A company runs a production AKS cluster. The security team wants to ensure that the Kubernetes API server is not exposed to the internet and that all access to the cluster is authenticated and authorized. Which configuration should you implement?

Keep the API server public but restrict access with authorized IP ranges.

Use Azure AD integration for authentication and rely on RBAC for authorization, but keep the API server public.

Create a private AKS cluster and use Azure Private Link to connect to the API server from a peered virtual network.

Disable the API server endpoint and use only kubectl with a local kubeconfig file.

A company runs a containerized application on AKS that needs to access an on-premises database. The security team wants to avoid exposing the database to the internet and also wants to ensure that the container's secrets are not stored in the image. Which approach should you take?

Expose the database through a public endpoint with an IP whitelist, and store secrets in Kubernetes Secrets.

Deploy a jump box in Azure with the database client tools, and use kubectl port-forward to access the database.

Use Azure Service Bus to relay traffic to the database, and embed the connection string in the container image.

Use Azure ExpressRoute or VPN to connect the AKS cluster to the on-premises network, and use the Secrets Store CSI driver to mount secrets from Azure Key Vault.

A company uses Azure Functions to process IoT device messages. The functions are triggered by IoT Hub and write results to Azure Storage. The security team wants to ensure that the functions can only access the specific storage account and that the storage account is not publicly accessible. What should you configure?

Store the storage account key in the function app settings and use it in the code.

Use a VPN gateway to connect the function app to the storage account.

Create a shared access signature (SAS) token for the storage account and embed it in the function code.

Use a system-assigned managed identity for the function app and grant it the 'Storage Blob Data Contributor' role on the specific storage account, then enable the storage account's firewall to deny public access.

Which Azure service provides a managed container registry that supports private container image storage and access control?

Azure Container Instances (ACI)

Microsoft Certified:Cybersecurity Architect Expert

Domain 3Objective 3

Specify Requirements for Securing SaaS, PaaS, and IaaS Services SC-100 Practice Questions (Page 3)

Part of the Design security solutions for infrastructure domain, which accounts for 25–30% of the SC-100 exam. Microsoft does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–24 in this domain), expect 3–6 from this objective — we provide 26 practice questions to prepare you well beyond it. (estimate)

26questions here

6free pages

8concepts

25–30%of the exam

Questions 11–15

11application · medium
A company runs a production AKS cluster. The security team wants to ensure that the Kubernetes API server is not exposed to the internet and that all access to the cluster is authenticated and authorized. Which configuration should you implement?
Select an answer first
12foundation · easy
Which Azure service provides content moderation and safety filters that can be integrated into Azure AI services to prevent harmful outputs?
Select an answer first
13expert · hard
A company runs a containerized application on AKS that needs to access an on-premises database. The security team wants to avoid exposing the database to the internet and also wants to ensure that the container's secrets are not stored in the image. Which approach should you take?
Select an answer first
14application · medium
A company uses Azure Functions to process IoT device messages. The functions are triggered by IoT Hub and write results to Azure Storage. The security team wants to ensure that the functions can only access the specific storage account and that the storage account is not publicly accessible. What should you configure?
Select an answer first
15foundation · easy
Which Azure service provides a managed container registry that supports private container image storage and access control?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SC-100

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-100” is a trademark of its owner, used for identification only.

Specify Requirements for Securing SaaS, PaaS, and IaaS Services SC-100 Practice Questions (Page 3)

Questions 11–15

A company runs a production AKS cluster. The security team wants to ensure that the Kubernetes API server is not exposed to the internet and that all access to the cluster is authenticated and authorized. Which configuration should you implement?

Which Azure service provides content moderation and safety filters that can be integrated into Azure AI services to prevent harmful outputs?

A company runs a containerized application on AKS that needs to access an on-premises database. The security team wants to avoid exposing the database to the internet and also wants to ensure that the container's secrets are not stored in the image. Which approach should you take?

Which Azure service provides a managed container registry that supports private container image storage and access control?

Keep studying — Design security solutions for infrastructure