SC-100 · Domain 1: Design solutions that align with security best practices and priorities · 22% of the exam
Task 1.3: Design solutions that align with the Microsoft Cloud Adoption Framework for Azure (CAF) and the Azure Well-Architected Framework
Secure AI adoption, security and governance strategy from CAF and the Well-Architected security pillar, Azure landing zones as the way to apply and govern it, and a DevSecOps process.
Study it
Cloud Adoption Framework security and the Well-Architected security pillar
Try each one before opening the answer. Every option is explained, with the Microsoft documentation page that proves it.
Question 1 · choose 1
A company is adopting Azure landing zones. Every new workload subscription placed under the Corp management group must automatically send activity and resource logs to the central workspace and get the required Microsoft Defender for Cloud plans, and the platform team doesn't want to rely on each workload team remembering to configure them. What should the design use?
ADeployIfNotExists and Modify policies assigned at the landing zone management groups
BAuditIfNotExists policies at the Corp management group that flag subscriptions missing the settings
CA Bicep template of the required settings that each workload team deploys from its own pipeline
DA CanNotDelete lock on each subscription's resource groups
Show the answer and why
ADeployIfNotExists and Modify policies assigned at the landing zone management groups
Correct
Policy-driven guardrails configure supporting settings in each new landing zone subscription and keep it compliant as the estate scales.
BAuditIfNotExists policies at the Corp management group that flag subscriptions missing the settings
Incorrect
Audit effects report noncompliant subscriptions; they don't deploy the diagnostic settings or enable the Defender plans.
CA Bicep template of the required settings that each workload team deploys from its own pipeline
Incorrect
A template still depends on every team remembering to run it, which is what the platform team wants to avoid.
DA CanNotDelete lock on each subscription's resource groups
Incorrect
Locks prevent deletion; they don't deploy diagnostic settings or enable Defender plans.
DeployIfNotExists (DINE) and Modify policies are part of the Azure landing zone reference implementations. When a new landing zone subscription is placed in a management group such as Corp, they deploy or configure supporting settings, such as diagnostic settings and Defender for Cloud plans, so the subscription stays compliant without manual work.
In a tenant with an Azure landing zone hierarchy, any user can currently create management groups, and new subscriptions created by developers with Visual Studio benefits appear under the tenant root management group, where some broad policies and role assignments apply. Which two settings should the architect configure? (Choose TWO.)
ADefine a dedicated default management group for newly created subscriptions
BMirror the full organizational chart in management groups ten levels deep
CRequire authorization for creating new management groups
DAssign workload teams Contributor at the Corp management group
EApply every security policy only at the tenant root so nothing is missed
Show the answer and why
ADefine a dedicated default management group for newly created subscriptions
Correct
A default management group keeps new subscriptions out of the root and away from its broad assignments.
BMirror the full organizational chart in management groups ten levels deep
Incorrect
Landing zone guidance keeps the hierarchy reasonably flat instead of mirroring the organization chart.
CRequire authorization for creating new management groups
Correct
By default any principal in the tenant can create management groups; requiring authorization overrides that.
DAssign workload teams Contributor at the Corp management group
Incorrect
Workload team permissions belong at subscription or resource group scope; inheritance from management groups over-permissions them.
EApply every security policy only at the tenant root so nothing is missed
Incorrect
Constructs at the root affect new subscriptions immediately, which is why many organizations avoid broad assignments there.
The hierarchy protection settings let you define the default management group for new subscriptions and require authorization for management group creation. Landing zone guidance adds a dedicated default management group, a flat hierarchy, and workload permissions at subscription or resource group scope rather than at management groups.
A team is starting a new workload and asks the architect what it should measure its security design against, both at launch and as the workload changes over the next years. Which Azure Well-Architected Framework security recommendation answers this directly?
AEncrypt all data with customer-managed keys from day one
BRun a penetration test only when the workload goes live
CEstablish a security baseline aligned to compliance and platform guidance, and measure against it regularly
DCopy the security settings of the most recent workload the team built, since it passed its last security review without findings
Show the answer and why
AEncrypt all data with customer-managed keys from day one
Incorrect
Encryption is one control, not the yardstick for the whole design.
BRun a penetration test only when the workload goes live
Incorrect
Testing is one part of a testing regimen; it doesn't define what to measure against over time.
CEstablish a security baseline aligned to compliance and platform guidance, and measure against it regularly
Correct
SE:01 asks for exactly this baseline and regular measurement to sustain or improve posture.
DCopy the security settings of the most recent workload the team built, since it passed its last security review without findings
Incorrect
Another workload's settings aren't a baseline aligned to compliance and platform guidance.
SE:01 in the security pillar checklist says to establish a security baseline aligned to compliance requirements, industry standards and platform recommendations, and to regularly measure the workload architecture and operations against it.
A global retailer has dozens of teams experimenting with generative AI in Azure. The CISO's first goal under the Cloud Adoption Framework's AI security guidance is to know which AI applications, models and connected data exist in its subscriptions and which of them carry risks such as exposed endpoints or excessive permissions, with findings updated automatically. What should the architect propose?
AWeekly Azure Resource Graph queries that list the AI resource types in every subscription
BMicrosoft Purview Data Loss Prevention policies for every AI application
CAI security posture management in the Defender CSPM plan of Microsoft Defender for Cloud
DA content filter configuration applied to each model deployment
Show the answer and why
AWeekly Azure Resource Graph queries that list the AI resource types in every subscription
Incorrect
Resource Graph lists resources, but it doesn't map models and connected data to risks such as exposed endpoints, or raise findings on its own.
BMicrosoft Purview Data Loss Prevention policies for every AI application
Incorrect
DLP blocks sensitive data from leaving through AI; it doesn't inventory AI workloads or posture risks.
CAI security posture management in the Defender CSPM plan of Microsoft Defender for Cloud
Correct
AI-SPM in Defender CSPM discovers generative AI workloads and their components and surfaces risks with recommendations and attack paths.
DA content filter configuration applied to each model deployment
Incorrect
Filters screen prompts and responses but don't build an inventory or find misconfigurations.
The Cloud Adoption Framework's AI security guidance asks for a complete AI asset inventory and automated AI risk detection, using AI security posture management in Microsoft Defender for Cloud. AI-SPM, part of the Defender CSPM plan, discovers generative AI applications and their components and identifies risks with recommendations and attack path analysis.
In the Cloud Adoption Framework for Azure, when does the Secure methodology apply?
AOnly in the Ready phase, when the landing zones are built and the platform policies are assigned
BOnly after migration, during operations
CAcross every phase of cloud adoption
DOnly when a workload handles regulated data
Show the answer and why
AOnly in the Ready phase, when the landing zones are built and the platform policies are assigned
Incorrect
Landing zones are one place it applies, not the only one.
BOnly after migration, during operations
Incorrect
Gaps in any phase weaken overall posture, so it starts earlier.
CAcross every phase of cloud adoption
Correct
Security guidance applies across every methodology phase of the framework.
DOnly when a workload handles regulated data
Incorrect
The methodology applies to the whole estate.
The Secure methodology introduces security guidance that applies across every phase of the Cloud Adoption Framework: strategy, planning, readiness, adoption, governance and operations.
In the Azure landing zone management group hierarchy, a public website needs direct internet inbound connectivity and no connection to the corporate network. Where does its subscription belong?
AThe Corp management group
BThe Decommissioned management group
CThe Online management group
DThe tenant root management group
Show the answer and why
AThe Corp management group
Incorrect
Corp is for workloads that need connectivity to the corporate network through the hub.
BThe Decommissioned management group
Incorrect
That group holds subscriptions being retired.
CThe Online management group
Correct
Online is for workloads that might need direct internet inbound or outbound connectivity.
DThe tenant root management group
Incorrect
Subscriptions shouldn't sit under the root.
The landing zone hierarchy organizes subscriptions by workload type: Online for workloads that might need direct internet connectivity, Corp for workloads connected to the corporate network through the hub, plus Sandbox and Decommissioned groups.
How many levels of depth can an Azure management group tree have, not counting the tenant root level or the subscription level?
AThree
BSix
CTwelve
DThere is no limit
Show the answer and why
AThree
Incorrect
Three to four levels is the recommendation, not the limit.
BSix
Correct
A management group tree can support up to six levels of depth.
CTwelve
Incorrect
The limit is six.
DThere is no limit
Incorrect
There is a limit of six levels.
A management group tree can support up to six levels of depth, excluding the tenant root level and the subscription level. Landing zone guidance recommends keeping it to three or four levels.
The Cloud Adoption Framework's Secure methodology maps controls to the CIA triad. Which principle do hashing, signing and immutable storage enforce?
AConfidentiality
BIntegrity
CAvailability
DAccountability
Show the answer and why
AConfidentiality
Incorrect
Confidentiality is enforced by encryption, access control and segmentation.
BIntegrity
Correct
Integrity preserves data correctness, enforced by hashing, signing and immutable storage patterns.
CAvailability
Incorrect
Availability is about keeping systems and data accessible.
DAccountability
Incorrect
Accountability isn't one of the three CIA principles.
In the CIA triad, integrity preserves data correctness and completeness through hashing, signing, immutable storage, version control and secure update supply chains.