SC-100 Zero Trust Architecture 3

Question 1

Which Azure feature enables Zero Trust enforcement at the application layer by requiring users to authenticate before accessing internal web apps, even from within the corporate network?

Accepted Answer

Azure AD Application Proxy

Answer

Azure AD Application Proxy (now Entra Application Proxy) enables secure remote access to internal apps using Azure AD authentication, eliminating VPN dependency.

Question 2

A security architect is implementing Zero Trust for privileged accounts. Which solution should be used to provide just-in-time (JIT) privileged access with approval workflows?

Accepted Answer

Microsoft Entra Privileged Identity Management (PIM)

Answer

Microsoft Entra PIM enables just-in-time privileged access with time-bound assignments, approval workflows, and audit trails for privileged roles.

Question 3

In a Zero Trust network design, which approach replaces traditional VPN connections by brokering per-session, per-application access decisions?

Accepted Answer

Software-Defined Perimeter (SDP) / Zero Trust Network Access (ZTNA)

Answer

ZTNA/SDP solutions grant access to specific applications per session based on verified identity and device posture, replacing broad VPN network-level access.

Question 4

Which Microsoft Defender product enforces Zero Trust principles for endpoints by detecting behavioral anomalies, blocking malicious processes, and reporting device health to Conditional Access?

Accepted Answer

Microsoft Defender for Endpoint

Answer

Microsoft Defender for Endpoint provides endpoint detection and response (EDR) capabilities and shares device health signals with Conditional Access for Zero Trust enforcement.

Question 5

When applying Zero Trust to SaaS applications, which Microsoft service acts as a Cloud Access Security Broker (CASB) to provide visibility, threat protection, and access controls?

Accepted Answer

Microsoft Defender for Cloud Apps

Answer

Microsoft Defender for Cloud Apps is Microsoft's CASB solution that provides discovery, data protection, threat detection, and compliance for SaaS applications.

(SC-100) Microsoft Cybersecurity Architect Expert Practice Test

(SC-100) Microsoft Cybersecurity Architect Expert Practice Test

SC-100 Zero Trust Architecture 3