SC-100 Zero Trust Architecture 5 — Questions and Answers
Question 1: Under the Zero Trust 'use least privilege access' principle, which Entra ID feature limits the blast radius of compromised application identities by granting only permissions required for a specific task?
- Global Administrator role
- App-only permissions scoped to minimum required Microsoft Graph scopes (Correct answer)
- Delegated permissions with admin consent for all scopes
- Guest user access to the entire tenant
Correct answer: App-only permissions scoped to minimum required Microsoft Graph scopes
Scoping application permissions to the minimum required Microsoft Graph API scopes ensures compromised app credentials cannot access resources beyond their legitimate need.
Question 2: A cybersecurity architect is designing Zero Trust for a hybrid environment. Which service provides a single SIEM and SOAR platform to collect signals across on-premises and cloud workloads for Zero Trust monitoring?
- Azure Monitor Logs only
- Microsoft Sentinel (Correct answer)
- Microsoft Defender for Endpoint only
- Azure Network Watcher
Correct answer: Microsoft Sentinel
Microsoft Sentinel is Microsoft's cloud-native SIEM/SOAR that aggregates signals from across the entire hybrid environment to support continuous monitoring and automated response aligned to Zero Trust.
Question 3: Which capability in Microsoft Entra allows administrators to define what conditions must be met (e.g., MFA completed, compliant device, named location) before a user can access a resource?
- Access Reviews
- Conditional Access policies (Correct answer)
- Entitlement Management
- Authentication methods policy
Correct answer: Conditional Access policies
Conditional Access policies evaluate if-then statements (if user meets condition, then grant/block/require control) to enforce Zero Trust access decisions dynamically.
Question 4: An organization needs to provide secure access to Azure VMs for administrators without exposing RDP/SSH ports to the internet. Which service aligns with Zero Trust by eliminating direct public exposure?
- Azure VPN Gateway with point-to-site VPN
- Azure Bastion (Correct answer)
- Azure NAT Gateway
- Azure Load Balancer with public IP
Correct answer: Azure Bastion
Azure Bastion provides browser-based RDP/SSH access to VMs over TLS through the Azure portal without requiring public IP addresses or open RDP/SSH ports on VMs.
Question 5: In Zero Trust, continuous validation means that access should be:
- Granted once at login and maintained for the entire session without re-evaluation
- Re-evaluated in real time based on changing risk signals throughout the session (Correct answer)
- Only evaluated at the network perimeter using firewall rules
- Granted based solely on the user's job title in the HR system
Correct answer: Re-evaluated in real time based on changing risk signals throughout the session
Continuous validation means access decisions are re-assessed throughout a session using real-time signals such as changing location, device state, or anomalous behavior.
Question 6: Which Azure capability allows workload identities (VMs, containers, functions) to authenticate to other Azure services using a managed identity without storing credentials in code or config files?
- Azure Key Vault references in App Settings
- Azure Managed Identities (Correct answer)
- Service principal with client secret stored in environment variables
- Azure AD B2B federation
Correct answer: Azure Managed Identities
Managed Identities provide workloads with an automatically managed identity in Azure AD, enabling credential-free authentication to any service that supports Azure AD auth.
Question 7: When designing Zero Trust for a multi-cloud environment, which Microsoft solution extends posture management and threat protection to workloads running in AWS and GCP in addition to Azure?
- Azure Security Center (limited to Azure only)
- Microsoft Defender for Cloud with multi-cloud connectors (Correct answer)
- Microsoft Intune (limited to endpoint devices)
- Microsoft Purview (limited to data governance)
Correct answer: Microsoft Defender for Cloud with multi-cloud connectors
Microsoft Defender for Cloud supports multi-cloud environments through native connectors for AWS and GCP, providing unified security posture and threat protection across cloud providers.
SC-100 Zero Trust Architecture 5
Under the Zero Trust 'use least privilege access' principle, which Entra ID feature limits the blast radius of compromised application identities by granting only permissions required for a specific task?