SC-200 Cloud Security Architecture 3

Question 1

A multi-tenant SaaS application runs on Azure App Service. The security team wants to prevent OWASP Top 10 web attacks without modifying application code. Which service should be placed in front of the application?

Accepted Answer

Azure Web Application Firewall (WAF) on Application Gateway

Answer

Azure WAF on Application Gateway inspects inbound HTTP/S traffic and blocks OWASP Top 10 attack patterns before requests reach the application.

Question 2

You need to detect when an Azure service principal has been used to authenticate from an unusual geographic location. Which Microsoft service generates this type of identity-based alert?

Accepted Answer

Microsoft Entra ID Protection

Answer

Microsoft Entra ID Protection analyzes sign-in signals and generates risk detections such as impossible travel and atypical location for service principals and users.

Question 3

When designing a cloud security architecture, what is the primary purpose of a network segmentation strategy using VNet peering and NSGs?

Accepted Answer

To limit lateral movement in the event a workload is compromised

Answer

Network segmentation with NSGs and peering restricts traffic flows so that a compromised workload cannot freely communicate with other resources.

Question 4

A security engineer is configuring Microsoft Sentinel to ingest data from Microsoft Defender for Cloud. Which connector type should be used?

Accepted Answer

Microsoft Defender for Cloud native connector

Answer

Microsoft Sentinel includes a native Microsoft Defender for Cloud data connector that enables bidirectional alert synchronization without custom configuration.

Question 5

Which Azure networking feature allows you to privately connect Azure PaaS services (such as Azure SQL) to a VNet, keeping traffic off the public internet?

Accepted Answer

Azure Private Link

Answer

Azure Private Link creates a private endpoint in your VNet with a private IP address, routing traffic to PaaS services over the Microsoft backbone.

(SC-200) Microsoft Security Operations Analyst Practice Test

(SC-200) Microsoft Security Operations Analyst Practice Test

SC-200 Cloud Security Architecture 3