Microsoft SC-100 Online Practice Questions and Exam Preparation

Microsoft SC-100 Online Questions & Answers

• Question 101:

  DRAG DROP

  You have a hybrid Azure AD tenant that has pass-through authentication enabled.

  You are designing an identity security strategy.

  You need to minimize the impact of brute force password attacks and leaked credentials of hybrid identities.

  What should you include in the design?

  To answer, drag the appropriate features to the correct requirements. Each feature may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

  NOTE: Each correct selection is worth one point.

  Select and Place:

  

  

• Question 102:

  Your company has a hybrid cloud infrastructure that contains an on-premises Active Directory Domain Services (AD DS) forest, a Microsoft 365 subscription, and an Azure subscription.

  The company's on-premises network contains internal web apps that use Kerberos authentication. Currently, the web apps are accessible only from the network.

  You have remote users who have personal devices that run Windows 11.

  You need to recommend a solution to provide the remote users with the ability to access the web apps. The solution must meet the following requirements:

  1. Prevent the remote users from accessing any other resources on the network.

  2. Support Azure Active Directory (Azure AD) Conditional Access.

  3. Simplify the end-user experience.

  What should you include in the recommendation?

  A. Microsoft Entra Application Proxy
  B. web content filtering in Microsoft Defender for Endpoint
  C. Microsoft Tunnel for Microsoft Intune
  D. Azure Virtual WAN
  A. Microsoft Entra Application Proxy

  ---

  Explanation

  Azure Active Directory's Application Proxy provides secure remote access to on-premises web applications. After a single sign-on to Azure AD, users can access both cloud and on-premises applications through an external URL or an internal application portal.

  Azure AD Application Proxy is:

  Secure. On-premises applications can use Azure's authorization controls and security analytics. For example, on-premises applications can use Conditional Access and two-step verification. Application Proxy doesn't require you to open inbound connections through your firewall.

  Simple to use. Users can access your on-premises applications the same way they access Microsoft 365 and other SaaS apps integrated with Azure AD. You don't need to change or update your applications to work with Application Proxy.

  Incorrect:

  Not D: Azure Virtual WAN

  Azure Virtual WAN is for end users, not for applications.

  Note: Azure Virtual WAN is a networking service that brings many networking, security, and routing functionalities together to provide a single operational interface. Some of the main features include:

  Branch connectivity (via connectivity automation from Virtual WAN Partner devices such as SD-WAN or VPN CPE).

  Site-to-site VPN connectivity.

  Remote user VPN connectivity (point-to-site).

  Private connectivity (ExpressRoute).

  Intra-cloud connectivity (transitive connectivity for virtual networks).

  VPN ExpressRoute inter-connectivity.

  Routing, Azure Firewall, and encryption for private connectivity.

  References:

  https://docs.microsoft.com/en-us/azure/active-directory/app-proxy/application-proxy

• Question 103:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Azure subscription that has Microsoft Defender for Cloud enabled.

  You are evaluating the Azure Security Benchmark V3 report.

  In the Secure management ports controls, you discover that you have 0 out of a potential 8 points.

  You need to recommend configurations to increase the score of the Secure management ports controls.

  Solution: You recommend enabling adaptive network hardening.

  Does this meet the goal?

  A. Yes
  B. No
  B. No

  ---

  Explanation

  Instead: You recommend enabling just-in-time (JIT) VM access on all virtual machines.

  Note:

  Secure management ports - Brute force attacks often target management ports. Use these recommendations to reduce your exposure with tools like just-in-time VM access and network security groups.

  Recommendations:

  - Internet-facing virtual machines should be protected with network security groups

  - Management ports of virtual machines should be protected with just-in-time network access control

  - Management ports should be closed on your virtual machines

  References:

  https://docs.microsoft.com/en-us/azure/defender-for-cloud/secure-score-security-controls

• Question 104:

  HOTSPOT

  You have an on-premises datacenter. The datacenter contains a server named Server1 that runs Windows Server 2022 and a firewall that prevents Server1 from connecting to the internet.

  You have an Azure subscription named Sub1.

  You need to recommend a resiliency strategy for Server1 that incorporates a backup plan to transfer the data from Server1 to Sub1.

  What should you include in the recommendation? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 105:

  You have a customer that has a Microsoft 365 subscription and an Azure subscription.

  The customer has devices that run either Windows, iOS, Android, or macOS. The Windows devices are deployed on-premises and in Azure.

  You need to design a security solution to assess whether all the devices meet the customer's compliance rules.

  What should you include in the solution?

  A. Microsoft Defender for Endpoint
  B. Microsoft Endpoint Manager
  C. Microsoft Information Protection
  D. Microsoft Sentinel
  B. Microsoft Endpoint Manager

  ---

  Explanation

  Microsoft Endpoint Manager includes Microsoft Intune.

  Device compliance policies are a key feature when using Intune to protect your organization's resources. In Intune, you can create rules and settings that devices must meet to be considered compliant, such as a minimum OS version.

  Microsoft Endpoint Manager helps deliver the modern workplace and modern management to keep your data secure, in the cloud and on-premises. Endpoint Manager includes the services and tools you use to manage and monitor mobile devices, desktop computers, virtual machines, embedded devices, and servers.

  Endpoint Manager combines services you may know and already be using, including Microsoft Intune, Configuration Manager, Desktop Analytics, co-management, and Windows Autopilot. These services are part of the Microsoft 365 stack to help secure access, protect data, respond to risk, and manage risk.

  Note: Microsoft Defender for Endpoint Plan 2 protects your Windows and Linux machines whether they're hosted in Azure, hybrid clouds (on-premises), or multicloud.

  Microsoft Defender for Endpoint on iOS offers protection against phishing and unsafe network connections from websites, emails, and apps.

  Microsoft Defender for Endpoint on Android supports installation on both modes of enrolled devices - the legacy Device Administrator and Android Enterprise modes. Currently, Personally-owned devices with work profile and Corporate-owned fully managed user device enrollments are supported in Android Enterprise.

  References:

  https://docs.microsoft.com/en-us/mem/endpoint-manager-overview

  https://docs.microsoft.com/en-us/azure/defender-for-cloud/integration-defender-for-endpoint

• Question 106:

  HOTSPOT

  Your company has an Azure App Service plan that is used to deploy containerized web apps.

  You are designing a secure DevOps strategy for deploying the web apps to the App Service plan.

  You need to recommend a strategy to integrate code scanning tools into a secure software development lifecycle. The code must be scanned during the following two phases:

  1. Uploading the code to repositories

  2. Building containers

  Where should you integrate code scanning for each phase? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: GitHub Enterprise

  A GitHub Advanced Security license provides the following additional features: Code scanning - Search for potential security vulnerabilities and coding errors in your code.

  Secret scanning - Detect secrets, for example keys and tokens, that have been checked into the repository. If push protection is enabled, also detects secrets when they are pushed to your repository.

  Etc.

  Code scanning is a feature that you use to analyze the code in a GitHub repository to find security vulnerabilities and coding errors. Any problems identified by the analysis are shown in GitHub Enterprise Cloud.

  Box 2: Azure Pipelines

  Building Containers with Azure DevOps using DevTest Pattern with Azure Pipelines

  The pattern enabled as to build container for development, testing and releasing the container for further reuse (production ready).

  Azure Pipelines integrates metadata tracing into your container images, including commit hashes and issue numbers from Azure Boards, so that you can inspect your applications with confidence.

  Incorrect:

  * Not Azure Boards: Azure Boards provides software development teams with the interactive and customizable tools they need to manage their software projects. It provides a rich set of capabilities including native support for Agile, Scrum, and Kanban processes, calendar views, configurable dashboards, and integrated reporting.

  * Not Microsoft Defender for Cloud

  Microsoft Defender for Containers is the cloud-native solution that is used to secure your containers so you can improve, monitor, and maintain the security of your clusters, containers, and their applications.

  You cannot use Microsoft Defender for Cloud to scan code, it scans images.

  References:

  https://docs.github.com/en/enterprise-cloud@latest/get-started/learning-about-github/about-github-advanced-security

  https://microsoft.github.io/code-with-engineering-playbook/automated-testing/tech-specific-samples/azdo-container-dev-test-release/

• Question 107:

  You have a multicloud environment that contains an Azure subscription, an Amazon Web Services (AWS) subscription, and a Google Cloud Platform (GCP) subscription.

  You plan to assess data security and compliance.

  You need to design a Compliance Manager solution that meets the following requirements: Provides recommended improvement actions that include detailed implementation guidance

  Automatically monitors regulatory compliance

  Minimizes administrative effort

  What should you include in the solution?

  A. Microsoft Defender for Cloud
  B. Microsoft Defender for Cloud Apps
  C. Microsoft Sentinel
  D. Compliance Manager connectors
  A. Microsoft Defender for Cloud

• Question 108:

  You have 10 Azure subscriptions that contain 100 role-based access control (RBAC) role assignments.

  You plan to consolidate the role assignments.

  You need to recommend a solution to identify which role assignments were NOT used during the last 90 days. The solution must minimize administrative effort.

  What should you include in the recommendation?

  A. Microsoft Defender for Cloud
  B. Microsoft Entra access reviews
  C. Microsoft Entra Privileged Identity Management (PIM)
  D. Microsoft Entra Permissions Management
  D. Microsoft Entra Permissions Management

• Question 109:

  HOTSPOT

  You have multiple on-premises Hyper-V hosts running virtual machines that use Windows Server 2022.

  You have an Azure subscription and need to recommend a solution to collect Security event logs from the virtual machines using Microsoft Sentinel. The solution must meet the following requirements:

  1. Leverage the Windows Security Events via the Azure Monitor Agent (AMA) data connector.

  2. Ensure that only specific events are collected.

  3. Minimize costs.

  What should you recommend? To answer, select the appropriate options in the answer area.

  Each correct selection is worth one port.

  

  

  ---

  Box 1: Azure Monitor data collection rules (DCRs)

  In Azure, deploy

  Windows Security Events via AMA connector for Microsoft Sentinel You can stream all security events from the Windows machines connected to your Microsoft Sentinel workspace using the Windows agent. This connection enables you to view dashboards, create custom alerts, and improve investigation. This gives you more insight into your organization's network and improves your security operation capabilities.

  

  Create a data collection rule

  You can define a data collection rule to send data from multiple machines to multiple Log Analytics workspaces, including workspaces in a different region or tenant. Create the data collection rule in the same region as your Log Analytics workspace. You can send Windows event and Syslog data to Azure Monitor Logs only. You can send performance counters to both Azure Monitor Metrics and Azure Monitor Logs.

  Box 2: The Azure Connected Machine agent for Azure Arc-enabled servers On the virtual machines, install

  The Azure Connected Machine agent enables you to manage your Windows and Linux machines hosted outside of Azure on your corporate network or other cloud providers.

  References:

  https://learn.microsoft.com/en-us/azure/azure-monitor/agents/data-collection-rule-azure-monitor-agent

  https://learn.microsoft.com/en-us/windows-server/administration/azure

  https://learn.microsoft.com/en-us/azure/azure-arc/servers/agent-overview

• Question 110:

  You have an Azure AD tenant that syncs with an Active Directory Domain Services (AD DS) domain.

  You are designing an Azure DevOps solution to deploy applications to an Azure subscription by using continuous integration and continuous deployment (CI/CD) pipelines.

  You need to recommend which types of identities to use for the deployment credentials of the service connection.

  The solution must follow DevSecOps best practices from the Microsoft Cloud Adoption Framework for Azure.

  What should you recommend?

  A. a managed identity in Azure
  B. an Azure AD user account that has role assignments in Azure AD Privileged Identity Management (PIM)
  C. a group managed service account (gMSA)
  D. an Azure AD user account that has a password stored in Azure Key Vault
  A. a managed identity in Azure

  ---

  Explanation

  In the context of deploying applications using CI/CD pipelines in Azure and following DevSecOps best practices from the Microsoft Cloud Adoption Framework for Azure, using managed identities is often recommended. Managed identities provide an identity for applications to use when connecting to resources that support Azure AD authentication, without needing to manage credentials like usernames and passwords.

  A managed identity in Azure is automatically managed by Azure and does not require you to provision or rotate secrets. This aligns with the principles of DevSecOps, where security is integrated into the development process, and the management of secrets and credentials is handled securely and automatically.

  So, the correct recommendation for this scenario would be:

  A. a managed identity in Azure.