SC-200 Cloud Security Architecture 3 — Questions and Answers
Question 1: A multi-tenant SaaS application runs on Azure App Service. The security team wants to prevent OWASP Top 10 web attacks without modifying application code. Which service should be placed in front of the application?
- Azure Front Door with caching enabled
- Azure Web Application Firewall (WAF) on Application Gateway (Correct answer)
- Azure DDoS Protection Standard
- Microsoft Defender for App Service
Correct answer: Azure Web Application Firewall (WAF) on Application Gateway
Azure WAF on Application Gateway inspects inbound HTTP/S traffic and blocks OWASP Top 10 attack patterns before requests reach the application.
Question 2: You need to detect when an Azure service principal has been used to authenticate from an unusual geographic location. Which Microsoft service generates this type of identity-based alert?
- Microsoft Defender for Cloud
- Microsoft Entra ID Protection (Correct answer)
- Microsoft Defender for Endpoint
- Azure Monitor Log Analytics
Correct answer: Microsoft Entra ID Protection
Microsoft Entra ID Protection analyzes sign-in signals and generates risk detections such as impossible travel and atypical location for service principals and users.
Question 3: When designing a cloud security architecture, what is the primary purpose of a network segmentation strategy using VNet peering and NSGs?
- To increase network throughput between regions
- To limit lateral movement in the event a workload is compromised (Correct answer)
- To enable public internet routing for private resources
- To reduce Azure egress costs
Correct answer: To limit lateral movement in the event a workload is compromised
Network segmentation with NSGs and peering restricts traffic flows so that a compromised workload cannot freely communicate with other resources.
Question 4: A security engineer is configuring Microsoft Sentinel to ingest data from Microsoft Defender for Cloud. Which connector type should be used?
- Common Event Format (CEF) connector
- Microsoft Defender for Cloud native connector (Correct answer)
- Syslog connector
- REST API custom connector
Correct answer: Microsoft Defender for Cloud native connector
Microsoft Sentinel includes a native Microsoft Defender for Cloud data connector that enables bidirectional alert synchronization without custom configuration.
Question 5: Which Azure networking feature allows you to privately connect Azure PaaS services (such as Azure SQL) to a VNet, keeping traffic off the public internet?
- Service Endpoints
- Azure Private Link (Correct answer)
- VNet Peering
- Azure Bastion
Correct answer: Azure Private Link
Azure Private Link creates a private endpoint in your VNet with a private IP address, routing traffic to PaaS services over the Microsoft backbone.
Question 6: In Microsoft Defender for Cloud, what is the difference between a security recommendation and a security alert?
- Recommendations are paid features; alerts are free
- Recommendations address configuration weaknesses proactively; alerts indicate active threat activity (Correct answer)
- Recommendations apply only to IaaS; alerts apply only to PaaS
- Recommendations require Sentinel; alerts are standalone
Correct answer: Recommendations address configuration weaknesses proactively; alerts indicate active threat activity
Recommendations are posture improvements to harden resources before an attack, while alerts signal ongoing or detected malicious activity.
Question 7: You need to ensure Azure virtual machines can receive OS patches automatically without manual intervention. Which Azure feature handles this for Windows and Linux VMs?
- Microsoft Defender for Servers auto-provisioning
- Azure Automatic VM Guest Patching (Correct answer)
- Azure Update Manager scheduled assessment
- Azure Policy DeployIfNotExists
Correct answer: Azure Automatic VM Guest Patching
Azure Automatic VM Guest Patching automatically installs critical and security patches on VMs using a rolling, availability-aware approach.
SC-200 Cloud Security Architecture 3
A multi-tenant SaaS application runs on Azure App Service.
The security team wants to prevent OWASP Top 10 web attacks without modifying application code.
Which service should be placed in front of the application?