What type of attacks does Azure Web Application Firewall (WAF) primarily protect against?

Brute-force attacks on SSH endpoints

Distributed denial-of-service (DDoS) attacks at the network layer

Common web vulnerabilities such as SQL injection and cross-site scripting

Malware infections on virtual machines

A company is designing a multi-tier application in Azure. The web tier must be accessible from the internet, but the database tier must only be accessible from the web tier. The company wants to isolate the tiers and enforce traffic rules at the subnet level. What should they implement?

Place each tier in a separate subnet within the same virtual network and apply network security groups (NSGs) to each subnet

Place all tiers in the same subnet and rely on Azure Firewall to filter traffic

Use Azure Bastion to connect the database tier to the web tier

Deploy each tier in a separate virtual network and peer them

What is the primary purpose of Azure Key Vault?

To provide a firewall for virtual networks

To manage user identities and access

To monitor and detect security threats in Azure

To securely store and manage cryptographic keys, secrets, and certificates

A company is deploying a hub-and-spoke network topology in Azure. The hub virtual network contains a shared Azure Firewall that inspects traffic between on-premises networks and spoke virtual networks. The security team needs to ensure that all outbound traffic from the spokes to the internet is filtered by the firewall and that the filtering rules are managed centrally. What should they configure?

Create an Azure Firewall Policy and associate it with the firewall, then configure user-defined routes (UDRs) in each spoke to send internet-bound traffic to the firewall

Deploy Azure DDoS Protection on the hub virtual network

Use Azure Bastion to route all internet traffic through a jump host

Apply network security groups (NSGs) to the subnets in each spoke with rules to block internet access

How are NSG rules evaluated?

Randomly, with the most specific rule applied

In alphabetical order of rule names

In order of priority, with lower numbers evaluated first

In the order they were created, with the oldest rule applied first

Microsoft Certified:Security, Compliance, and Identity Fundamentals

Domain 3Objective 1

Describe Core Infrastructure Security Services in Azure SC-900 Practice Questions (Page 8)

Part of the Describe the capabilities of Microsoft security solutions domain, which accounts for 35–40% of the SC-900 exam. Microsoft does not publish an official question count, but from its 45-minute exam (~20–30 total, ~7–12 in this domain), expect 2–3 from this objective — we provide 49 practice questions to prepare you well beyond it. (estimate)

49questions here

10free pages

12concepts

35–40%of the exam

12 Concepts in This Objective

Azure DDoS Protection Overview
Azure DDoS Protection Tiers
Azure Firewall Functionality
Azure Firewall Policy Management
Azure Web Application Firewall (WAF) Features
Azure WAF Deployment
Azure Virtual Networks Segmentation
Network Security Groups (NSGs) Function
NSG Rule Configuration
Azure Bastion Service
Azure Key Vault Overview
Azure Key Vault Integration

Questions 36–40

36foundation · easy
What type of attacks does Azure Web Application Firewall (WAF) primarily protect against?
Select an answer first
37application · medium
A company is designing a multi-tier application in Azure. The web tier must be accessible from the internet, but the database tier must only be accessible from the web tier. The company wants to isolate the tiers and enforce traffic rules at the subnet level. What should they implement?
Select an answer first
38foundation · easy
What is the primary purpose of Azure Key Vault?
Select an answer first
39application · medium
A company is deploying a hub-and-spoke network topology in Azure. The hub virtual network contains a shared Azure Firewall that inspects traffic between on-premises networks and spoke virtual networks. The security team needs to ensure that all outbound traffic from the spokes to the internet is filtered by the firewall and that the filtering rules are managed centrally. What should they configure?
Select an answer first
40foundation · easy
How are NSG rules evaluated?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SC-900

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-900” is a trademark of its owner, used for identification only.