Microsoft Microsoft Certified: Cybersecurity Architect Expert SC-100 Questions & Answers

• Question 1:

  You need to recommend a solution to scan the application code. The solution must meet the application development requirements. What should you include in the recommendation?

  A. Azure Key Vault

  B. GitHub Advanced Security

  C. Application Insights in Azure Monitor

  D. Azure DevTest Labs

  Correct Answer: B

  Requirements. Application Development Requirements

  Fabrikam identifies the following requirements for application development:

  *

  All the application code must be stored in GitHub Enterprise.

  *

  All application code changes must be scanned for security vulnerabilities, including application code or configuration files that contain secrets in clear text. Scanning must be done at the time the code is pushed to a repository.

  A GitHub Advanced Security license provides the following additional features:

  Code scanning - Search for potential security vulnerabilities and coding errors in your code.

  Secret scanning - Detect secrets, for example keys and tokens, that have been checked into the repository. If push protection is enabled, also detects secrets when they are pushed to your repository.

  Dependency review - Show the full impact of changes to dependencies and see details of any vulnerable versions before you merge a pull request.

  Security overview - Review the security configuration and alerts for an organization and identify the repositories at greatest risk.

  Incorrect:

  Not C:

  Scenario: Azure DevTest labs will be used by developers for testing.

  Azure DevTest Labs is a service for easily creating, using, and managing infrastructure-as-a-service (IaaS) virtual machines (VMs) and platform-as-a-service (PaaS) environments in labs. Labs offer preconfigured bases and artifacts for

  creating VMs, and Azure Resource Manager (ARM) templates for creating environments like Azure Web Apps or SharePoint farms.

  Lab owners can create preconfigured VMs that have tools and software lab users need. Lab users can claim preconfigured VMs, or create and configure their own VMs and environments. Lab policies and other methods track and control lab

  usage and costs.

  Reference: https://docs.github.com/en/enterprise-cloud@latest/get-started/learning-about-github/about-github-advanced-security

• Question 2:

  To meet the application security requirements, which two authentication methods must the applications support? Each correct answer presents a complete solution.

  NOTE: Each correct selection is worth one point.

  A. Security Assertion Markup Language (SAML)

  B. NTLMv2

  C. certificate-based authentication

  D. Kerberos

  Correct Answer: AD

  A: SAML

  Litware identifies the following application security requirements:

  Identify internal applications that will support single sign-on (SSO) by using Azure AD Application Proxy.

  You can provide single sign-on (SSO) to on-premises applications that are secured with SAML authentication and provide remote access to these applications through Application Proxy. With SAML single sign-on, Azure Active Directory (Azure AD) authenticates to the application by using the user's Azure AD account.

  D: You can provide single sign-on for on-premises applications published through Application Proxy that are secured with integrated Windows authentication. These applications require a Kerberos ticket for access. Application Proxy uses Kerberos Constrained Delegation (KCD) to support these applications.

  Incorrect:

  Not C: Certificate. This is not a custom domain scenario!

  If you're using a custom domain, you also need to upload the TLS/SSL certificate for your application.

  To configure an on-premises app to use a custom domain, you need a verified Azure Active Directory custom domain, a PFX certificate for the custom domain, and an on-premises app to configure.

  Reference:

  https://docs.microsoft.com/en-us/azure/active-directory/app-proxy/application-proxy-configure-single-sign-on-on-premises-apps

  https://docs.microsoft.com/en-us/azure/active-directory/app-proxy/application-proxy-configure-single-sign-on-with-kcd

  https://docs.microsoft.com/en-us/azure/active-directory/app-proxy/application-proxy-configure-custom-domain

• Question 3:

  You need to design a strategy for securing the SharePoint Online and Exchange Online data. The solution must meet the application security requirements.

  Which two services should you leverage in the strategy? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. Azure AD Conditional Access

  B. access reviews in Azure AD

  C. Microsoft Defender for Cloud

  D. Microsoft Defender for Cloud Apps

  E. Microsoft Defender for Endpoint

  Correct Answer: BD

  Scenario: Litware identifies the following application security requirements:

  Monitor and control access to Microsoft SharePoint Online and Exchange Online data in real time.

  B: Azure Active Directory (Azure AD) access reviews enable organizations to efficiently manage group memberships, access to enterprise applications, and role assignments. User's access can be reviewed on a regular basis to make sure only the right people have continued access.

  D: The Defender for Cloud Apps framework Discover and control the use of Shadow IT: Identify the cloud apps, IaaS, and PaaS services used by your organization. Investigate usage patterns, assess the risk levels and business readiness of more than 25,000 SaaS apps against more than 80 risks. Start managing them to ensure security and compliance.

  Protect your sensitive information anywhere in the cloud: Understand, classify, and protect the exposure of sensitive information at rest. Leverage out-of-the box policies and automated processes to apply controls in real time across all your cloud apps.

  Etc.

  Reference: https://docs.microsoft.com/en-us/azure/active-directory/governance/access-reviews-overview https://docs.microsoft.com/en-us/defender-cloud-apps/what-is-defender-for-cloud-apps

• Question 4:

  You need to recommend a solution for securing the landing zones. The solution must meet the landing zone requirements and the business requirements. What should you configure for each landing zone?

  A. Azure DDoS Protection Standard

  B. an Azure Private DNS zone

  C. Microsoft Defender for Cloud

  D. an ExpressRoute gateway

  Correct Answer: D

  ExpressRoute provides direct connectivity to Azure cloud services and connecting Microsoft's global network. All transferred data is not encrypted, and do not go over the public Internet. VPN Gateway provides secured connectivity to Azure

  cloud services over public Internet.

  Note:

  Litware identifies the following landing zone requirements:

  1.

  Route all internet-bound traffic from landing zones through Azure Firewall in a dedicated Azure subscription.

  2.

  Provide a secure score scoped to the landing zone.

  3.

  Ensure that the Azure virtual machines in each landing zone communicate with Azure App Service web apps in the same zone over the Microsoft backbone network, rather than over public endpoints.

  4.

  Minimize the possibility of data exfiltration.

  5.

  Maximize network bandwidth.

  Litware identifies the following business requirements:

  1.

  Minimize any additional on-premises infrastructure.

  2.

  Minimize the operational costs associated with administrative overhead.

  Reference: https://medium.com/awesome-azure/azure-difference-between-azure-expressroute-and-azure-vpn-gateway-comparison-azure-hybrid-connectivity-5f7ce02044f3

• Question 5:

  You need to recommend a solution to meet the security requirements for the InfraSec group. What should you use to delegate the access?

  A. a subscription

  B. a custom role-based access control (RBAC) role

  C. a resource group

  D. a management group

  Correct Answer: B

  Scenario: Requirements. Security Requirements include:

  Only members of a group named InfraSec must be allowed to configure network security groups (NSGs) and instances of Azure Firewall, WAF, and Front Door in Sub1.

  If the Azure built-in roles don't meet the specific needs of your organization, you can create your own custom roles. Just like built-in roles, you can assign custom roles to users, groups, and service principals at management group (in preview

  only), subscription, and resource group scopes.

  Incorrect:

  Not D: Management groups are useful when you have multiple subscriptions. This is not what is addressed in this question.

  Scenario: Fabrikam has a single Azure subscription named Sub1.

  Note: If your organization has many Azure subscriptions, you may need a way to efficiently manage access, policies, and compliance for those subscriptions. Management groups provide a governance scope above subscriptions. You

  organize subscriptions into management groups the governance conditions you apply cascade by inheritance to all associated subscriptions.

  Management groups give you enterprise-grade management at scale no matter what type of subscriptions you might have. However, all subscriptions within a single management group must trust the same Azure Active Directory (Azure AD)

  tenant.

  Reference: https://docs.microsoft.com/en-us/azure/role-based-access-control/custom-roles

• Question 6:

  You need to recommend a solution to meet the security requirements for the virtual machines. What should you include in the recommendation?

  A. an Azure Bastion host

  B. a network security group (NSG)

  C. just-in-time (JIT) VM access

  D. Azure Virtual Desktop

  Correct Answer: D

  The security requirement this question wants us to meet is "The secure host must be provisioned from a custom operating system image." https://docs.microsoft.com/en-us/azure/virtual-desktop/set-up-golden-image

• Question 7:

  You need to recommend a solution to secure the MedicalHistory data in the ClaimsDetail table. The solution must meet the Contoso developer requirements.

  What should you include in the recommendation?

  A. row-level security (RLS)

  B. Transparent Data Encryption (TDE)

  C. Always Encrypted

  D. data classification

  E. dynamic data masking

  Correct Answer: C

  Anyone with admin privileges can see masked data. https://docs.microsoft.com/en-us/learn/modules/protect-data-transit-rest/4-explain-object-encryption-secure-enclaves

• Question 8:

  You have an on-premises datacenter and an Azure Kubernetes Service (AKS) cluster named AKS1.

  You need to restrict internet access to the public endpoint of AKS1. The solution must ensure that AKS1 can be accessed only from the public IP addresses associated with the on-premises datacenter.

  What should you use?

  A. a private endpoint

  B. a network security group (NSG)

  C. a service endpoint

  D. an authorized IP range

  Correct Answer: D

  Explanation:

  By default, the Kubernetes API server uses a public IP address and a fully qualified domain name (FQDN). You can limit access to the API server endpoint using authorized IP ranges. You can also create a fully private cluster to limit API

  server access to your virtual network.

  Reference:

  https://learn.microsoft.com/en-us/azure/aks/concepts-security

• Question 9:

  You have an Azure subscription. The subscription contains 50 virtual machines that run Windows Server and 50 virtual machines that run Linux.

  You need to perform vulnerability assessments on the virtual machines. The solution must meet the following requirements:

  Identify missing updates and insecure configurations. Use the Qualys engine.

  What should you use?

  A. Microsoft Defender for Servers

  B. Microsoft Defender Threat Intelligence (Defender TI)

  C. Microsoft Defender for Endpoint

  D. Microsoft Defender External Attack Surface Management (Defender EASM)

  Correct Answer: A

  Explanation:

  The vulnerability scanner included with Microsoft Defender for Cloud is powered by Qualys. Qualys' scanner is one of the leading tools for real-time identification of vulnerabilities. It's only available with Microsoft Defender for Servers.

  Note: Enable vulnerability scanning with the integrated Qualys scanner

  A core component of every cyber risk and security program is the identification and analysis of vulnerabilities. Defender for Cloud regularly checks your connected machines to ensure they're running vulnerability assessment tools.

  When a machine is found that doesn't have a vulnerability assessment solution deployed, Defender for Cloud generates the security recommendation: Machines should have a vulnerability assessment solution. Use this recommendation to

  deploy the vulnerability assessment solution to your Azure virtual machines and your Azure Arc-enabled hybrid machines.

  Defender for Cloud includes vulnerability scanning for your machines. You don't need a Qualys license or even a Qualys account - everything's handled seamlessly inside Defender for Cloud.

  Reference:

  https://learn.microsoft.com/en-us/azure/defender-for-cloud/deploy-vulnerability-assessment-vm

• Question 10:

  You have a Microsoft 365 subscription.

  You need to design a solution to block file downloads from Microsoft SharePoint Online by authenticated users on unmanaged devices.

  Which two services should you include in the solution? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. Azure AD Conditional Access

  B. Azure Data Catalog

  C. Microsoft Purview Information Protection

  D. Azure AD Application Proxy

  E. Microsoft Defender for Cloud Apps

  Correct Answer: AE

  Explanation:

  Blocking or limiting access on unmanaged devices relies on Azure AD conditional access policies.

  Create a block download policy for unmanaged devices

  Defender for Cloud Apps session policies allow you to restrict a session based on device state. To accomplish control of a session using its device as a condition, create both a conditional access policy AND a session policy.

  Incorrect:

  Not B: Azure Data Catalog is an enterprise-wide metadata catalog that makes data asset discovery straightforward. It's a fully-managed service that lets you — from analyst to data scientist to data developer — register, enrich, discover,

  understand, and consume data sources.

  Not C: Implement capabilities from Microsoft Purview Information Protection (formerly Microsoft Information Protection) to help you discover, classify, and protect sensitive information wherever it lives or travels.

  Reference:

  https://learn.microsoft.com/en-us/sharepoint/control-access-from-unmanaged-devices

  https://learn.microsoft.com/en-us/defender-cloud-apps/use-case-proxy-block-session-aad