Design Solutions That Align with the Microsoft Cloud Adoption Framework for Azure (CAF) and the Azure Well-Architected Framework SC-100 Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which component is typically included in an Azure landing zone to support security governance?

   • AA single virtual network for all resources.
   • BA shared admin account for all subscriptions.
   • CNo logging configuration to reduce complexity.
   • DAzure Policy assignments for compliance and security.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A company is designing Azure landing zones. The security architect needs to ensure that all subscriptions have a consistent security baseline, but some business units have stricter requirements. The architect also needs to ensure that security logs are centrally managed. Which approach should the architect recommend?

   • AAssign all Azure Policy initiatives at the root management group to ensure uniformity.
   • BAssign all Azure Policy initiatives at each subscription level manually.
   • CUse Azure Blueprints to deploy a standard set of resources to all subscriptions.
   • DAssign a common Azure Policy initiative at the root management group and additional initiatives at business-unit management groups.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A company is designing Azure landing zones. The security architect needs to ensure that all virtual machines are monitored for security threats and that security alerts are centralized. Which solution should the architect recommend?

   • AUse Azure Sentinel (now Microsoft Sentinel) without Defender for Cloud.
   • BEnable Microsoft Defender for Cloud on all subscriptions and connect it to a central Log Analytics workspace.
   • CEnable Azure Monitor on each VM and send logs to a storage account.
   • DUse Azure Policy to require a specific tag on all VMs.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A security architect is reviewing a workload that uses Azure SQL Database. The current configuration allows public network access and uses SQL authentication. The architect is evaluating the design against the Azure Well-Architected Framework. Which recommendation should the architect make?

   • AEnable Azure Defender for SQL to detect threats.
   • BDisable public network access and use Azure Active Directory authentication with managed identities.
   • CKeep public access but restrict it to specific IP addresses.
   • DUse SQL authentication with strong passwords and rotate them regularly.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   A cybersecurity architect is evaluating an existing security strategy using the Azure Well-Architected Framework. Which pillar of the framework directly addresses the ability to protect data and systems from attacks?

   • AOperational Excellence
   • BCost Optimization
   • CReliability
   • DSecurity
   Reveal Solution Discussion Select an answer first