Quiz SC-100: Microsoft Cybersecurity Architect

The correct answer is the first option. A Zero Trust architecture requires continuous verification at every access
point. Azure AD (Entra ID) with Conditional Access policies enforces granular access decisions based on
user identity, device state, location, and risk signals. Microsoft Defender for Cloud provides continuous
compliance monitoring and vulnerability assessments. Intune device attestation ensures only compliant,
managed devices can access resources. Together, these services implement the three pillars of Zero Trust:
verify explicitly, secure the perimeter and insider movement, and assume breach mentality.
The second option focuses on encryption and resource organization but lacks identity verification mechanisms.
The third option addresses network security but not identity and device compliance verification. The fourth
option provides access management and monitoring but misses device attestation and compliance
assessment. The fifth option is limited to network connectivity and segmentation without addressing identity or
device compliance controls, which are fundamental to Zero Trust.

The correct answer is the first option. This combination directly addresses all compliance requirements: Azure
Storage encryption with customer-managed keys provides encryption at rest with organizational control
over keys. Application Gateway with TLS termination secures data in transit at the application layer.
Azure Key Vault provides centralized key management and audit trails required for SOC 2 and financial
compliance. Azure Policy can enforce data residency restrictions by controlling where resources are deployed
and where data can be stored, critical for meeting regional data protection regulations like GDPR.
The second option includes encryption but relies on symmetric keys via TDE and SAS tokens, which lack the
centralized key management and audit capabilities required by financial compliance frameworks. The third
option covers encryption mechanisms but does not address data residency enforcement or centralized key
management auditing. The fourth option focuses on threat detection and labeling but misses the core
encryption and residency enforcement mechanisms. The fifth option emphasizes identity and network isolation
but does not provide the encryption and residency control mechanisms necessary for this scenario.

The correct answer is the third option. This combination comprehensively addresses infrastructure security:
Azure Firewall with application rules provides next-generation firewall capabilities for inspecting traffic at
the application layer. Network Security Groups with service tags enable rule-based traffic control.
Application Security Groups (ASGs) allow you to group virtual machines logically and apply network
security rules based on application workload, achieving true microsegmentation independent of network
topology. Microsoft Defender for Cloud provides continuous monitoring, detects anomalous traffic patterns,
and offers unified visibility across hybrid environments through its agentless scanning and integration with on-
premises systems.
The first option lacks workload-based segmentation and relies primarily on perimeter defense without adequate
microsegmentation. The second option provides network isolation but does not include application-layer
inspection, anomaly detection, or unified threat monitoring across hybrid environments. The fourth option
focuses on connectivity and troubleshooting rather than security controls and threat detection. The fifth option
addresses network topology but does not provide the security controls, microsegmentation, or threat detection
capabilities needed to address lateral movement concerns.

The correct answer is the first option. This combination creates a comprehensive SOC architecture: Azure
Sentinel acts as the Security Information and Event Management (SIEM) platform, aggregating data from
disparate sources and providing Security Orchestration, Automation, and Response (SOAR) capabilities to
automate incident response workflows. Microsoft Defender for Endpoint provides endpoint detection and
response (EDR) with behavioral analytics. Microsoft Defender for Cloud Apps extends detection to cloud
service usage and threats. Microsoft Threat Intelligence integration enriches events with context about
known threats, enabling faster analysis and response. Together, these enable 24/7 real-time threat detection
and automated response across all attack surfaces.
The second option provides logging and monitoring but lacks dedicated security detection, response
automation, and threat intelligence capabilities required for an advanced SOC. The third option focuses on
compliance and identity but does not provide the real-time threat detection or incident response automation
needed for active defense. The fourth option emphasizes device and identity management but lacks
SIEM/SOAR and network/cloud threat detection. The fifth option is governance and compliance-focused rather
than detection and response-focused.

The correct answer is the first option. This design comprehensively secures the application development and
deployment lifecycle: Azure DevOps with branch protection and build validation gates prevents
unauthorized code changes and enforces code reviews. Microsoft Defender for DevOps scans source code,
dependencies, and build artifacts for vulnerabilities and compliance violations before they reach production.
Azure Key Vault provides centralized secrets management with role-based access control, ensuring
developers access only necessary credentials. Azure Pipelines approvals enforce policy gates that require
security scanning and compliance validation before deployment, preventing non-compliant code from reaching
production.
The second option provides containerization and signing but does not address secrets management, lifecycle
gates, or source code scanning. The third option focuses on runtime security and data protection but lacks
development lifecycle controls and secrets management. The fourth option addresses API and data security but
does not cover development pipeline controls or secrets injection. The fifth option provides serverless and
event-driven capabilities but does not address the development pipeline security requirements or secrets
management.

The correct answer is the first option. This design addresses all healthcare compliance and operational
requirements: Azure AD with passwordless sign-in (Windows Hello, FIDO2) provides strong authentication
without the vulnerability of password-based attacks. Conditional Access policies enforce risk-based adaptive
authentication—requiring additional verification when sign-in risk is detected or access originates from unusual
locations, which is critical for protecting patient data access. Azure AD Connect enables hybrid identity,
integrating on-premises systems with cloud identity services. Privileged Identity Management (PIM)
provides just-in-time access and audit logging for administrative actions on sensitive systems. Unified audit
logging in Azure Sentinel provides comprehensive, searchable audit trails required for HIPAA compliance
and incident investigations.
The second option provides external user management and legacy access but lacks risk-based adaptive
policies, comprehensive audit logging for compliance, and strong passwordless authentication. The third option
relies on legacy on-premises authentication mechanisms that lack modern risk assessment and passwordless
capabilities. The fourth option lacks the hybrid identity integration and comprehensive audit capabilities
necessary for healthcare compliance. The fifth option is outdated and uses deprecated on-premises services
(MIM, AD FS) rather than cloud-native identity services with modern security capabilities.
CASE STUDY 1
OverView
Fabrikam, Inc. is an insurance company that has a main office in New York and a branch office in Paris.
On-premises Environment
The on-premises network contains a single Active Directory Domain Services (AD DS) domain named
corp.fabrikam.com.
Azure Environment
Fabrikam has the following Azure resources:
* An Azure Active Directory (Azure AD) tenant named fabrikam.onmicrosoft.com that syncs with corp.fabnkam.com
* A single Azure subscription named Sub1
* A virtual network named Vnet1 in the East US Azure region
* A virtual network named Vnet2 in the West Europe Azure region
* An instance of Azure Front Door named FD1 that has Azure Web Application Firewall (WAR enabled
* A Microsoft Sentinel workspace
* An Azure SQL database named ClaimsDB that contains a table named ClaimDetails
* 20 virtual machines that are configured as application servers and are NOT onboarded to Microsoft Defender for
Cloud
* A resource group named TestRG that is used for testing purposes only
* An Azure Virtual Desktop host pool that contains personal assigned session hosts
All the resources in Sub1 are in either the East US or the West Europe region.
Partners
Fabrikam has contracted a company named Contoso, Ltd. to develop applications. Contoso has the following
infrastructure-.
* An Azure AD tenant named contoso.onmicrosoft.com
* An Amazon Web Services (AWS) implementation named ContosoAWS1 that contains AWS EC2 instances used to host
test workloads for the applications of Fabrikam
Developers at Contoso will connect to the resources of Fabrikam to test or update applications. The developers will be
added to a security Group named Contoso Developers in fabrikam.onmicrosoft.com that will be assigned to roles in
Sub1.
The ContosoDevelopers group is assigned the db.owner role for the ClaimsDB database.
Compliance Event
Fabrikam deploys the following compliance environment:
* Defender for Cloud is configured to assess all the resources in Sub1 for compliance to the HIPAA HITRUST standard.
* Currently, resources that are noncompliant with the HIPAA HITRUST standard are remediated manually.
* Qualys is used as the standard vulnerability assessment tool for servers.
Problem Statements
The secure score in Defender for Cloud shows that all the virtual machines generate the following recommendation-.
Machines should have a vulnerability assessment solution.
All the virtual machines must be compliant in Defender for Cloud.
ClaimApp Deployment
Fabrikam plans to implement an internet-accessible application named ClaimsApp that will have the following
specification
* ClaimsApp will be deployed to Azure App Service instances that connect to Vnetl and Vnet2.
* Users will connect to ClaimsApp by using a URL of https://claims.fabrikam.com.
* ClaimsApp will access data in ClaimsDB.
* ClaimsDB must be accessible only from Azure virtual networks.
* The app services permission for ClaimsApp must be assigned to ClaimsDB.
Application Development Requirements
Fabrikam identifies the following requirements for application development:
* Azure DevTest labs will be used by developers for testing.
* All the application code must be stored in GitHub Enterprise.
* Azure Pipelines will be used to manage application deployments.
* All application code changes must be scanned for security vulnerabilities, including application code or configuration
files that contain secrets in clear text. Scanning must be done at the time the code is pushed to a repository.
Security Requirement
Fabrikam identifies the following security requirements:
* Internet-accessible applications must prevent connections that originate in North Korea.
* Only members of a group named InfraSec must be allowed to configure network security groups (NSGs} and
instances of Azure Firewall, VJM. And Front Door in Sub1.
* Administrators must connect to a secure host to perform any remote administration of the virtual machines. The
secure host must be provisioned from a custom operating system image.
AWS Requirements
Fabrikam identifies the following security requirements for the data hosted in ContosoAWSV.
* Notify security administrators at Fabrikam if any AWS EC2 instances are noncompliant with secure score
recommendations.
* Ensure that the security administrators can query AWS service logs directly from the Azure environment.
Contoso Developer Requirements
Fabrikam identifies the following requirements for the Contoso developers;
* Every month, the membership of the ContosoDevelopers group must be verified.
* The Contoso developers must use their existing contoso.onmicrosoft.com credentials to access the resources in
Sub1.
* The Comoro developers must be prevented from viewing the data in a column named MedicalHistory in the
ClaimDetails table.
Compliance Requirement
Fabrikam wants to automatically remediate the virtual machines in Sub1 to be compliant with the HIPPA HITRUST
standard. The virtual machines in TestRG must be excluded from the compliance assessment.

This question requires knowing the context of the InfraSec group's security requirements from a larger scenario
that is not provided. Without the scenario details (such as whether this involves Azure AD roles, resource-based
access control, management groups, etc.), a definitive answer cannot be determined. Common answers might
include: Azure AD Privileged Identity Management (PIM) for role delegation, Azure role-based access control
(RBAC), or management group-based delegation, but the correct answer depends on the specific requirements
stated in the original scenario.

Https://docs.microsoft.com/en-us/learn/modules/introduction-github-advanced-security/2-what-is-
github-advanced-security

Https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/switch-to-mde-phase-3?vi-
w=o365-worldwide