Design Solutions That Align with the Microsoft Cloud Adoption Framework for Azure (CAF) and the Azure Well-Architected Framework SC-100 Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A large enterprise is adopting Azure and has established a CAF-based governance strategy. The security team wants to enforce a security baseline across all subscriptions, but the business units have different compliance requirements. The architect must balance centralized governance with business unit autonomy. Which approach should the architect recommend?

   • ALet each business unit manage its own policies independently with no central oversight.
   • BUse Azure Blueprints to deploy policies to each subscription individually.
   • CAssign all policies at the root management group and prohibit business units from creating their own policies.
   • DUse a management group hierarchy with Azure Policy assignments at the root for common requirements and allow business units to add their own policies at lower scopes.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A company is adopting a DevSecOps approach for a critical application. The security architect needs to ensure that security checks are integrated into the CI/CD pipeline without slowing down development. The company has a strict release deadline. Which approach should the architect recommend?

   • ARun only SAST in the build stage and skip DAST to save time.
   • BRun all security scans after deployment to production to avoid delaying the release.
   • CRun SAST and dependency scanning in the build stage, and run DAST in a staging environment before release.
   • DUse a separate pipeline for security scans that runs after the release.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A company is planning to adopt Azure AI services for a customer-facing chatbot. The security architect must design a strategy that aligns with the organization's security requirements. Which approach should the architect recommend?

   • AUse API keys without expiration for all AI service calls to avoid disruption.
   • BDeploy the AI service in a separate subscription with no network restrictions to simplify access.
   • CStore all training data in a public blob container for easy access by the AI service.
   • DUse Azure AI services with managed identities, role-based access control, and data encryption in transit and at rest.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is the primary purpose of an Azure landing zone in the context of security and governance?

   • ATo provide a single subscription for all workloads without any policies.
   • BTo eliminate the need for identity management.
   • CTo replace the need for any security monitoring tools.
   • DTo provide a scalable, secure, and governed foundation for cloud workloads.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A company is deploying an Azure landing zone to support a new application. The security team requires that all virtual machines (VMs) in the landing zone have disk encryption enabled and that no public IP addresses are assigned to VMs. The application team wants to deploy VMs using infrastructure as code (IaC) templates. What should the security architect configure to enforce these requirements?

   • AAssign Azure Policy initiatives at the landing zone management group scope that audit and deny non-compliant VM configurations.
   • BUse Azure Security Center's regulatory compliance dashboard to monitor for non-compliant VMs and alert the security team.
   • CConfigure Azure Blueprints to deploy the VMs with the required settings and rely on the IaC templates to maintain compliance.
   • DCreate a custom RBAC role that prevents users from creating VMs without disk encryption and public IPs.
   Reveal Solution Discussion Select an answer first