View Full Microsoft SC-100 Exam Dumps and Practice Test Dumps.

 

Question 321

Which security architecture capability is designed to protect applications from common web-based attacks such as SQL injection and cross-site scripting?

1. Azure Bastion
2. Azure DNS
3. Azure Load Balancer
4. Web Application Firewall

Correct Answer: 4
Explanation

A Web Application Firewall protects supported web applications by inspecting HTTP and HTTPS requests and applying security rules. It can help detect and block common web attacks such as SQL injection and cross-site scripting. Azure Bastion provides administrative connectivity to virtual machines, Azure DNS handles name resolution, and Load Balancer distributes network traffic. WAF should be part of a broader application security strategy that includes secure coding, authentication, authorization, vulnerability management, monitoring, and appropriate network protections.

Question 322

Which security architecture approach helps organizations enforce consistent security requirements across multiple Azure subscriptions?

1. Individual manual configuration
2. Centralized policy governance
3. Public resource access
4. Separate unmanaged configurations

Correct Answer: 2
Explanation

Centralized policy governance helps organizations apply consistent security requirements across multiple Azure subscriptions. Azure Policy and management structures can be used to define requirements for configurations, locations, tags, security settings, and other organizational standards. Manual configuration can lead to inconsistencies, while unmanaged subscriptions may develop different security postures. Centralized governance should still allow appropriate delegation to workload teams and should include documented exceptions, monitoring, change management, and periodic policy reviews to ensure that requirements remain practical and aligned with business needs.

Question 323

Which capability can help security teams determine whether an identity has been compromised based on unusual authentication patterns?

1. Microsoft Entra ID Protection
2. Azure Storage
3. Azure Traffic Manager
4. Azure Resource Manager

Correct Answer: 1
Explanation

Microsoft Entra ID Protection uses identity-related risk signals to help identify potentially compromised users and suspicious authentication activity. These signals can be incorporated into access decisions and remediation workflows. Azure Storage provides data services, Traffic Manager manages traffic routing, and Resource Manager provides resource management capabilities. Identity risk detection should be combined with strong authentication, Conditional Access, lifecycle governance, monitoring, and appropriate response procedures. Security architects should also establish processes for investigating risky sign-ins and handling legitimate activities that generate elevated risk signals.

Question 324

A company needs to protect an internal application while allowing employees to reach it without exposing the application directly to the public internet. Which architecture is appropriate?

1. Public IP with unrestricted access
2. Anonymous application access
3. Private network connectivity
4. Public DNS-only protection

Correct Answer: 3
Explanation

Private network connectivity can keep an internal application inaccessible directly from the public internet while allowing authorized users and workloads to reach it through controlled network paths. Depending on the architecture, private endpoints, virtual networks, VPN connectivity, or other private networking technologies can be used. Public exposure increases the attack surface, while DNS alone does not provide application authorization or network isolation. Private connectivity should still be combined with identity controls, authorization, monitoring, segmentation, and secure application design.

Question 325

Which security practice helps prevent developers from using production credentials during application development?

1. Shared production accounts
2. Separate development identities and secrets
3. Permanent administrator access
4. Production credentials stored in source code

Correct Answer: 2
Explanation

Separate development identities and secrets help maintain a security boundary between development and production environments. Developers should receive access appropriate to development activities without receiving unnecessary production privileges or credentials. Shared production accounts and permanent administrator access increase the consequences of compromised development systems or accounts. Storing production credentials in source code creates additional exposure. Environment separation should also include dedicated subscriptions or resource groups where appropriate, independent secrets, controlled deployment pipelines, and explicit approval processes for production changes.

Question 326

Which security architecture component can provide centralized collection and analysis of security events from multiple sources?

1. Azure Bastion
2. Azure Private DNS
3. Microsoft Sentinel
4. Azure Load Balancer

Correct Answer: 3
Explanation

Microsoft Sentinel provides cloud-native SIEM capabilities for collecting, analyzing, and correlating security data from multiple sources. Centralized monitoring can help security teams identify suspicious patterns that might not be visible when logs are examined separately. Azure Bastion provides secure administrative access, Private DNS supports private name resolution, and Load Balancer distributes network traffic. Sentinel architecture should consider data connectors, analytics rules, retention, automation, investigation requirements, threat intelligence, and the operational needs of security analysts.

Question 327

Which security architecture approach reduces the likelihood that an attacker can move from a compromised endpoint to critical administrative systems?

1. Administrative isolation
2. Shared administrator workstations
3. Flat network connectivity
4. Universal privileged access

Correct Answer: 1
Explanation

Administrative isolation separates privileged systems, accounts, and management paths from ordinary user environments. This can reduce opportunities for attackers to move from a compromised endpoint toward critical administrative infrastructure. Shared workstations and flat connectivity increase exposure, while universal privileged access creates excessive permissions. Administrative isolation can include privileged access workstations, dedicated administrative identities, network restrictions, strong authentication, just-in-time elevation, and monitoring. The design should focus on protecting high-value administrative paths because compromise of these paths can affect many other resources.

Question 328

Which security capability can automatically investigate certain endpoint alerts and recommend or perform remediation actions?

1. Azure Policy
2. Microsoft Defender automated investigation and response
3. Azure Resource Locks
4. Microsoft Purview Records Management

Correct Answer: 2
Explanation

Microsoft Defender automated investigation and response capabilities can investigate certain security alerts and perform or recommend remediation actions based on supported detections and configured permissions. Automation can reduce repetitive analyst tasks and help accelerate response to common threats. Azure Policy manages resource governance, Resource Locks protect resources from certain changes, and Purview Records Management handles information governance. Automated remediation should be tested carefully and governed with appropriate permissions, monitoring, approval requirements, and escalation procedures for situations where automated action could affect legitimate business activity.

Question 329

Which architecture principle requires every access request to be evaluated according to available identity, device, and risk information?

1. Perimeter trust
2. Implicit trust
3. Zero Trust
4. Static authorization

Correct Answer: 3
Explanation

Zero Trust requires organizations to avoid assuming that a user or device is trustworthy simply because it is located within a particular network. Access decisions should consider identity, device state, resource sensitivity, application context, and relevant risk signals. Perimeter-based and static authorization models may provide insufficient protection when an attacker obtains valid credentials or compromises an internal device. Zero Trust architecture applies continuous verification, least privilege, segmentation, and monitoring across identity, endpoint, application, network, and data security layers.

Question 330

Which security control helps ensure that only approved applications can execute on a sensitive endpoint?

1. Application control
2. Public DNS
3. Network load balancing
4. Storage replication

Correct Answer: 1
Explanation

Application control can restrict software execution according to approved rules, reducing the likelihood that unauthorized or malicious applications will run on sensitive endpoints. This can be particularly useful for privileged workstations, critical servers, and high-value systems. Public DNS, load balancing, and storage replication address different infrastructure requirements. Application control should be carefully tested because overly restrictive policies can interfere with legitimate business applications. Deployment should include monitoring, exception management, change control, and regular review of approved software.

Question 331

Which security architecture capability can provide centralized protection for cryptographic keys and application secrets?

1. Azure Traffic Manager
2. Azure Load Balancer
3. Azure Key Vault
4. Azure Bastion

Correct Answer: 3
Explanation

Azure Key Vault provides centralized management for secrets, cryptographic keys, and certificates. Centralizing sensitive material can reduce the need to embed secrets within application code or configuration files and can support controlled access, auditing, and lifecycle management. Traffic Manager and Load Balancer provide traffic management capabilities, while Bastion provides secure administrative access to virtual machines. Key Vault access should follow least privilege and should be combined with managed identities, monitoring, appropriate key rotation, and separation of administrative responsibilities.

Question 332

Which security architecture practice helps identify whether an organization’s controls address the most important threats before implementation begins?

1. Security gap and threat analysis
2. Unrestricted deployment
3. Public access testing only
4. Cost estimation without risk analysis

Correct Answer: 1
Explanation

Security gap and threat analysis helps organizations determine whether planned controls address relevant threats, business risks, and security requirements. It can identify missing capabilities, weak assumptions, unnecessary controls, and areas requiring stronger protection before implementation. Unrestricted deployment can introduce unmanaged risks, while cost estimation alone does not determine security effectiveness. Analysis should consider assets, threat scenarios, business impact, regulatory requirements, existing controls, and target-state architecture. The results can then be used to prioritize security improvements and architectural decisions.

Question 333

Which identity architecture capability can allow an external organization to collaborate with internal users while maintaining controlled access to organizational resources?

1. Microsoft Entra B2B collaboration
2. Azure DDoS Protection
3. Azure Storage replication
4. Azure Resource Locks

Correct Answer: 1
Explanation

Microsoft Entra B2B collaboration can allow external users to access selected organizational resources using their external identities while maintaining organizational controls over that access. This can support partners, contractors, suppliers, and other external collaborators. DDoS Protection addresses availability threats, Storage replication supports resilience, and Resource Locks protect Azure resources from certain changes. External identity architecture should include appropriate invitation controls, authentication requirements, lifecycle management, access reviews, least privilege, and monitoring to prevent external access from becoming excessive or permanent.

Question 334

Which architecture approach provides separate security controls for internet-facing applications and internal workloads?

1. Single flat security zone
2. Distinct security zones
3. Universal network access
4. Shared unrestricted firewall rules

Correct Answer: 2
Explanation

Distinct security zones allow organizations to apply different controls according to the exposure and sensitivity of workloads. Internet-facing applications may require stronger edge protection, WAF capabilities, restricted inbound traffic, and additional monitoring, while internal workloads may have different connectivity requirements. A flat security zone can make it harder to apply differentiated protections. Universal access and shared unrestricted firewall rules increase exposure. Security zones should be designed around trust boundaries, data sensitivity, business requirements, application dependencies, and expected traffic flows.

Question 335

Which Microsoft Purview capability can help organizations manage how long information should be retained and when it can be disposed of?

1. Defender for Endpoint
2. Azure Firewall
3. Records management
4. Azure Bastion

Correct Answer: 3
Explanation

Microsoft Purview Records Management supports information governance requirements related to retention, records, and disposition. Organizations can define policies that determine how certain information should be retained and managed throughout its lifecycle. This can help address regulatory, legal, and business requirements while reducing unnecessary retention. Defender for Endpoint protects devices, Azure Firewall provides network security, and Bastion provides administrative connectivity. Retention architecture should consider data classification, legal requirements, business value, privacy obligations, and documented disposal processes.

Question 336

Which security architecture practice can help prevent unauthorized infrastructure changes from being introduced directly into production?

1. Controlled change management
2. Shared administrator passwords
3. Direct unrestricted editing
4. Anonymous deployment

Correct Answer: 1
Explanation

Controlled change management requires infrastructure modifications to follow defined processes such as review, testing, approval, deployment, and documentation. This helps prevent unauthorized or poorly tested changes from reaching production and provides accountability for significant modifications. Shared passwords and unrestricted editing weaken accountability and make it difficult to determine who changed a configuration. Anonymous deployment also removes important governance controls. Change management should be integrated with infrastructure as code, version control, automated validation, security testing, monitoring, and documented emergency-change procedures.

Question 337

Which security architecture capability helps identify potentially dangerous attack paths involving cloud resources and permissions?

1. Cost Management
2. Attack path analysis
3. Azure DNS
4. Azure Load Balancer

Correct Answer: 2
Explanation

Attack path analysis can help security teams understand how weaknesses, exposed resources, identities, permissions, and network relationships could combine to create a route toward valuable assets. This perspective can help prioritize remediation based on potential attack impact rather than treating every finding independently. Cost Management addresses financial analysis, DNS handles name resolution, and Load Balancer distributes traffic. Attack path findings should be evaluated alongside business criticality, asset sensitivity, exploitability, existing controls, and operational feasibility when prioritizing security improvements.

Question 338

Which architecture approach helps ensure that security controls are tested before an application is promoted to production?

1. Security validation in CI/CD
2. Production-only testing
3. Unrestricted deployment
4. Manual credential sharing

Correct Answer: 1
Explanation

Security validation in CI/CD integrates security checks into the software delivery process before an application reaches production. Depending on requirements, validation can include code analysis, dependency scanning, secret detection, infrastructure checks, configuration validation, and security tests. Production-only testing can discover problems too late, while unrestricted deployment bypasses important controls. Manual credential sharing also introduces security risks. Automated validation should be combined with appropriate approval gates, exception management, secure identities, artifact integrity controls, and continuous runtime monitoring.

Question 339

Which security architecture capability helps protect users when accessing applications by requiring stronger authentication under specific risk conditions?

1. Azure Storage
2. Azure Private DNS
3. Microsoft Entra Conditional Access
4. Azure Traffic Manager

Correct Answer: 3
Explanation

Microsoft Entra Conditional Access enables organizations to create policies that evaluate access conditions and apply requirements such as stronger authentication or access restrictions. Policies can consider factors including user identity, device state, application, location, and risk signals. Storage, Private DNS, and Traffic Manager provide infrastructure capabilities rather than access-policy enforcement. Conditional Access should be designed carefully to avoid creating unnecessary business disruption while still enforcing appropriate security requirements for sensitive applications and elevated-risk access attempts.

Question 340

Which security architecture principle recommends continuously improving controls based on new threats, incidents, and changes in business requirements?

1. Static security configuration
2. Continuous security improvement
3. Permanent exception acceptance
4. Technology deployment without reassessment

Correct Answer: 2
Explanation

Continuous security improvement recognizes that threats, technologies, business processes, and regulatory requirements change over time. Organizations should regularly assess security controls, review incidents, analyze new threats, measure control effectiveness, and update architecture when necessary. Static configurations may become ineffective as environments evolve, while permanent exceptions can introduce unmanaged risk. Technology should not be deployed without reassessment of its security implications. Continuous improvement creates a feedback loop between security operations, architecture, risk management, compliance, and business stakeholders.