StudyByteLearn
← SC-100: Microsoft Cybersecurity Architect
SC-100 · Application lifecycle workload identities and APIs

Practice question 425 of 498 · medium

A public API needs complementary protections for web exploits and API-specific access rules. Which two controls fit? Select two.

Select all that apply. Every correct option and no extras are required for credit in the app.

  1. A.TDE as the sole caller identity mechanism
  2. B.Backend authorization for allowed objects and functions
  3. C.A shared subscription key as proof of every end user’s authorization
  4. D.WAF rules for supported common HTTP attacks
  5. E.A gateway rate limit as the only web-exploit and object-access control
Show the answer and explanation

✓ Correct answers

  • Backend authorization for allowed objects and functions
  • WAF rules for supported common HTTP attacks

WAF and backend authorization meet distinct web and business-access requirements. TDE encrypts stored database files rather than authenticating callers. Subscription keys do not prove individual object rights. Rate limits constrain volume but do not replace attack inspection or authorization.

Read the source reference

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study material. Not affiliated with or endorsed by Microsoft. These are original learning questions, not actual exam questions. Product capabilities and exam objectives can change; verify current Microsoft documentation. Practice scores do not predict or guarantee an exam result.