Microsoft - SC-100: Microsoft Cybersecurity Architect

Sample Questions

Explanation:

Microsoft Entra Private Access provides secure access to your organization's internal resources by enabling you to control and secure access to specific network destinations on your private network. This allows you to provide granular network access based on user needs. To do this, create an Enterprise application and add the application segment that is used by the internal, private resource that you want to secure. Network requests sent from devices running the Global Secure Access client to the application segment you added to your Enterprise application will be acquired and routed to your internal application by the Global Secure Access cloud service without any ability to connect to other resources on your network. By configuring an Enterprise application, you create per-app access to your internal resources. Enterprise applications provide you a segmented, granular ability to manage how your resources are accessed on a per-app basis.

When publishing internal web applications with Microsoft Entra Private Access and a Global Secure Access application, you must configure:

• A connector group that contains one or more active Microsoft Entra private network connectors.
• Application segments/endpoints that define the internal FQDNs (or IP addresses) of the web applications.
• The connector group routes traffic from the Global Secure Access service to the internal applications.

Reference: How to configure per-app access using Global Secure Access applications

• Add or remove access package assignments for the users in their department.
• Prevent the access packages from appearing in each user’s My Access portal.

Explanation:

The Access Package Assignment Manager role is specifically designed to manage assignments to existing access packages, including viewing, adding, and removing assignments, without granting broader permissions to manage catalogs, access packages, or policies.

References:

View, add, and remove assignments for an access package in entitlement management

Delegate access governance to access package managers in entitlement management

• Provides centralized management and updates for protection rules
• Protects all the web apps without modifying the application code
• Minimizes costs

Explanation:

To protect multi-region Azure App Service instances from web exploits and malicious bots while ensuring centralized rule management, the recommended solution is Azure Front Door Premium with Azure Web Application Firewall (WAF).

Global Protection & Routing: Azure Front Door is a global service that acts as a secure entry point. It natively load-balances traffic across multiple Azure regions using anycast, directing customers to the closest healthy region with the lowest latency.

Centralized Management: Instead of deploying and managing individual firewalls (like Azure Application Gateway) inside each of the three regions, you can associate a single global Azure WAF policy with your Front Door profile. This provides a single pane of glass to manage, scale, and update your security rules across all five web applications instantly.

Exploit & Bot Mitigation: The Premium tier of Azure Front Door WAF includes built-in managed rulesets (like the OWASP Core Rule Set) to defend sensitive customer data against common vulnerabilities (e.g., SQL Injection, Cross-Site Scripting). It also integrates Microsoft Threat Intelligence to detect and block malicious bots, crawlers, and scrapers before they ever reach your backend App Services.

Zero Application Modification: This architecture acts as an edge proxy network layer. It protects your applications without requiring any changes to your web application code or runtime configurations.

References:

Web Application Firewall (WAF) on Azure Front Door

Configure bot protection for Web Application Firewall

• APIs that receive and send the PII
• A data ingestion pipeline that stores the PII in an Azure Data Lake Storage Gen2 account

Explanation:

Azure Key Vault provides a centralized repository for encryption keys and supports customer-managed keys (CMKs), key rotation, and access control. Azure Storage customer-managed keys can be stored in Azure Key Vault.

Azure Storage uses Server-Side Encryption (SSE) to encrypt data at rest automatically. When combined with customer-managed keys stored in Azure Key Vault, the storage account (including Data Lake Storage Gen2) can encrypt data using organization-controlled keys without requiring application code changes.

References:

Customer-managed keys for Azure Storage encryption

Azure Storage encryption for data at rest

• Provide a single tenancy to store the keys and certificates.
• Maintain FIPS 140-2 Level 3 compliance.
• Follow the principle of least privilege.
• Minimize costs.
• Minimize administrative effort.

Explanation:

Azure offers several solutions for cryptographic key storage and management in the cloud: Azure Key Vault (standard and premium offerings), Azure Managed HSM, Azure Cloud HSM, and Azure Payment HSM.

FIPS-140 is a US government standard with different levels of security requirements. Use the table to compare all the solutions side by side:

Note: Azure Key Vault Premium SKU supports HSM-protected keys, but the HSM infrastructure is multi-tenant, not single-tenant.

Azure role-based access control (Azure RBAC) is an authorization system built on Azure Resource Manager that provides centralized access management of Azure resources.

Azure RBAC allows users to manage keys, secrets, and certificates permissions, and provides one place to manage all permissions across all key vaults.

The Azure RBAC model allows users to set permissions on different scope levels: management group, subscription, resource group, or individual resources. Azure RBAC for key vault also allows users to have separate permissions on individual keys, secrets, and certificates.

References:

About keys

How to choose the right Azure key management solution

Provide access to Key Vault keys, certificates, and secrets with Azure role-based access control