ExamworthyExamworthy
Open the appStart free

SC-100 - Design Security Solutions for Infrastructure - Section 3.3

Specify requirements for securing SaaS, PaaS, and IaaS services, including containers and workloads.

Specify security requirements for SaaS, PaaS, and IaaS services by applying the appropriate security baselines and hardening containers and container orchestration environments. Distinguish the additional controls needed for web workloads, IoT workloads, and Azure AI services security relative to standard compute baselines.

SaaS, PaaS, and IaaS security baselinescontainer and container orchestration securityweb workloadsIoT workloadsAzure AI services security

Practice question for this objective

Free sampleDesign Security Solutions for Infrastructuremedium

A retailer hosts a public web application on Azure App Service behind Azure Front Door and must design protection against common web exploits such as SQL injection and cross-site scripting, with managed rule sets that update as new exploits emerge. Which capability should the architect specify at the edge to meet this web workload requirement?

  • AAzure DDoS Protection on the Front Door profile, inspecting application requests against managed rule sets to block SQL injection and cross-site scripting attempts before they reach the App Service origin.
  • BNetwork security groups on the App Service subnet, inspecting application requests against managed rule sets to block SQL injection and cross-site scripting attempts before they reach the origin.
  • CAzure Web Application Firewall on Azure Front Door, inspecting application requests against managed rule sets to block SQL injection and cross-site scripting attempts before they reach the App Service origin. Correct
  • DMicrosoft Defender for App Service, inspecting application requests against managed rule sets to block SQL injection and cross-site scripting attempts before they reach the App Service origin.
Specify the Azure Web Application Firewall on Azure Front Door to block common web exploits inline using managed rule sets at the edge. Protecting a public web application from injection and cross-site scripting requires Layer 7 inspection of HTTP payloads with maintained managed rule sets. The Azure Web Application Firewall on Front Door performs that inline filtering at the edge, whereas DDoS protection, network security groups, and detection-focused Defender plans operate at different layers or only alert rather than block.

Why A is wrong: DDoS Protection is tempting because it shields the public endpoint, but it defends availability against volumetric and protocol floods at the network layer and does not inspect application payloads for injection or scripting exploits.

Why B is wrong: Network security groups appeal as a filtering control, but they allow or deny traffic by IP address, port, and protocol and cannot parse HTTP payloads to detect injection or cross-site scripting exploits.

Why C is correct: The Azure Web Application Firewall on Front Door applies managed OWASP rule sets that are updated as exploits emerge and blocks injection and scripting attacks inline at the edge, which is exactly the web workload protection the requirement specifies.

Why D is wrong: Defender for App Service is tempting because it protects the same workload, but it detects threats and surfaces alerts on the running app rather than inline-blocking malicious web requests at the edge with managed rule sets.

See more SC-100 practice questions, answers explained.

More in this domain

Back to all Design Security Solutions for Infrastructure objectives, or the SC-100 cert hub.

Examworthy is not affiliated with or endorsed by Microsoft. Original, blueprint-aligned practice material only.