SC-100 - Design Security Solutions for Applications and Data (23% of the exam) - Section 4.2

Design solutions for securing applications across their full lifecycle, including threat modeling and workload identities.

Design application security across the full lifecycle by applying application threat modeling to surface risks early and integrating DevSecOps and secure development practices at each stage. Choose workload identities for service-to-service authentication, and layer Azure API Management with Azure Web Application Firewall (WAF) to control and inspect API traffic.

application threat modelingapplication security lifecycleDevSecOps and secure developmentworkload identitiesAzure API ManagementAzure Web Application Firewall (WAF)

Practice question for this objective

Free sampleDesign Security Solutions for Applications and Datahard

A retailer's public web application is suffering automated attacks attempting SQL injection and cross-site scripting against its HTTP endpoints, and the design must inspect and filter malicious application-layer requests against common web exploits before they reach the application. The architect needs the control purpose-built to block layer-7 web attacks at the network edge. Which control should the design place in front of the application?

AA network security group on the application subnet configured to permit only the load balancer's address range to reach the web servers on the HTTP and HTTPS ports.
BAzure DDoS Protection on the public address so that volumetric and protocol floods aimed at the application are absorbed and mitigated before they degrade availability.
CMicrosoft Defender for Cloud workload protection on the web servers so that suspicious process behaviour on the hosts is detected and alerted to the security team.
DAzure Web Application Firewall with the managed rule set so that layer-7 requests are inspected and known web exploit patterns are blocked before reaching the application. Correct

Azure Web Application Firewall is the layer-7 control that inspects HTTP request content and blocks common web exploits before they reach the application. A Web Application Firewall parses HTTP requests and matches them against managed rule sets covering common exploit categories such as injection and cross-site scripting, blocking malicious requests at the edge. Network security groups and DDoS Protection work below the application layer, and host workload protection acts after the request lands, so none filters layer-7 exploit content.

Why A is wrong: A network security group restricts traffic by address and port and is a reasonable hygiene control, but it operates at layers 3 and 4 and cannot read request payloads, so it cannot detect or block the injection and scripting attacks the requirement describes.

Why B is wrong: DDoS Protection defends availability against floods and is tempting because the traffic is attacker-driven, but it targets volumetric and protocol abuse rather than malicious request content, so it does nothing against injection or cross-site scripting payloads.

Why C is wrong: Host workload protection detects malicious behaviour after a request lands and is appealing as defence in depth, but it alerts on host activity rather than filtering inbound web requests, so it does not block layer-7 exploits at the edge as required.

Why D is correct: Azure Web Application Firewall inspects HTTP request content at layer 7 and applies managed rules that block injection and cross-site scripting before traffic reaches the application, which is the purpose-built edge control the requirement specifies.

See more SC-100 practice questions, answers explained.

Exam traps in Design Security Solutions for Applications and Data

Answers that look right on this material and are not. Each one is a distractor from a different question in the SC-100 bank for this domain.

Configure dynamic application security testing to exercise the running, deployed service from the outside so that exploitable runtime flaws are discovered against a live endpoint.
Why it is wrong: Dynamic testing is a genuine lifecycle control and is tempting because it finds real flaws, but it requires a deployed running application and therefore belongs to the verification phase, not the design phase the requirement asks about.
Deploy a regional Azure Application Gateway with its web application firewall in front of the origin so that requests are inspected after they leave Front Door and arrive in the application's region.
Why it is wrong: An Application Gateway firewall is a real web application firewall and is tempting because it also blocks layer-7 attacks, but it inspects traffic only after it reaches a single region rather than at the global edge close to the user as the requirement demands.
Rely on the platform-managed keys that Azure Storage applies automatically, since all data at rest is already encrypted with 256-bit keys by the service.
Why it is wrong: Platform-managed keys are tempting because encryption at rest is on by default, but Microsoft owns and rotates those keys, so the insurer cannot independently control or revoke them as the regulation requires.

Examworthy is not affiliated with or endorsed by Microsoft. Original, blueprint-aligned practice material only.