (backend isolation) provides defense-in-depth for API security.

Question 4

In Azure, what is the security purpose of enabling 'forced tunneling' for an Azure VPN Gateway connected to on-premises?

Accepted Answer

To route all internet-bound traffic from Azure VMs back through on-premises for inspection before it exits to the internet

Answer

Forced tunneling redirects all Azure VM internet traffic through the VPN gateway to on-premises, where existing security controls (proxies, firewalls, DLP) can inspect it before internet egress.

Question 5

A multi-tenant SaaS provider hosts customer workloads on Azure and must ensure complete network isolation between tenants. Which architecture best achieves this?

Accepted Answer

Separate VNet per tenant with no peering and tenant-specific NSGs and private endpoints

Answer

Separate VNets per tenant provide the strongest network isolation boundary; even if one tenant's workload is compromised, it cannot directly reach another tenant's VNet.

(SC-100) Microsoft Cybersecurity Architect Expert Practice Test

(SC-100) Microsoft Cybersecurity Architect Expert Practice Test

SC-100 Network Security Architecture 5