SC-100 Certification Practice Question #221

Question

You have an Azure subscription.

You have a DNS domain named contoso.com that is hosted by a third-party DNS registrar.

Developers use Azure DevOps to deploy web apps to App Service Environments. When a new app is deployed, a CNAME record for the app is registered in contoso.com.

You need to recommend a solution to secure the DNS record for each web app. The solution must meet the following requirements:

•	Ensure that when an app is deleted, the CNAME record for the app is removed also.
•	Minimize administrative effort.

What should you include in the recommendation?

Accepted Answer

The scenario is the textbook **dangling-DNS / subdomain-takeover** case: a CNAME in a third-party registrar points at an App Service app that gets deleted. MS Learn states explicitly that **Microsoft Defender for App Service** detects dangling DNS entries when an App Service website is decommissioned, and that this protection works whether the domain is in Azure DNS or an external registrar — matching the third-party-registrar detail in the question. With Defender enabled there is nothing extra to build, which satisfies "minimize administrative effort." Confidence is held at 88 (not higher) because of an important nuance several commenters (Luweho, mohamed1999) raise: Defender for App Service **alerts** on the dangling entry rather than auto-deleting it, so it does not literally "ensure the record is removed" — but it is unambiguously the closest fit among the four Defender plans, and Defender for DNS (the only tempting alternative) targets Azure name-resolution threats, not external-registrar CNAMEs.

More SC-100 practice questions