Specify Requirements for Securing SaaS, PaaS, and IaaS Services SC-100 Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   When identifying security requirements for an IoT workload, which of the following is a primary consideration?

   • AEnsuring devices have a public IP address for direct internet access.
   • BEnsuring devices use the latest version of the Windows operating system.
   • CEnsuring devices have unique identities and can authenticate to the cloud securely.
   • DEnsuring devices have large storage capacity for local data.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A company uses Microsoft 365 and has a custom web application that authenticates users via Azure AD. The security team wants to enforce a baseline that requires multi-factor authentication (MFA) for all users accessing the web app, but the company has a group of service accounts that cannot perform MFA. What should you do to meet the baseline while accommodating the service accounts?

   • ACreate a Conditional Access policy that requires MFA for all users except the service accounts, and use a separate policy to block the service accounts from interactive sign-in.
   • BUse a Conditional Access policy that requires MFA only for guest users and leave internal users unaffected.
   • CRequire MFA for all users and instruct the service accounts to use a hardware token that supports MFA.
   • DDisable MFA for the web app and rely on IP-based Conditional Access restrictions.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A company runs a multi-tenant AKS cluster where each tenant's workloads are isolated in separate namespaces. The security team wants to enforce network isolation between namespaces and also ensure that pods cannot escalate privileges. Which combination of controls should you implement?

   • AUse Kubernetes RBAC to limit access to namespaces and rely on the default pod security settings.
   • BUse Azure Network Policy to restrict traffic between namespaces and apply a Pod Security Admission policy that disallows privileged containers.
   • CDeploy each tenant's workloads to separate node pools and use node-level isolation.
   • DEnable Azure Defender for Kubernetes and use its recommendations to manually review network and pod security.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   For an IaaS workload such as an Azure virtual machine, which security control is the customer responsible for implementing as part of a security baseline?

   • AConfiguring the network switches that connect the virtual machine to the internet.
   • BPatching the hypervisor that runs the virtual machine.
   • CApplying operating system patches and updates to the virtual machine.
   • DSecuring the physical data center that hosts the virtual machine.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which security measure is critical for containerized applications to ensure that container images are free from known vulnerabilities?

   • AScanning container images for vulnerabilities before deployment.
   • BDisabling container logs.
   • CUsing the latest version of the container runtime.
   • DAssigning each container a public IP address.
   Reveal Solution Discussion Select an answer first