Design Solutions That Align with the Microsoft Cloud Adoption Framework for Azure (CAF) and the Azure Well-Architected Framework SC-100 Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which Azure service is commonly recommended by the Microsoft Cloud Adoption Framework for centralizing security monitoring and threat detection?

   • AAzure DevOps
   • BMicrosoft Defender for Cloud
   • CAzure Monitor
   • DAzure Cost Management
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A multinational company is migrating its first workloads to Azure. The security team has drafted a governance strategy that assigns a single subscription for all production workloads and relies on network security groups (NSGs) at the subnet level for segmentation. The company plans to expand to multiple business units over the next year. Which CAF-aligned recommendation should the security architect make?

   • AUse Azure Firewall instead of NSGs to segment all workloads within the single subscription.
   • BKeep the single subscription but create a separate virtual network per business unit and peer them together.
   • CDeploy a single management group with one subscription per business unit and apply Azure Policy at the management group level.
   • DCreate a management group per business unit but keep all subscriptions under a single management group.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A company is implementing an Azure landing zone for a regulated industry. The security architect must ensure that all resources are compliant with industry regulations, but the business units have different compliance requirements. The architect needs to balance centralized compliance with business unit autonomy. Which approach should the architect recommend?

   • AUse Azure Security Center's regulatory compliance dashboard to monitor compliance.
   • BUse Azure Policy at the management group level for common compliance requirements and allow business units to add their own policies at lower scopes.
   • CLet each business unit manage its own compliance policies independently.
   • DUse a single Azure Policy assignment at the root management group for all compliance requirements.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A security architect is evaluating an existing workload that uses Azure Kubernetes Service (AKS). The workload is mission-critical and requires high availability. The current design uses a single node pool in a single availability zone. The architect is reviewing the design against the Azure Well-Architected Framework. Which recommendation should the architect make?

   • AKeep the single node pool but enable cluster autoscaler.
   • BDeploy multiple node pools across multiple availability zones and use pod anti-affinity rules.
   • CUse a single larger node to handle more load.
   • DUse Azure Site Recovery to replicate the AKS cluster to another region.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A company is deploying a new application using a CI/CD pipeline. The security architect is reviewing the workload against the Azure Well-Architected Framework. The team wants to ensure that security vulnerabilities are identified early in the development process. Which practice should the architect recommend?

   • AUse Azure Policy to block deployments that do not have a specific tag.
   • BRun static application security testing (SAST) as part of the build pipeline.
   • CRun dynamic application security testing (DAST) only in production.
   • DRely on Azure Defender for Cloud to scan the deployed application.
   Reveal Solution Discussion Select an answer first