SC-100 · Domain 4
Design security solutions for applications and data
About 23% of the exam
Information protection with Purview
- Sensitive information types
- patterns with confidence and proximity
- Trainable classifiers
- models trained on your examples
- Exact data match
- compares against your own records
- Sensitivity labels
- classification that travels with content
- Auto labeling
- applied on creation or scan
- Loss prevention policies
- block or warn on risky sharing
- Data lifecycle
- retention and disposal by policy
- Insider risk
- signals about risky user behavior
Application security in the pipeline
- Static analysis
- inspects first party source code
- Composition analysis
- finds vulnerable third party dependencies
- Dynamic analysis
- exercises the running application
- Image scanning
- fails the build on critical findings
- Secret scanning
- catches credentials before they merge
- Provenance attestations
- prove the pipeline built the artifact
- Lockfiles and hashes
- install the exact verified package
Shifting left means the gate runs inside the build rather than in a report someone reads later, so pick the answer that fails the pipeline
Programming interface risks
- Object level authorization checked server side
- Property level filtering on every response
- Page size clamped by the server
- Misconfiguration leaking stack traces
- Rate limits per identity and endpoint
- An inventory of endpoints kept current
Token and session design
- Short lived access tokens by default
- Refresh tokens rotated and reuse detected
- A backend service holds the tokens
- Strict redirect matching, never prefixes
- Proof key exchange for public clients
- Introspection for high risk operations
Secrets in applications
- Managed identities instead of stored credentials
- Vault references resolved at runtime
- Never bake secrets into images
- Pipeline variables masked in logs
- Short lived credentials limit leak value
- Every read logged for the auditor
Data protection choices
- Tokenization keeps format, removes the value
- Encryption protects but changes the field
- Customer managed keys for regulated data
- Ephemeral key exchange for forward secrecy
- Keep the mapping store separate
Classify then protect
- Discover where the data actually lives
- Define the classification scheme
- Build the information types and classifiers
- Publish labels with protection attached
- Auto label at creation and rest
- Add loss prevention policies
- Monitor, tune and report
- Labels drive encryption and access rights
- Classification without enforcement changes nothing
- Tune confidence to control false matches
- Cover endpoints, cloud services and messaging
Application flaws to design out
- Injection
- parameterize every query
- Request forgery
- tokens or same site cookies
- Broken authorization
- check ownership on every request
- Excessive exposure
- serialize only permitted properties
- Verbose errors
- generic messages in production
- Dependency confusion
- pin versions and verify hashes
- Insecure storage
- no secrets in configuration files
Database and platform controls
- Directory authentication instead of connection strings
- Least privilege roles for the application
- Encryption at rest with managed keys
- Auditing to a central workspace
- Discovery and classification of columns
Triage and prioritization
- Identifier names the flaw, score ranks it
- Exploitability matters more than raw severity
- Reachability analysis cuts the backlog
- Fix in the base image once
- Track exceptions with expiry dates
Evidence for the auditor
- Pipeline gate results retained per release
- Label coverage across the estate
- Loss prevention incidents and outcomes
- Secret access logs from the vault
- Attestations tied to deployed images
Which control answers which ask
- Find sensitive data
- information types and classifiers
- Keep the format intact
- tokenization rather than encryption
- Keep tokens from browsers
- a backend service holding them
- Remove stored credentials
- managed identities and federation
- Prove build integrity
- signed provenance attestations
- Block risky sharing
- loss prevention policies
Reference strip: classify, protect, build, runtime, evidence
Classify
- Types, classifiers and exact matching
- Labels carry protection with them
- Auto label at creation
Protect
- Tokenize when format matters
- Encrypt with managed keys
- Prevent loss at every endpoint
Build
- Static, composition and dynamic testing
- Fail on critical findings
- Pin and verify dependencies
Runtime
- Authorize every object request
- Short tokens, rotated refresh
- Secrets referenced, never embedded
Evidence
- Gate results per release
- Label and policy coverage
- Vault access logs retained
Quick exam traps
- Trap: Encrypting a field is always preferable to tokenizing it
- Trap: Composition analysis and static analysis find the same problems
- Trap: A high severity score means the finding is exploitable here
- Trap: Storing tokens in browser local storage is acceptable with short expiry
- Trap: Sensitivity labels protect data without any policy behind them
- Trap: Prefix matching on redirect addresses is a safe shortcut
- Trap: Scanning images after deployment is equivalent to shifting left
cybercertprep.com · original revision sheet written from the public body of knowledge