SC-100 Zero Trust Architecture 4

Question 1

A healthcare organization must ensure that sensitive patient data is protected under Zero Trust even when accessed by authorized users on compliant devices. Which additional control should be applied?

Accepted Answer

Apply data-level encryption and sensitivity labels using Microsoft Purview Information Protection

Answer

Even with compliant devices and valid identity, Zero Trust requires data-level protection through encryption and sensitivity labels to protect information if it is exfiltrated or mishandled.

Question 2

In an SC-100 scenario, which signal type is used by Azure AD Identity Protection to elevate the sign-in risk score and trigger step-up authentication?

Accepted Answer

Anomalous sign-in behavior such as impossible travel or unfamiliar location

Answer

Azure AD Identity Protection uses ML-based signals such as impossible travel, leaked credentials, and unfamiliar sign-in properties to compute real-time risk scores.

Question 3

Which Azure Firewall feature supports Zero Trust by providing URL-based filtering, FQDN-based rules, and TLS inspection for outbound traffic?

Accepted Answer

Azure Firewall Premium with IDPS and TLS inspection

Answer

Azure Firewall Premium includes TLS inspection, IDPS, URL filtering, and web categories to enforce Zero Trust controls for outbound traffic including encrypted sessions.

Question 4

An architect wants to apply Zero Trust to API access between microservices in Azure Kubernetes Service (AKS). Which approach best aligns with Zero Trust principles?

Accepted Answer

Use mutual TLS (mTLS) with a service mesh to authenticate and encrypt service-to-service communication

Answer

A service mesh implementing mTLS ensures that each microservice authenticates its identity to the other, aligning with Zero Trust's 'verify explicitly' principle for workload-to-workload communication.

Question 5

What is the primary benefit of using Azure Private Link in a Zero Trust architecture?

Accepted Answer

It keeps traffic to Azure PaaS services on the Microsoft backbone, removing exposure to the public internet

Answer

Azure Private Link routes traffic to Azure PaaS services over private endpoints within the virtual network, eliminating public internet exposure and reducing attack surface.

(SC-100) Microsoft Cybersecurity Architect Expert Practice Test

(SC-100) Microsoft Cybersecurity Architect Expert Practice Test

SC-100 Zero Trust Architecture 4