SC-100 Zero Trust Architecture 4 — Questions and Answers
Question 1: A healthcare organization must ensure that sensitive patient data is protected under Zero Trust even when accessed by authorized users on compliant devices. Which additional control should be applied?
- Allow all access once device compliance is confirmed
- Apply data-level encryption and sensitivity labels using Microsoft Purview Information Protection (Correct answer)
- Remove conditional access policies for compliant devices
- Grant permanent access tokens after initial authentication
Correct answer: Apply data-level encryption and sensitivity labels using Microsoft Purview Information Protection
Even with compliant devices and valid identity, Zero Trust requires data-level protection through encryption and sensitivity labels to protect information if it is exfiltrated or mishandled.
Question 2: In an SC-100 scenario, which signal type is used by Azure AD Identity Protection to elevate the sign-in risk score and trigger step-up authentication?
- Network latency between client and server
- Anomalous sign-in behavior such as impossible travel or unfamiliar location (Correct answer)
- The number of failed DNS lookups on the client device
- CPU utilization on the authentication server
Correct answer: Anomalous sign-in behavior such as impossible travel or unfamiliar location
Azure AD Identity Protection uses ML-based signals such as impossible travel, leaked credentials, and unfamiliar sign-in properties to compute real-time risk scores.
Question 3: Which Azure Firewall feature supports Zero Trust by providing URL-based filtering, FQDN-based rules, and TLS inspection for outbound traffic?
- Azure Firewall Premium with IDPS and TLS inspection (Correct answer)
- Azure DDoS Protection Standard
- Azure Bastion host
- Azure Private Link
Correct answer: Azure Firewall Premium with IDPS and TLS inspection
Azure Firewall Premium includes TLS inspection, IDPS, URL filtering, and web categories to enforce Zero Trust controls for outbound traffic including encrypted sessions.
Question 4: An architect wants to apply Zero Trust to API access between microservices in Azure Kubernetes Service (AKS). Which approach best aligns with Zero Trust principles?
- Allow all intra-cluster traffic by default using broad network policies
- Use mutual TLS (mTLS) with a service mesh to authenticate and encrypt service-to-service communication (Correct answer)
- Assign a single shared service account to all microservices
- Use HTTP instead of HTTPS to reduce latency within the cluster
Correct answer: Use mutual TLS (mTLS) with a service mesh to authenticate and encrypt service-to-service communication
A service mesh implementing mTLS ensures that each microservice authenticates its identity to the other, aligning with Zero Trust's 'verify explicitly' principle for workload-to-workload communication.
Question 5: What is the primary benefit of using Azure Private Link in a Zero Trust architecture?
- It provides DDoS protection for public-facing endpoints
- It keeps traffic to Azure PaaS services on the Microsoft backbone, removing exposure to the public internet (Correct answer)
- It enables automatic failover between Azure regions
- It accelerates global content delivery for static assets
Correct answer: It keeps traffic to Azure PaaS services on the Microsoft backbone, removing exposure to the public internet
Azure Private Link routes traffic to Azure PaaS services over private endpoints within the virtual network, eliminating public internet exposure and reducing attack surface.
Question 6: A company uses shared workstations. Which Zero Trust control most effectively prevents credential theft from being used to access cloud resources from an unauthorized device?
- Require all users to reset passwords every 30 days
- Enforce device compliance as a Conditional Access requirement, blocking access from unmanaged or non-compliant devices (Correct answer)
- Disable multi-factor authentication for shared accounts
- Allow access only during business hours
Correct answer: Enforce device compliance as a Conditional Access requirement, blocking access from unmanaged or non-compliant devices
Device compliance requirements in Conditional Access ensure that even valid credentials cannot be used to access resources unless the device meets security standards such as encryption and patch level.
Question 7: Which Microsoft solution provides a unified view of the Zero Trust deployment status across identity, endpoints, apps, data, infrastructure, and network pillars?
- Azure Security Center Secure Score only
- Microsoft 365 Defender portal
- The Zero Trust initiative in Microsoft Defender for Cloud / Microsoft Security Exposure Management (Correct answer)
- Azure Advisor recommendations
Correct answer: The Zero Trust initiative in Microsoft Defender for Cloud / Microsoft Security Exposure Management
Microsoft Defender for Cloud and Microsoft Security Exposure Management provide Zero Trust posture management dashboards that track maturity across all six Zero Trust pillars.
SC-100 Zero Trust Architecture 4
A healthcare organization must ensure that sensitive patient data is protected under Zero Trust even when accessed by authorized users on compliant devices.
Which additional control should be applied?