ExamworthyExamworthy
Open the appStart free

SC-100 - Design Security Solutions for Applications and Data - Section 4.2

Design solutions for securing applications across their full lifecycle, including threat modeling and workload identities.

Design application security across the full lifecycle by applying application threat modeling to surface risks early and integrating DevSecOps and secure development practices at each stage. Choose workload identities for service-to-service authentication, and layer Azure API Management with Azure Web Application Firewall (WAF) to control and inspect API traffic.

application threat modelingapplication security lifecycleDevSecOps and secure developmentworkload identitiesAzure API ManagementAzure Web Application Firewall (WAF)

Practice question for this objective

Free sampleDesign Security Solutions for Applications and Datahard

A retailer's public web application is suffering automated attacks attempting SQL injection and cross-site scripting against its HTTP endpoints, and the design must inspect and filter malicious application-layer requests against common web exploits before they reach the application. The architect needs the control purpose-built to block layer-7 web attacks at the network edge. Which control should the design place in front of the application?

  • AA network security group on the application subnet configured to permit only the load balancer's address range to reach the web servers on the HTTP and HTTPS ports.
  • BAzure DDoS Protection on the public address so that volumetric and protocol floods aimed at the application are absorbed and mitigated before they degrade availability.
  • CMicrosoft Defender for Cloud workload protection on the web servers so that suspicious process behaviour on the hosts is detected and alerted to the security team.
  • DAzure Web Application Firewall with the managed rule set so that layer-7 requests are inspected and known web exploit patterns are blocked before reaching the application. Correct
Azure Web Application Firewall is the layer-7 control that inspects HTTP request content and blocks common web exploits before they reach the application. A Web Application Firewall parses HTTP requests and matches them against managed rule sets covering common exploit categories such as injection and cross-site scripting, blocking malicious requests at the edge. Network security groups and DDoS Protection work below the application layer, and host workload protection acts after the request lands, so none filters layer-7 exploit content.

Why A is wrong: A network security group restricts traffic by address and port and is a reasonable hygiene control, but it operates at layers 3 and 4 and cannot read request payloads, so it cannot detect or block the injection and scripting attacks the requirement describes.

Why B is wrong: DDoS Protection defends availability against floods and is tempting because the traffic is attacker-driven, but it targets volumetric and protocol abuse rather than malicious request content, so it does nothing against injection or cross-site scripting payloads.

Why C is wrong: Host workload protection detects malicious behaviour after a request lands and is appealing as defence in depth, but it alerts on host activity rather than filtering inbound web requests, so it does not block layer-7 exploits at the edge as required.

Why D is correct: Azure Web Application Firewall inspects HTTP request content at layer 7 and applies managed rules that block injection and cross-site scripting before traffic reaches the application, which is the purpose-built edge control the requirement specifies.

See more SC-100 practice questions, answers explained.

More in this domain

Back to all Design Security Solutions for Applications and Data objectives, or the SC-100 cert hub.

Examworthy is not affiliated with or endorsed by Microsoft. Original, blueprint-aligned practice material only.