View Full Microsoft SC-100 Exam Dumps and Practice Test Dumps.

 

Question 141

Which Microsoft Entra capability can help organizations automate the review and removal of unnecessary access to applications and resources?

1. Microsoft Entra Access Reviews
2. Azure DDoS Protection
3. Microsoft Defender for Endpoint
4. Azure Front Door

Correct Answer: 1
Explanation

Microsoft Entra Access Reviews help organizations regularly verify whether users, groups, or other identities should continue to have access to resources. Reviewers can confirm, deny, or remove access according to organizational requirements. This helps prevent outdated permissions from accumulating over time, particularly for sensitive applications and external users. DDoS Protection, Defender for Endpoint, and Front Door provide different security or networking capabilities. Access reviews are an important identity governance control because access should remain aligned with current business responsibilities.

Question 142

Which architecture principle is most important when designing security controls for a critical business application?

1. Minimize all functionality
2. Align security requirements with business risk
3. Allow unrestricted access
4. Use identical controls for every application

Correct Answer: 2
Explanation

Security architecture should align controls with the business risk associated with the application. Critical applications may require stronger authentication, stricter authorization, greater monitoring, resilience, and more comprehensive recovery capabilities than low-risk systems. Minimizing functionality without considering business requirements can create operational problems, while unrestricted access increases exposure. Applying exactly the same controls everywhere may also be inefficient. A risk-aligned approach helps security architects balance protection, availability, usability, compliance, and business objectives when designing application security.

Question 143

Which Azure service provides a managed firewall capability for controlling and inspecting network traffic in Azure environments?

1. Azure Firewall
2. Azure Key Vault
3. Azure Monitor
4. Azure Policy

Correct Answer: 1
Explanation

Azure Firewall provides a managed, cloud-based network security service that can control and inspect traffic according to configured rules and policies. It can be incorporated into centralized network architectures to control traffic flows between networks and other destinations. Key Vault protects cryptographic material and secrets, Monitor provides telemetry and monitoring capabilities, and Policy provides governance controls. Firewall architecture should be designed around traffic requirements, segmentation, routing, logging, application dependencies, and the organization’s overall security strategy.

Question 144

A security architect wants to ensure that only approved network traffic can leave sensitive workloads. Which design approach should be considered?

1. Open outbound connectivity
2. Unrestricted internet access
3. Controlled egress architecture
4. Shared administrator credentials

Correct Answer: 3
Explanation

Controlled egress architecture restricts outbound traffic from sensitive workloads according to defined security requirements. This can reduce the risk of data exfiltration, command-and-control communication, and unauthorized connections to external services. Depending on the environment, controls can include firewalls, network security rules, proxies, DNS filtering, private connectivity, and approved destination lists. Open outbound connectivity provides fewer restrictions and can increase exposure. Egress controls should be carefully designed so that required application dependencies remain functional while unnecessary communication paths are blocked.

Question 145

Which security architecture capability helps identify vulnerabilities in cloud resources and provides recommendations for improving their security posture?

1. Microsoft Defender for Cloud
2. Microsoft Teams
3. Azure DNS
4. Microsoft SharePoint

Correct Answer: 1
Explanation

Microsoft Defender for Cloud provides cloud security posture management capabilities that can identify security weaknesses and provide recommendations for improving resource configurations. It can help organizations assess security posture across supported cloud environments and identify areas requiring attention. Teams and SharePoint are collaboration services, while Azure DNS provides name-resolution functionality. Defender for Cloud can therefore contribute to continuous security assessment by helping security teams discover configuration gaps, prioritize recommendations, and improve the security posture of cloud workloads.

Question 146

Which Azure networking capability provides private connectivity to supported platform services through a private endpoint?

1. Azure Public IP
2. Azure Private Endpoint
3. Azure Load Balancer
4. Azure Traffic Manager

Correct Answer: 2
Explanation

Azure Private Endpoint provides a network interface that connects privately to supported Azure services through a private IP address in a virtual network. This can help reduce exposure to the public internet and support private application architectures. Public IP addresses provide internet-facing connectivity, Load Balancer distributes network traffic, and Traffic Manager provides DNS-based traffic routing. Private endpoints should be integrated with appropriate DNS architecture, network access controls, identity controls, and monitoring to provide secure private connectivity.

Question 147

An organization needs a central location for security teams to collect and analyze telemetry from multiple sources. Which Microsoft service is designed for this purpose?

1. Microsoft Intune
2. Microsoft Sentinel
3. Microsoft Purview
4. Microsoft Entra ID

Correct Answer: 2
Explanation

Microsoft Sentinel is a cloud-native security information and event management platform that can collect, analyze, and correlate security data from multiple sources. It can support detection, investigation, incident management, automation, and threat hunting. Intune focuses on endpoint management, Purview focuses on data governance and compliance, and Entra ID provides identity services. Centralized security analytics are valuable because they allow organizations to correlate activity across different systems instead of investigating each security signal in isolation.

Question 148

Which security architecture practice helps ensure that application components cannot access resources outside their defined responsibilities?

1. Workload isolation
2. Shared permissions
3. Flat authorization
4. Universal administrator access

Correct Answer: 1
Explanation

Workload isolation separates application components and limits their ability to interact with unrelated resources. Combined with narrowly scoped permissions, isolation can reduce the impact of a compromised component and prevent unnecessary lateral movement. Shared permissions and universal administrator access increase the potential blast radius, while flat authorization provides fewer meaningful boundaries. Security architects should identify application dependencies and define required communication paths before implementing isolation. The resulting architecture should support legitimate functionality while restricting unnecessary access between components.

Question 149

Which approach is most appropriate for protecting secrets used by cloud applications?

1. Store secrets directly in source code
2. Use a centralized secret-management service
3. Publish secrets in configuration documentation
4. Share one credential across applications

Correct Answer: 2
Explanation

A centralized secret-management service provides controlled storage and access to sensitive values such as passwords, API keys, certificates, and cryptographic material. Azure Key Vault is an example of such a service. Centralized management can support access control, auditing, rotation, and reduced exposure compared with embedding secrets directly in source code. Shared credentials and publicly documented secrets increase the consequences of compromise. Applications should retrieve only the secrets they require and should use managed identities or other secure authentication mechanisms where supported.

Question 150

Which security architecture concept describes using multiple independent security controls so that failure of one control does not expose the entire environment?

1. Single-layer security
2. Defense in depth
3. Implicit trust
4. Open access

Correct Answer: 2
Explanation

Defense in depth uses multiple layers of protection so that a failure or bypass of one security control does not automatically compromise the entire environment. Layers may include identity protection, endpoint security, network segmentation, application controls, data protection, monitoring, and incident response. Single-layer security creates greater dependence on one mechanism. Implicit trust and open access also reduce protection. Defense in depth should be designed carefully so that controls complement one another rather than creating unnecessary complexity or conflicting policies.

Question 151

A security architect wants to identify which business processes would be most affected by the loss of a specific application. Which activity should be performed?

1. Business impact analysis
2. Password rotation
3. DNS configuration
4. Endpoint enrollment

Correct Answer: 1
Explanation

Business impact analysis identifies the consequences of disruptions to applications, services, processes, and supporting resources. It can help determine business criticality, dependencies, acceptable downtime, and recovery requirements. This information is important when designing resilience, backup, disaster recovery, and availability strategies. Password rotation, DNS configuration, and endpoint enrollment address different security or operational requirements. Business impact analysis allows architects to prioritize protection and recovery investments according to the consequences of service disruption.

Question 152

Which Azure capability can provide centralized governance across a hierarchy of subscriptions?

1. Management groups
2. Individual virtual machines
3. Azure Storage containers
4. Private DNS zones

Correct Answer: 1
Explanation

Azure management groups provide a hierarchical structure above subscriptions and can help organizations apply governance consistently across groups of subscriptions. Policies and access controls can be organized at appropriate levels within the hierarchy. This is useful for large environments where security requirements need to be managed across multiple subscriptions while still allowing appropriate administrative delegation. Virtual machines, storage containers, and private DNS zones operate at different resource levels and do not provide the same organizational governance structure.

Question 153

Which security practice helps ensure that infrastructure changes are reviewed before they are introduced into a production environment?

1. Unrestricted direct changes
2. Change control and approval
3. Shared administrator accounts
4. Disabled logging

Correct Answer: 2
Explanation

Change control and approval processes help ensure that significant infrastructure modifications are reviewed for security, operational, and business impacts before implementation. These processes can include peer review, testing, authorization, documentation, and rollback planning. Unrestricted direct changes increase the risk of configuration errors and unauthorized modifications. Shared accounts reduce accountability, while disabled logging removes important evidence. Security architecture should integrate change management with identity governance, policy enforcement, monitoring, and automated deployment processes where appropriate.

Question 154

An organization wants to identify sensitive data stored across multiple repositories before deciding which protection policies to apply. What should be performed first?

1. Data discovery and classification
2. Public data sharing
3. Credential deletion
4. Network load balancing

Correct Answer: 1
Explanation

Data discovery and classification help an organization understand what information exists, where it is stored, how sensitive it is, and which business or regulatory requirements apply. This information provides the foundation for selecting appropriate protection controls such as encryption, access restrictions, retention, and data loss prevention. Applying controls without understanding the underlying data can lead to gaps or unnecessary restrictions. Public sharing and load balancing do not provide data classification capabilities. A data-centric architecture should begin with visibility into information assets.

Question 155

Which Microsoft Purview capability helps organizations manage how long content should be retained or when it should be deleted?

1. Microsoft Defender for Endpoint
2. Retention policies and labels
3. Azure Bastion
4. Microsoft Entra B2B

Correct Answer: 2
Explanation

Microsoft Purview retention capabilities help organizations define how long content should be retained and, where appropriate, when it can be deleted. Retention policies and labels can support organizational, legal, regulatory, and business requirements for information lifecycle management. Defender for Endpoint protects devices, Azure Bastion provides secure virtual machine administration, and Entra B2B supports external collaboration. Retention should be designed alongside classification, records management, privacy requirements, and data governance so that information is neither retained unnecessarily nor deleted prematurely.

Question 156

Which network architecture provides centralized connectivity and security services while allowing application networks to remain separated?

1. Hub-and-spoke
2. Flat network
3. Single public subnet
4. Unsegmented LAN

Correct Answer: 1
Explanation

A hub-and-spoke architecture places shared connectivity and security services in a central hub while application workloads can reside in separate spoke networks. This structure can support centralized inspection, connectivity, routing, and security controls while maintaining workload separation. A flat network provides fewer boundaries and can increase lateral movement opportunities. Public or unsegmented designs may expose resources unnecessarily. The hub-and-spoke model should be designed around traffic flows, application dependencies, administrative ownership, and security requirements.

Question 157

Which security architecture capability helps identify and investigate potentially malicious activity across application and identity data without waiting for a predefined alert?

1. Threat hunting
2. Resource locking
3. Data replication
4. Load balancing

Correct Answer: 1
Explanation

Threat hunting involves proactively searching security telemetry for suspicious patterns, behaviors, or indicators that may not have triggered an existing detection. Security analysts can use queries and contextual information to investigate hypotheses and uncover potentially hidden threats. Resource locking protects infrastructure from certain administrative changes, replication supports resilience, and load balancing distributes traffic. Threat hunting is especially useful as part of a mature security operations program because it complements automated detection with proactive investigation and analysis.

Question 158

A company needs to ensure that a critical application can continue operating when individual infrastructure components fail. Which architecture principle should guide the design?

1. High availability
2. Single-point dependency
3. Manual-only recovery
4. Centralized failure

Correct Answer: 1
Explanation

High availability architecture reduces dependence on individual components and uses redundancy, failover, or distributed resources to maintain service availability when failures occur. The exact design depends on application requirements and may include redundant instances, availability zones, load balancing, or other resilience mechanisms. Single points of failure create greater outage risk, while manual-only recovery may increase recovery time. High availability should be designed together with monitoring, capacity planning, dependency analysis, and appropriate recovery objectives.

Question 159

Which security governance practice provides a formal mechanism for accepting a known security risk when immediate remediation is not practical?

1. Risk acceptance
2. Unrestricted access
3. Security policy removal
4. Anonymous administration

Correct Answer: 1
Explanation

Risk acceptance is a formal governance decision in which an authorized party acknowledges a known risk and agrees to accept it under defined conditions. It should include documented justification, ownership, scope, duration, and review requirements. Risk acceptance does not mean that the risk has disappeared or that security controls should be removed. Unrestricted access and anonymous administration increase exposure without providing governance. Formal risk acceptance allows organizations to make accountable decisions when technical, financial, operational, or business constraints prevent immediate remediation.

Question 160

Which architecture approach is most useful when an organization must securely connect on-premises resources with cloud workloads while maintaining defined network boundaries?

1. Hybrid network architecture with controlled connectivity
2. Public internet access for every workload
3. Unrestricted routing between all networks
4. Shared credentials for network devices

Correct Answer: 1
Explanation

A controlled hybrid network architecture can connect on-premises infrastructure with cloud workloads while maintaining defined security boundaries and traffic controls. Depending on requirements, organizations may use VPN or dedicated connectivity, network segmentation, firewalls, private DNS, routing controls, and identity-based administration. Public access for every workload and unrestricted routing increase exposure and reduce isolation. Shared network credentials also weaken accountability. Hybrid architecture should be designed around business dependencies, security requirements, traffic flows, resilience, and administrative responsibilities.