Design Solutions That Align with the Microsoft Cybersecurity Reference Architectures (MCRA) and Microsoft Cloud Security Benchmark (MCSB) SC-100 Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A healthcare provider is adopting Zero Trust and aligning with the MCRA. The provider uses legacy on-premises applications that do not support modern authentication protocols. The security architect must enable secure remote access for these applications without compromising the Zero Trust model. Which approach should be recommended?

   • AUse Azure AD Application Proxy to publish legacy applications and enforce Conditional Access policies.
   • BExpose the legacy applications directly to the internet with a VPN.
   • CMigrate all legacy applications to Azure Virtual Desktop (AVD).
   • DDeploy a web application firewall (WAF) in front of the legacy applications.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A multinational company is deploying a new customer-facing web application in Azure. The security architect must design a defense-in-depth strategy aligned with the MCRA that protects the application from external web attacks while also ensuring that remote employees accessing the application from untrusted networks are verified. The company wants to minimize the number of separate security products. Which approach should the architect recommend?

   • AEnable Azure DDoS Protection and configure NSGs to restrict inbound traffic to the application's public IP.
   • BDeploy Azure WAF in front of the application and require Azure AD Conditional Access with MFA for all remote access.
   • CDeploy a network virtual appliance (NVA) with intrusion detection and require all remote employees to connect through a VPN.
   • DUse Azure Front Door with built-in WAF policies and implement Azure AD B2B for external partner access only.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A government agency is implementing the MCRA insider threat best practices. The agency has a high number of employees with access to classified information. The security architect needs to reduce the risk of data exfiltration by insiders while maintaining employee productivity. Which control should be prioritized?

   • ADeploy Azure AD Privileged Identity Management (PIM) for all users.
   • BUse Azure AD Identity Protection to block risky sign-ins.
   • CRequire all employees to use multi-factor authentication (MFA).
   • DImplement Microsoft Purview Data Loss Prevention (DLP) policies to block unauthorized sharing of sensitive data.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A large enterprise is implementing a Zero Trust strategy and wants to protect against insider threats. The security architect must design a solution that balances user productivity with security. The company has a mix of on-premises and cloud resources, and employees often work from personal devices. Which approach should the architect recommend?

   • ARequire all employees to use company-managed devices and block access from personal devices.
   • BUse Azure AD Privileged Identity Management (PIM) to require approval for all access to sensitive resources.
   • CImplement Azure AD Conditional Access with device compliance policies and use Microsoft Purview Insider Risk Management to detect risky behavior.
   • DDeploy Azure Information Protection to encrypt all data and require a password to open it.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A tech startup is deploying a generative AI chatbot that uses Azure OpenAI Service. The security architect must align with the Microsoft Cloud Security Benchmark (MCSB). The startup wants to prevent the AI from generating harmful content and ensure that only authorized users can access the service. Which MCSB control should be applied?

   • ADeploy Azure API Management in front of the chatbot.
   • BUse Azure Policy to enforce tagging on all resources.
   • CEnable Azure Application Insights for logging chatbot interactions.
   • DConfigure Azure AI Content Safety filters and use Azure AD authentication for the chatbot.
   Reveal Solution Discussion Select an answer first