Microsoft SC-100 Online Practice Questions and Exam Preparation

Microsoft SC-100 Online Questions & Answers

• Question 1:

  HOTSPOT

  You have a Microsoft 365 E5 subscription. The subscription contains 1,000 devices that run Windows 11 Pro and are enrolled in Microsoft Intune. You need to recommend a Microsoft Defender for Cloud Apps solution that meets the following requirements:

  When a user downloads a file from Microsoft SharePoint Online, a label must be applied to the file in real time based on the file's contents.

  Only users that use Intune-compliant devices must be able to sign in to Dropbox.

  Which type of policy should you recommend for each requirement? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 2:

  You have an Azure subscription. You plan to deploy Azure Kubernetes Service (AKS) clusters that will be used to host web services. You need to recommend an ingress controller solution that will protect the hosted web services.

  What should you include in the recommendation?

  A. Azure Load Balancer
  B. Azure Application Gateway
  C. Azure Front Door
  D. Azure Firewall
  B. Azure Application Gateway

• Question 3:

  HOTSPOT

  You have a Microsoft 365 E5 subscription that uses Microsoft Teams.

  Your company has an investment department and a research department. Each department has a compliance team.

  You are designing a Microsoft Purview Information Barriers (IBs) solution to restrict communication between the departments.

  The solution must meet the following requirements:

  1. The employees in each department must only be able to communicate with the employees in their respective department.

  2. The employees on the compliance team of each department must be able to communicate with the employees on the compliance team of the other department.

  What is the minimum number of segments and IB policies required? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 4:

  You have legacy operational technology (OT) devices and IoT devices.

  You need to recommend best practices for applying Zero Trust principles to the OT and IoT devices based on the Microsoft Cybersecurity Reference Architectures (MCRA). The solution must minimize the risk of disrupting business operations.

  Which two security methodologies should you include in the recommendation? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. active scanning
  B. threat monitoring
  C. software patching
  D. passive traffic monitoring
  B. threat monitoring
  D. passive traffic monitoring

  ---

  Explanation

  From MCRA slide 17 (OT): "Many well-established IT security best practices like software patching aren't practical or fully effective in an OT environment, so they can only be selectively applied (or have a limited security effect). Basic security hygiene for OT starts with network isolation (including good maintenance/**monitoring** of that isolation boundaries), **threat monitoring**, and carefully managing vendor access risk."

• Question 5:

  You have an Azure subscription that contains a Microsoft Sentinel workspace.

  Your on-premises network contains firewalls that support forwarding event logs in the Common Event Format (CEF).

  There is no built-in Microsoft Sentinel connector for the firewalls.

  You need to recommend a solution to ingest events from the firewalls into Microsoft Sentinel.

  What should you include in the recommendation?

  A. an Azure logic app
  B. an on-premises Syslog server
  C. an on-premises data gateway
  D. Azure Data Factory
  B. an on-premises Syslog server

• Question 6:

  DRAG DROP

  You have a Microsoft 365 subscription that contains a Microsoft SharePoint Online site named Site1.

  You have a Conditional Access policy named Policy1 that only allows workload identities from trusted locations to access SharePoint Online.

  You plan to move all business-sensitive information to Site1.

  You need to ensure that CAPolicy1 applies to Site1 only.

  Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  NOTE: More than one order of answer choices is correct. You will receive credit for any of the correct orders you select.

  Select and Place:

  

  

• Question 7:

  You need to recommend a solution for securing the landing zones. The solution must meet the landing zone requirements and the business requirements.

  What should you configure for each landing zone?

  A. Azure DDoS Protection Standard
  B. an Azure Private DNS zone
  C. Microsoft Defender for Cloud
  D. an ExpressRoute gateway
  C. Microsoft Defender for Cloud

• Question 8:

  Your company is developing an invoicing application that will use Azure AD B2C. The application will be deployed as an App Service web app.

  You need to recommend a solution to the application development team to secure the application from identity-related attacks.

  Which two configurations should you recommend? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. Azure AD Conditional Access integration with user flows and custom policies
  B. smart account lockout in Azure AD B2C
  C. access packages in Identity Governance
  D. custom resource owner password credentials (ROPC) flows in Azure AD B2C
  A. Azure AD Conditional Access integration with user flows and custom policies
  B. smart account lockout in Azure AD B2C

  ---

  Explanation

  A: Add Conditional Access to user flows in Azure Active Directory B2C

  Conditional Access can be added to your Azure Active Directory B2C (Azure AD B2C) user flows or custom policies to manage risky sign-ins to your applications. Azure Active Directory (Azure AD) Conditional Access is the tool used by Azure AD B2C to bring signals together, make decisions, and enforce organizational policies.

  B: Mitigate credential attacks in Azure AD B2C with smart lockout Credential attacks lead to unauthorized access to resources. Passwords that are set by users are required to be reasonably complex. Azure AD B2C has mitigation techniques in place for credential attacks. Mitigation includes detection of brute-force credential attacks and dictionary credential attacks. By using various signals, Azure Active Directory B2C (Azure AD B2C) analyzes the integrity of requests. Azure AD B2C is designed to intelligently differentiate intended users from hackers and botnets.

  Incorrect:

  Not C: Identity Governance though useful, does not address this specific scenario: to secure the application from identity-related attack in an Azure AD B2C environment.

  Note: Identity Governance gives organizations the ability to do the following tasks across employees, business partners and vendors, and across services and applications both on-premises and in clouds:

  Govern the identity lifecycle Govern access lifecycle Secure privileged access for administration Specifically, it is intended to help organizations address these four key questions:

  Which users should have access to which resources?

  What are those users doing with that access?

  Are there effective organizational controls for managing access?

  Can auditors verify that the controls are working?

  Note: An access package enables you to do a one-time setup of resources and policies that automatically administers access for the life of the access package.

  Not D: In Azure Active Directory B2C (Azure AD B2C), the resource owner password credentials (ROPC) flow is an OAuth standard authentication flow. In this flow, an application, also known as the relying party, exchanges valid credentials for tokens. The credentials include a user ID and password.

  References:

  https://docs.microsoft.com/en-us/azure/active-directory-b2c/conditional-access-user-flow

  https://docs.microsoft.com/en-us/azure/active-directory/governance/identity-governance-overview

  https://docs.microsoft.com/en-us/azure/active-directory-b2c/threat-management

• Question 9:

  HOTSPOT

  You have an Azure subscription that contains multiple apps.

  The apps are deployed by using continuous integration and continuous delivery (CI/CD) pipelines in Azure DevOps.

  You need to integrate static application security testing (SAST) and security smoke testing into the pipelines based on Microsoft Cloud Adoption Framework for Azure principles.

  At which stage of the CI/CID process should each type of test be integrated? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 10:

  You have a Microsoft 365 subscription that syncs with Active Directory Domain Services (AD DS).

  You need to define the recovery steps for a ransomware attack that encrypted data in the subscription. The solution must follow Microsoft Security Best Practices.

  What is the first step in the recovery plan?

  A. From Microsoft Defender for Endpoint, perform a security scan.
  B. Recover files to a cleaned computer or device.
  C. Contact law enforcement.
  D. Disable Microsoft OneDrive sync and Exchange ActiveSync.
  D. Disable Microsoft OneDrive sync and Exchange ActiveSync.

  ---

  Explanation

  The following containment steps can be done concurrently as new threat vectors are discovered.

  Step 1: Assess the scope of the situation

  Which user accounts were compromised?

  Which devices are affected?

  Which applications are affected?

  Step 2: Preserve existing systems

  * Disable all privileged user accounts except for a small number of accounts used by your admins to assist in resetting the integrity of your AD DS infrastructure. If a user account is believed to be compromised, disable it immediately.

  * Isolate compromised systems from the network, but do not shut them off.

  * Etc.

  Note:

  With OneDrive, you can sync files between your computer and the cloud, so you can get to your files from anywhere - your computer, your mobile device, and even through the OneDrive website at OneDrive.com.

  ActiveSync is a client protocol that lets users synchronize their Exchange mailbox with a mobile device.

  References:

  https://learn.microsoft.com/en-us/security/compass/incident-response-playbook-dart-ransomware-approach