View Full Microsoft SC-100 Exam Dumps and Practice Test Dumps.

 

Question 381

Which security architecture capability is specifically designed to protect web applications from common application-layer attacks?

1. Azure VPN Gateway
2. Azure DNS
3. Azure ExpressRoute
4. Web Application Firewall

Correct Answer: 4
Explanation

A Web Application Firewall, or WAF, helps protect web applications against common application-layer threats by inspecting HTTP and HTTPS requests and applying security rules. It can help address attacks such as SQL injection and cross-site scripting when appropriately configured. VPN Gateway and ExpressRoute primarily provide network connectivity, while Azure DNS handles name resolution. WAF protection should be integrated with secure application design, vulnerability management, logging, monitoring, and appropriate rule tuning to reduce both malicious traffic and unnecessary blocking of legitimate requests.

Question 382

An organization wants Azure governance policies to apply consistently across multiple subscriptions. Which architectural capability should it use?

1. Azure Management Groups
2. Azure Load Balancer
3. Azure Bastion
4. Azure Storage Accounts

Correct Answer: 1
Explanation

Azure Management Groups provide a hierarchical structure for organizing subscriptions and applying governance consistently across them. Policies, role assignments, and other governance mechanisms can be scoped at appropriate management-group levels, helping organizations maintain consistent security requirements. Load Balancer manages traffic distribution, Bastion provides secure administrative access, and Storage Accounts provide data storage. Management-group design should reflect organizational ownership, regulatory boundaries, workload classifications, and governance requirements while avoiding unnecessarily complex hierarchies.

Question 383

Which authentication approach provides strong protection against phishing by using a cryptographic credential rather than a reusable password?

1. Basic authentication
2. SMS-only authentication
3. FIDO2 security keys
4. Shared passwords

Correct Answer: 3
Explanation

FIDO2 security keys use public-key cryptography to provide strong authentication without requiring users to submit reusable passwords to a service. This design can provide strong resistance against phishing because authentication is tied to the legitimate service and cryptographic credentials. Basic authentication and shared passwords rely on weaker reusable credentials, while SMS-based authentication can be vulnerable to several attack techniques. Phishing-resistant authentication should be deployed according to application requirements, identity architecture, recovery procedures, and organizational access policies.

Question 384

A company needs to connect an on-premises environment to Azure while keeping traffic on a private dedicated connection. Which service is most appropriate?

1. Azure Front Door
2. Azure ExpressRoute
3. Azure Application Gateway
4. Azure DNS

Correct Answer: 2
Explanation

Azure ExpressRoute provides private connectivity between an organization’s network and Microsoft cloud services through a connectivity provider. It is designed for scenarios where organizations require predictable connectivity, private network paths, or specific network architecture requirements. Azure Front Door and Application Gateway focus on application traffic management, while Azure DNS provides name-resolution services. ExpressRoute should be incorporated into a broader hybrid security architecture that includes routing controls, segmentation, identity protections, monitoring, redundancy, and appropriate on-premises security controls.

Question 385

Which identity design avoids embedding credentials directly inside an Azure application when the application needs to access supported Azure resources?

1. Managed identity
2. Hard-coded secret
3. Shared administrator password
4. Permanent API key

Correct Answer: 1
Explanation

Managed identities allow supported Azure resources and applications to authenticate to services without requiring developers to embed long-term credentials in application code or configuration. This reduces the risk of secrets being exposed and simplifies credential lifecycle management. Hard-coded secrets, shared administrator passwords, and permanent API keys can create significant credential-management risks. A secure architecture should still apply least privilege to the managed identity, restrict its resource permissions, monitor its activity, and regularly review whether the assigned access remains necessary.

Question 386

Which security architecture control is most useful for restricting outbound traffic from a sensitive workload to only approved destinations?

1. Open internet routing
2. Controlled egress filtering
3. Unrestricted DNS resolution
4. Public inbound access

Correct Answer: 2
Explanation

Controlled egress filtering restricts outbound connections from workloads to destinations that are explicitly permitted by security and business requirements. This can reduce the ability of compromised systems to communicate with malicious infrastructure or unauthorized services. Open internet routing and unrestricted connectivity increase exposure, while public inbound access addresses a different traffic direction. A controlled egress architecture should consider application dependencies, approved destinations, DNS security, logging, firewall policies, proxy requirements, and exception procedures to maintain functionality without unnecessarily broad outbound access.

Question 387

Which Microsoft Sentinel capability can automatically execute response actions after a security event meets defined conditions?

1. Workbooks
2. Watchlists
3. Playbooks
4. Data connectors

Correct Answer: 3
Explanation

Microsoft Sentinel playbooks provide automation capabilities that can execute predefined actions in response to security events. They can support activities such as notifications, ticket creation, enrichment, or other approved response workflows. Workbooks focus on visualization, watchlists provide reference data, and data connectors ingest security information. Automated response should be carefully designed because inappropriate automation can disrupt legitimate activity. Organizations should define triggers, approval requirements, safeguards, logging, and rollback procedures before enabling high-impact automated actions.

Question 388

Which security architecture approach separates development, testing, and production resources to reduce the risk of unauthorized changes reaching live systems?

1. Environment isolation
2. Shared production credentials
3. Direct developer access to production
4. Single-environment deployment

Correct Answer: 1
Explanation

Environment isolation separates development, testing, and production workloads so that activities in lower-trust environments do not automatically affect production systems. Separate subscriptions, resource groups, identities, secrets, deployment permissions, and network boundaries can strengthen these distinctions. Shared credentials and direct developer access to production increase the possibility of unauthorized or accidental changes. A secure architecture should also implement controlled promotion processes, approval gates, logging, security testing, and narrowly scoped deployment identities between environments.

Question 389

Which security architecture capability helps determine whether a detected vulnerability presents a significant business risk based on the affected asset and attack path?

1. Password rotation
2. Risk-based vulnerability prioritization
3. DNS caching
4. Storage compression

Correct Answer: 2
Explanation

Risk-based vulnerability prioritization considers more than the existence of a vulnerability. It can incorporate factors such as asset criticality, exploitability, exposure, available attack paths, data sensitivity, and potential business impact. This allows security teams to focus remediation efforts where vulnerabilities create greater organizational risk. Password rotation and DNS caching address different security or operational concerns, while storage compression does not prioritize vulnerabilities. Effective prioritization should combine technical findings with business context and clearly defined remediation timelines.

Question 390

Which architecture approach provides a dedicated, hardened workstation for performing highly privileged administrative tasks?

1. Standard employee laptop
2. Shared kiosk
3. Privileged Access Workstation
4. Public cloud workstation

Correct Answer: 3
Explanation

A Privileged Access Workstation, or PAW, is a dedicated and hardened device designed for sensitive administrative activities. Restricting privileged operations to specially secured workstations can reduce exposure to malware, phishing, unauthorized software, and other threats commonly encountered on general-purpose endpoints. A standard employee laptop or shared kiosk may expose privileged sessions to additional risks. PAW architecture should be combined with strong authentication, separate administrative identities, just-in-time access, endpoint monitoring, secure configuration, and strict restrictions on how privileged sessions are initiated.

Question 391

Which security architecture capability helps protect application programming interfaces by enforcing authentication, authorization, throttling, and other gateway controls?

1. API Management
2. Azure Storage
3. Azure DNS
4. Azure Backup

Correct Answer: 1
Explanation

API Management provides capabilities for publishing, securing, monitoring, and governing APIs. It can enforce authentication and authorization requirements, apply rate limits, transform requests, and provide centralized policy controls for API traffic. Storage, DNS, and Backup address different infrastructure requirements. API security should also include secure application design, input validation, authorization at the appropriate resource level, logging, monitoring, and protection against abuse. A gateway does not replace secure coding practices or proper authorization within the underlying application.

Question 392

Which security architecture control helps prevent sensitive information from being accidentally shared through email or collaboration services?

1. Network Load Balancer
2. Data Loss Prevention
3. Azure Bastion
4. Azure Traffic Manager

Correct Answer: 2
Explanation

Data Loss Prevention, or DLP, can identify sensitive information and apply policies designed to reduce inappropriate sharing or transmission. Depending on the configured policy and service, DLP can help detect sensitive content and provide actions such as blocking, warning, or auditing activity. Load Balancer and Traffic Manager address traffic distribution, while Bastion provides secure administrative access. DLP should be aligned with data classification, business requirements, regulatory obligations, user workflows, and monitoring processes so that protection is effective without unnecessarily disrupting legitimate business activity.

Question 393

Which security architecture concept focuses on protecting the management interfaces used to configure and control cloud resources?

1. Data plane protection
2. Application plane protection
3. Control plane protection
4. Storage replication

Correct Answer: 3
Explanation

The control plane contains interfaces and mechanisms used to create, configure, modify, and manage cloud resources. Protecting it is important because unauthorized control-plane access can allow attackers to change security settings, create resources, modify permissions, or disrupt workloads. Control-plane protection can include strong authentication, privileged access management, least privilege, policy enforcement, monitoring, and administrative isolation. Data-plane controls protect access to the actual services and data, so architects should address both planes rather than assuming that securing application traffic alone is sufficient.

Question 394

Which security architecture capability can help identify sensitive data assets and understand where that data exists across an organization?

1. Data discovery and classification
2. Network load balancing
3. DNS forwarding
4. Application caching

Correct Answer: 1
Explanation

Data discovery and classification help organizations identify important information assets and determine their sensitivity, location, ownership, and handling requirements. This visibility supports decisions about access controls, encryption, retention, monitoring, DLP, and regulatory compliance. Network load balancing and DNS forwarding address connectivity, while application caching focuses on performance. A data governance architecture should establish classification criteria, ownership responsibilities, lifecycle requirements, and appropriate controls so that sensitive information receives protection proportional to its business and regulatory importance.

Question 395

Which security architecture strategy can reduce the risk created by storing application secrets in source-code repositories?

1. Store secrets in comments
2. Use a centralized secret-management service
3. Publish secrets in configuration files
4. Share secrets through source control

Correct Answer: 2
Explanation

A centralized secret-management service provides controlled storage, access management, auditing, and lifecycle capabilities for sensitive credentials and other secrets. Keeping secrets in source-code repositories, comments, or ordinary configuration files can expose them to developers, build systems, unauthorized users, or repository compromises. Centralized secret management should be combined with managed identities where possible, least-privilege access, secret rotation, monitoring, and secure CI/CD integration. Secret-scanning tools can provide an additional layer by detecting credentials that may have been accidentally committed.

Question 396

Which security architecture practice helps ensure that recovery procedures can actually restore critical services within required business timeframes?

1. Recovery testing
2. Disabling backups
3. Removing redundancy
4. Ignoring recovery dependencies

Correct Answer: 1
Explanation

Recovery testing validates whether documented recovery procedures, backups, dependencies, personnel responsibilities, and technical mechanisms can restore services as expected. A backup that has never been tested may not provide confidence that recovery will work when required. Testing can reveal missing dependencies, configuration problems, insufficient capacity, access issues, or unrealistic recovery assumptions. Organizations should conduct tests appropriate to the criticality of the workload and document results, corrective actions, recovery times, and lessons learned to continuously improve resilience.

Question 397

Which security architecture capability helps identify unusual authentication behavior associated with a potentially compromised identity?

1. Static IP addressing
2. Storage tiering
3. Identity risk detection
4. Network compression

Correct Answer: 3
Explanation

Identity risk detection analyzes authentication and identity-related signals to identify activity that may indicate compromised credentials or suspicious account behavior. Examples can include unusual sign-in characteristics or other risk indicators that warrant additional verification or investigation. Static IP addressing, storage tiering, and network compression do not provide identity-risk analysis. Identity risk signals can be integrated with access policies and security operations so that risky authentication attempts receive additional controls while legitimate users can continue working under appropriate verification requirements.

Question 398

Which security architecture capability helps protect backup data from unauthorized deletion or modification during a ransomware incident?

1. Immutable backup storage
2. Temporary local files
3. Shared writable folders
4. Unrestricted backup administration

Correct Answer: 1
Explanation

Immutable backup storage helps prevent protected recovery copies from being altered or deleted during a defined retention period. This is particularly valuable during ransomware incidents because attackers may attempt to compromise or destroy backups before encrypting production data. Shared writable folders and unrestricted administrative access can increase the possibility of destructive changes. An effective cyber-recovery architecture should also use access isolation, separate administrative identities, monitoring, recovery testing, appropriate retention, and protected copies so that backups remain usable when primary systems are unavailable.

Question 399

Which architecture approach helps an organization evaluate whether a security exception should continue after its approved expiration period?

1. Automatic permanent renewal
2. Periodic exception review
3. Unlimited exception duration
4. Unrecorded approval

Correct Answer: 2
Explanation

Periodic exception review ensures that temporary deviations from security requirements are reassessed after their approved period. The review can determine whether the original business justification remains valid, whether compensating controls remain effective, and whether a permanent remediation has become available. Automatic renewal and unlimited durations can allow temporary weaknesses to become permanent, while unrecorded approvals reduce accountability. Exception management should include an owner, documented justification, risk assessment, compensating controls, expiration date, approval authority, and a defined review process.

Question 400

Which security architecture outcome should be measured to determine whether implemented controls are actually reducing organizational exposure?

1. Number of security tools purchased
2. Number of policies written
3. Number of administrators
4. Control effectiveness and risk reduction

Correct Answer: 4
Explanation

Control effectiveness and risk reduction provide meaningful measures of whether security architecture is achieving its intended outcomes. Counting tools, policies, or administrators does not necessarily demonstrate that organizational risk has decreased. Effective measurement can examine factors such as control coverage, detection performance, incident trends, remediation time, policy compliance, and residual risk. Security metrics should connect technical performance with business objectives and risk tolerance. Regular measurement enables architects and security leaders to identify ineffective controls, prioritize improvements, and adjust the architecture as threats and business requirements change.