SC-200 Cloud Security Architecture 2 — Questions and Answers
Question 1: Your organization uses Microsoft Defender for Cloud. You need to identify which resources are exposed to the internet and have vulnerabilities. Which Defender for Cloud feature provides an attack path analysis showing how an attacker could reach sensitive resources?
- Security Score
- Attack path analysis in Cloud Security Graph (Correct answer)
- Regulatory compliance dashboard
- Workload protections inventory
Correct answer: Attack path analysis in Cloud Security Graph
Attack path analysis in Defender for Cloud's Cloud Security Graph visualizes chained risks showing how attackers could traverse your environment to reach sensitive assets.
Question 2: A security analyst needs to enforce that all Azure Storage accounts in a subscription require HTTPS-only access. Which service should be used to detect and remediate non-compliant resources at scale?
- Microsoft Defender for Storage
- Azure Policy with a Deny effect (Correct answer)
- Microsoft Sentinel analytics rule
- Azure Security Benchmark
Correct answer: Azure Policy with a Deny effect
Azure Policy with a Deny effect prevents creation of non-compliant resources and can remediate existing ones through deployment policies.
Question 3: In a Zero Trust cloud architecture, which principle ensures that even authenticated users can only access resources required for their specific role?
- Verify explicitly
- Use least privilege access (Correct answer)
- Assume breach
- Enable multi-factor authentication
Correct answer: Use least privilege access
Least privilege access limits users and workloads to only the permissions needed for their current task, reducing lateral movement risk.
Question 4: You are reviewing an Azure architecture where virtual machines in a spoke VNet must communicate with on-premises servers through a hub VNet. Which Azure service should you place in the hub to inspect and filter this traffic?
- Azure Application Gateway
- Azure Firewall (Correct answer)
- Azure DDoS Protection
- Network Security Groups
Correct answer: Azure Firewall
Azure Firewall is a managed, stateful firewall deployed in the hub VNet that inspects east-west and north-south traffic in a hub-and-spoke topology.
Question 5: Microsoft Defender for Cloud assigns a Secure Score to your subscription. What does a higher Secure Score indicate?
- More active threats have been detected
- A greater number of security recommendations have been implemented (Correct answer)
- More resources are enrolled in Defender plans
- Higher network throughput has been observed
Correct answer: A greater number of security recommendations have been implemented
Secure Score increases as you remediate security recommendations, reflecting a stronger security posture.
Question 6: A cloud workload running in Azure Kubernetes Service (AKS) is generating alerts in Microsoft Defender for Containers. Which threat does Defender for Containers detect that is specific to container environments?
- SQL injection attempts against the cluster API
- Cryptomining activity within container images (Correct answer)
- Phishing emails targeting cluster administrators
- Weak TLS certificate configurations on load balancers
Correct answer: Cryptomining activity within container images
Defender for Containers detects cryptomining and other anomalous behaviors specific to container workloads using runtime threat detection.
Question 7: Your team needs to centrally manage secrets, API keys, and certificates used by Azure workloads and eliminate hardcoded credentials. Which Azure service should you use?
- Azure Active Directory
- Azure Key Vault (Correct answer)
- Microsoft Defender for Cloud Apps
- Azure Information Protection
Correct answer: Azure Key Vault
Azure Key Vault provides centralized, audited storage for secrets, keys, and certificates, allowing applications to retrieve them at runtime without embedding credentials in code.
SC-200 Cloud Security Architecture 2
Your organization uses Microsoft Defender for Cloud.
You need to identify which resources are exposed to the internet and have vulnerabilities.
Which Defender for Cloud feature provides an attack path analysis showing how an attacker could reach sensitive resources?