Design Solutions That Align with the Microsoft Cybersecurity Reference Architectures (MCRA) and Microsoft Cloud Security Benchmark (MCSB) SC-100 Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A technology company is building a new application that will be deployed using containers and managed through a CI/CD pipeline. The security architect must design a solution aligned with the MCRA to protect the application from supply chain attacks. The company wants to ensure that only trusted container images are deployed. Which approach should the architect recommend?

   • AUse Azure Container Registry with content trust enabled and integrate Microsoft Defender for Cloud's vulnerability assessment for container images.
   • BStore all container images in a private Azure Storage account and restrict access with SAS tokens.
   • CDeploy all containers using the latest tag to ensure they are up to date.
   • DUse a third-party container registry and rely on its built-in security features.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A research organization is deploying an AI model that uses sensitive research data. The security architect must align with the Microsoft Cloud Security Benchmark (MCSB). The organization has a requirement to ensure that the AI model's outputs are not biased and that the data is protected. Which combination of MCSB controls should be applied?

   • AImplement Azure AI Content Safety filters and use Azure Confidential Computing for data processing.
   • BDeploy Azure Application Gateway with WAF in front of the AI service.
   • CEnable Azure Monitor for logging AI model calls.
   • DUse Azure Policy to enforce tagging on AI resources.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A healthcare organization is implementing a security strategy aligned with the MCRA. The security architect must design a solution that protects patient data from both external attacks and insider threats. The organization has a limited security team and wants to automate as much as possible. Which approach should the architect recommend?

   • ADeploy a third-party SIEM solution and hire additional security analysts to manage it.
   • BUse Azure Policy to enforce security configurations and rely on manual audits.
   • CUse Microsoft Defender for Cloud to monitor all workloads and Microsoft Sentinel for automated threat response.
   • DImplement Azure AD Privileged Identity Management (PIM) and require manual approval for all access.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A software company uses a third-party CI/CD pipeline that has been compromised in the past. The security architect is aligning with the MCRA supply chain attack mitigation guidance. The company wants to ensure that only code reviewed and approved by security is deployed. Which control should be implemented to enforce this requirement?

   • ARequire a security review as a mandatory step in the pipeline, with code signing and signature verification before deployment.
   • BUse a private package repository for all dependencies.
   • CDeploy a web application firewall (WAF) in front of the production environment.
   • DEnable Azure DevOps audit logs to track pipeline changes.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A technology company is designing a defense-in-depth strategy against external attacks, aligned with the MCRA. The company has a public-facing web application and uses Azure AD for authentication. The architect wants to implement controls at multiple layers. Which combination of controls best aligns with MCRA external attack defense?

   • ADeploy Azure DDoS Protection, a web application firewall (WAF), and Conditional Access with MFA.
   • BEnable Azure Security Center (Defender for Cloud) recommendations only.
   • CDeploy Azure Firewall and Network Security Groups (NSGs) only.
   • DUse Azure AD Conditional Access with MFA only.
   Reveal Solution Discussion Select an answer first