SC-100 Zero Trust Architecture 3 — Questions and Answers
Question 1: Which Azure feature enables Zero Trust enforcement at the application layer by requiring users to authenticate before accessing internal web apps, even from within the corporate network?
- Azure Application Gateway WAF
- Azure AD Application Proxy (Correct answer)
- Azure Front Door
- Azure Load Balancer
Correct answer: Azure AD Application Proxy
Azure AD Application Proxy (now Entra Application Proxy) enables secure remote access to internal apps using Azure AD authentication, eliminating VPN dependency.
Question 2: A security architect is implementing Zero Trust for privileged accounts. Which solution should be used to provide just-in-time (JIT) privileged access with approval workflows?
- Azure Policy
- Microsoft Entra Privileged Identity Management (PIM) (Correct answer)
- Microsoft Defender for Identity
- Azure Bastion
Correct answer: Microsoft Entra Privileged Identity Management (PIM)
Microsoft Entra PIM enables just-in-time privileged access with time-bound assignments, approval workflows, and audit trails for privileged roles.
Question 3: In a Zero Trust network design, which approach replaces traditional VPN connections by brokering per-session, per-application access decisions?
- Software-Defined Perimeter (SDP) / Zero Trust Network Access (ZTNA) (Correct answer)
- Site-to-site IPsec tunnels
- Network address translation (NAT)
- Split tunneling VPN
Correct answer: Software-Defined Perimeter (SDP) / Zero Trust Network Access (ZTNA)
ZTNA/SDP solutions grant access to specific applications per session based on verified identity and device posture, replacing broad VPN network-level access.
Question 4: Which Microsoft Defender product enforces Zero Trust principles for endpoints by detecting behavioral anomalies, blocking malicious processes, and reporting device health to Conditional Access?
- Microsoft Defender for Cloud Apps
- Microsoft Defender for Endpoint (Correct answer)
- Microsoft Defender for Office 365
- Microsoft Defender for DNS
Correct answer: Microsoft Defender for Endpoint
Microsoft Defender for Endpoint provides endpoint detection and response (EDR) capabilities and shares device health signals with Conditional Access for Zero Trust enforcement.
Question 5: When applying Zero Trust to SaaS applications, which Microsoft service acts as a Cloud Access Security Broker (CASB) to provide visibility, threat protection, and access controls?
- Microsoft Defender for Cloud
- Microsoft Defender for Cloud Apps (Correct answer)
- Azure AD B2C
- Microsoft Purview Compliance Portal
Correct answer: Microsoft Defender for Cloud Apps
Microsoft Defender for Cloud Apps is Microsoft's CASB solution that provides discovery, data protection, threat detection, and compliance for SaaS applications.
Question 6: To implement Zero Trust for Azure infrastructure, which service enforces resource configuration compliance and can deny non-compliant deployments?
- Azure Blueprints
- Azure Policy (Correct answer)
- Azure Resource Graph
- Azure Cost Management
Correct answer: Azure Policy
Azure Policy evaluates and enforces resource configurations at deployment and continuously, and can use 'deny' effects to prevent non-compliant resources from being created.
Question 7: Which Zero Trust control helps prevent lateral movement after an attacker compromises a single endpoint in a network?
- Single sign-on (SSO)
- Network segmentation and micro-segmentation (Correct answer)
- Passwordless authentication
- SSL/TLS certificate pinning
Correct answer: Network segmentation and micro-segmentation
Micro-segmentation divides the network into small zones and applies strict east-west traffic controls, preventing attackers from moving laterally across the environment.
SC-100 Zero Trust Architecture 3
Which Azure feature enables Zero Trust enforcement at the application layer by requiring users to authenticate before accessing internal web apps, even from within the corporate network?