A company is designing a secure architecture in Azure. The requirements are: (1) a database server must be accessible only from a specific application server, (2) the application server must be manageable via RDP without a public IP, and (3) secrets used by the application must be stored securely. What should they implement?

Use NSGs to allow all traffic between the servers and assign a public IP to the application server for RDP

Place both servers in the same subnet, use Azure Firewall to restrict database access, and store secrets in a configuration file

Place the application and database servers in separate subnets, use NSGs to restrict database access to the application subnet, deploy Azure Bastion for RDP access, and store secrets in Azure Key Vault

Use Azure Bastion to connect to the database server and store secrets in Azure Key Vault

Which feature is available only in the Standard tier of Azure DDoS Protection?

Integration with Azure Monitor for alerts

Mitigation of volumetric attacks

Adaptive tuning based on your application's traffic patterns

Which of the following can be stored in Azure Key Vault?

Azure subscription billing information

A company uses Azure Key Vault to store secrets for multiple applications. They want to ensure that each application can only access its own secrets, and they want to automatically rotate secrets without manual intervention. What should they do?

Use Azure DDoS Protection to secure Key Vault

Use separate Key Vaults per application and configure access policies, then use Key Vault rotation events

Use Azure Firewall to restrict access to Key Vault

Use a single Key Vault with one access policy for all applications

A company hosts a customer-facing web application on Azure Application Gateway. The application has experienced SQL injection and cross-site scripting (XSS) attacks. The security team wants to add protection against these common web vulnerabilities without changing the application code. What should they do?

Enable Azure Web Application Firewall (WAF) on the Application Gateway

Enable Azure DDoS Protection on the virtual network

Configure an Azure Firewall policy to filter HTTP traffic

Apply a network security group (NSG) rule to block port 443

Microsoft Certified:Security, Compliance, and Identity Fundamentals

Domain 3Objective 1

Describe Core Infrastructure Security Services in Azure SC-900 Practice Questions (Page 4)

Part of the Describe the capabilities of Microsoft security solutions domain, which accounts for 35–40% of the SC-900 exam. Microsoft does not publish an official question count, but from its 45-minute exam (~20–30 total, ~7–12 in this domain), expect 2–3 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

12concepts

35–40%of the exam

12 Concepts in This Objective

Azure DDoS Protection Overview
Azure DDoS Protection Tiers
Azure Firewall Functionality
Azure Firewall Policy Management
Azure Web Application Firewall (WAF) Features
Azure WAF Deployment
Azure Virtual Networks Segmentation
Network Security Groups (NSGs) Function
NSG Rule Configuration
Azure Bastion Service
Azure Key Vault Overview
Azure Key Vault Integration

Questions 16–20

16expert · hard
A company is designing a secure architecture in Azure. The requirements are: (1) a database server must be accessible only from a specific application server, (2) the application server must be manageable via RDP without a public IP, and (3) secrets used by the application must be stored securely. What should they implement?
Select an answer first
17foundation · easy
Which feature is available only in the Standard tier of Azure DDoS Protection?
Select an answer first
18foundation · easy
Which of the following can be stored in Azure Key Vault?
Select an answer first
19expert · hard
A company uses Azure Key Vault to store secrets for multiple applications. They want to ensure that each application can only access its own secrets, and they want to automatically rotate secrets without manual intervention. What should they do?
Select an answer first
20application · medium
A company hosts a customer-facing web application on Azure Application Gateway. The application has experienced SQL injection and cross-site scripting (XSS) attacks. The security team wants to add protection against these common web vulnerabilities without changing the application code. What should they do?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SC-900

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-900” is a trademark of its owner, used for identification only.

Describe Core Infrastructure Security Services in Azure SC-900 Practice Questions (Page 4)

Questions 16–20

Which feature is available only in the Standard tier of Azure DDoS Protection?

Which of the following can be stored in Azure Key Vault?

A company uses Azure Key Vault to store secrets for multiple applications. They want to ensure that each application can only access its own secrets, and they want to automatically rotate secrets without manual intervention. What should they do?

Keep studying — Describe the capabilities of Microsoft security solutions