Microsoft SC-100 Online Practice Questions and Exam Preparation

Microsoft SC-100 Online Questions & Answers

• Question 111:

  You have an Azure subscription that contains multiple network security groups (NSGs), multiple virtual machines, and an Azure Bastion host named bastion1.

  Several NSGs contain rules that allow direct RDP access to the virtual machines by bypassing bastion1.

  You need to ensure that the virtual machines can be accessed only by using bastion1. The solution must prevent the use of NSG rules to bypass bastion1.

  What should you include in the solution?

  A. Azure Virtual Network Manager connectivity configurations
  B. Azure Virtual Network Manager security admin rules
  C. Azure Firewall application rules
  D. Azure Firewall network rules
  A. Azure Virtual Network Manager connectivity configurations

• Question 112:

  HOTSPOT

  Your on-premises network contains an Active Directory Domain Services (AD DS) domain with a group named Group1 and five servers running Windows Server. Each server hosts a standalone app used by the members of Group1.

  You have a Microsoft Entra tenant that syncs with the domain and plan to manage access to the apps by deploying Global Secure Access. A Conditional Access policy will be used to enforce security controls for all connections to the apps.

  You need to recommend a Global Secure Access app and Microsoft Entra private network connector configuration for the planned deployment. The solution must minimize administrative effort and ensure high availability.

  What is the minimum number of Global Secure Access apps and private network connectors you should recommend?

  To answer, select the appropriate options in the answer area.

  Each correct selection is worth one point.

  

  

• Question 113:

  You are designing a ransomware response plan that follows Microsoft Security Best Practices.

  You need to recommend a solution to limit the scope of damage of ransomware attacks without being locked out.

  What should you include in the recommendation?

  A. device compliance policies
  B. Privileged Access Workstations (PAWs)
  C. Customer Lockbox for Microsoft Azure
  D. emergency access accounts
  B. Privileged Access Workstations (PAWs)

  ---

  Explanation

  The use of privileged access workstations (PAWs) helps protect privileged users from internet attacks and threat vectors by providing a dedicated machine for sensitive tacks and separating these sensitive tasks and accounts from the daily use workstations.

  Customers with good least-privileged access policies such as using Privileged Access Workstations (PAW) devices were able to protect key resources even in the face of initial network access by the attackers.

  Incorrect:

  * Customer Lockbox

  Customer Lockbox ensures that no one at Microsoft can access customer content to perform a service operation without the customer's explicit approval. Customer Lockbox brings the customer into the approval workflow for requests to access their content. Occasionally, Microsoft engineers are involved during the support process to troubleshoot and fix customer-reported issues. In most cases, issues are fixed through extensive telemetry and debugging tools that Microsoft has in place for its services. However, there may be cases that require a Microsoft engineer to access customer content to determine the root cause and fix the issue. Customer Lockbox requires the engineer to request access from the customer as a final step in the approval workflow. This gives organizations the option to approve or deny these requests, which gives them direct control over whether a Microsoft engineer can access the organizations' end-user data.

  * emergency access accounts

  It is important that you prevent being accidentally locked out of your Azure Active Directory (Azure AD) organization because you can't sign in or activate another user's account as an administrator. You can mitigate the impact of accidental lack of administrative access by creating two or more emergency access accounts in your organization.

  Why use an emergency access account

  An organization might need to use an emergency access account in the following situations:

  The user accounts are federated, and federation is currently unavailable because of a cell-network break or an identity-provider outage. For example, if the identity provider host in your environment has gone down, users might be unable to sign in when Azure AD redirects to their identity provider.

  The administrators are registered through Azure AD Multi-Factor Authentication, and all their individual devices are unavailable or the service is unavailable. Users might be unable to complete Multi-Factor Authentication to activate a role. For example, a cell network outage is preventing them from answering phone calls or receiving text messages, the only two authentication mechanisms that they registered for their device. The person with the most recent Global Administrator access has left the organization. Azure AD prevents the last Global Administrator account from being deleted, but it does not prevent the account from being deleted or disabled on-premises. Either situation might make the organization unable to recover the account.

  Unforeseen circumstances such as a natural disaster emergency, during which a mobile phone or other networks might be unavailable.

  References:

  https://www.microsoft.com/en-us/security/blog/2021/01/19/using-zero-trust-principles-to-protect-against-sophisticated-attacks-like-solorigate/

  https://www.microsoft.com/en-us/securityengineering/osa/practices

  https://learn.microsoft.com/en-us/azure/active-directory/roles/security-emergency-access

• Question 114:

  HOTSPOT

  You have an on-premises datacenter named Site1.

  You have an Azure subscription that contains a virtual network named VNet1 and multiple Azure App Service apps. Site1 is connected to VNet1 by using a Site-to-Site (P2S) VPN connection. The apps are accessed by using public internet connections.

  You need to recommend a solution for providing secure access to the apps. The solution must meet the following requirements:

  1. Servers on Site1 must use a VPN connection to access the apps.

  2. Access to the apps must be restricted to specific servers on Site1.

  3. Security administrators for VNet1 must be able to control which servers can access the apps.

  4. Costs must be minimized.

  What should you include in the recommendation? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: Service endpoints

  Service endpoints

  Virtual network integration enables you to reach Azure services that are secured with service endpoints. To access a service endpoint-secured service, follow these steps:

  Configure virtual network integration with your web app to connect to a specific subnet for integration.

  Go to the destination service and configure service endpoints against the integration subnet.

  Note: Integrate your app with an Azure virtual network

  Access on-premises resources

  No extra configuration is required for the virtual network integration feature to reach through your virtual network to on-premises resources. You simply need to connect your virtual network to on-premises resources by using ExpressRoute or a site-to-site VPN.

  Incorrect:

  * Azure Private Link

  On-Premise Connectivity

  Service Endpoints - it is not easily restrict on-premise traffic. They can only be secured to Azure VNet.

  Private Links - Easily extensible for On-premises network traffic via ExpressRoute or VPN tunnels.

  Complexity

  Service Endpoint - It's much simpler to implement and significantly reduce complexity of your architecture design.

  Private Link - Need to manage another resource.

  Box 2: App Service Static IP address restrictions

  Security administrators for VNet1 must be able to control which servers can access the apps.

  Set up Azure App Service access restrictions

  By setting up access restrictions, you can define a priority-ordered allow/deny list that controls network access to your app. The list can include IP addresses or Azure Virtual Network subnets. When there are one or more entries, an implicit deny all exists at the end of the list.

  The ability to restrict access to your web app from an Azure virtual network is enabled by service endpoints. With service endpoints, you can restrict access to a multi-tenant service from selected subnets. It doesn't work to restrict traffic to apps that are hosted in an App Service Environment. If you're in an App Service Environment, you can control access to your app by applying IP address rules.

  Incorrect:

  * Network security groups (NSGs)

  When you use virtual network integration, you can use the following Azure networking features:

  - Network security groups (NSGs): You can block outbound traffic with an NSG that's placed on your integration subnet. The inbound rules don't apply because you can't use virtual network integration to provide inbound access to your app.

  - Route tables (UDRs): You can place a route table on the integration subnet to send outbound traffic where you want.

  - NAT gateway:

  References:

  https://learn.microsoft.com/en-us/azure/app-service/overview-vnet-integration

  https://learn.microsoft.com/en-us/azure/app-service/app-service-ip-restrictions

• Question 115:

  Your company develops several applications that are accessed as custom enterprise applications in Azure AD.

  You need to recommend a solution to prevent users on a specific list of countries from connecting to the applications.

  What should you include in the recommendation?

  A. activity policies in Microsoft Defender for Cloud Apps
  B. sign-in risk policies in Azure AD Identity Protection
  C. Azure AD Conditional Access policies
  D. device compliance policies in Microsoft Endpoint Manager
  E. user risk policies in Azure AD Identity Protection
  C. Azure AD Conditional Access policies

  ---

  Explanation

  To prevent users from specific countries from connecting to the applications accessed as custom enterprise applications in Azure AD, you should include the following recommendation:

  C. Azure AD Conditional Access policies Azure AD Conditional Access allows you to create policies that enforce access controls based on various conditions, including location-based conditions. You can create a Conditional Access policy that restricts access to these applications for users coming from specific countries or regions. This ensures that only users from allowed countries can connect to the applications while blocking access for users from restricted countries.

• Question 116:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  Your on-premises network contains an e-commerce web app that was developed in Angular and Node,js. The web app uses a MongoDB database.

  You plan to migrate the web app to Azure. The solution architecture team proposes the following architecture as an Azure landing zone.

  

  You need to provide recommendations to secure the connection between the web app and the database. The solution must follow the Zero Trust model.

  Solution: You recommend implementing Azure Front Door with Azure Web Application Firewall (WAF).

  Does this meet the goal?

  A. Yes
  B. No
  B. No

  ---

  Explanation

  Instead use solution: You recommend creating private endpoints for the web app and the database layer.

  Note:

  How to Use Azure Private Endpoints to Restrict Public Access to WebApps.

  As an Azure administrator or architect, you are sometimes asked the question: "How can we safely deploy internal business applications to Azure App Services?"

  These applications characteristically are:

  Not accessible from the public internet.

  Accessible from within the on-premises corporate network Accessible via an authorized VPN client from outside the corporate network.

  For such scenarios, we can use Azure Private Links, which enables private and secure access to Azure PaaS services over Azure Private Endpoints, along with the Site-to-Site VPN, Point-to-Site VPN, or the Express Route. Azure Private Endpoint is a read-only network interface service associated with the Azure PAAS Services. It allows you to bring deployed sites into your virtual network, limiting access to them at the network level.

  It uses one of the private IP addresses from your Azure VNet and associates it with the Azure App Services. These services are called Private Link resources. They can be Azure Storage, Azure Cosmos DB, SQL, App Services Web App, your own / partner owned services, Azure Backups, Event Grids, Azure Service Bus, or Azure Automations.

  References:

  https://www.varonis.com/blog/securing-access-azure-webapps

• Question 117:

  HOTSPOT

  You have an Azure SQL database named DB1 that contains customer information.

  A team of database administrators has full access to DB1.

  To address customer inquiries, operators in the customer service department use a custom web app named App1 to view the customer information.

  You need to design a security strategy for DB1. The solution must meet the following requirement:

  1. When the database administrators access DB1 by using SQL management tools, they must be prevented from viewing the content of the CreditCard attribute of each customer record.

  2. When the operators view customer records in App1, they must view only the last four digits of the CreditCard attribute.

  What should you include in the design? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 118:

  You have an Azure subscription. The subscription contains 200 virtual machines that run Windows Server 2022 and are protected by using Microsoft Defender for Servers Plan 1. You have an Amazon Web Services (AWS) subscription.

  To the AWS subscription, you plan to deploy 100 virtual machines that run Windows Server 2022.

  You need to recommend which agent to deploy to the virtual machines in the AWS subscription.

  The solution must meet the following requirements:

  1. Provide consistent workload protection across all cloud platforms.

  2. Minimize the number of agents deployed to each virtual machine.

  What should you recommend?

  A. the log Analytics agent
  B. the Azure Connected Machine agent
  C. the Microsoft Defender for Endpoint agent
  D. the Azure Monitor Agent
  C. the Microsoft Defender for Endpoint agent

• Question 119:

  You are designing security for an Azure landing zone.

  Your company identifies the following compliance and privacy requirements:

  1. Encrypt cardholder data by using encryption keys managed by the company.

  2. Encrypt insurance claim files by using encryption keys hosted on-premises.

  Which two configurations meet the compliance and privacy requirements? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. Store the cardholder data in an Azure SQL database that is encrypted by using Microsoft-managed keys.
  B. Store the insurance claim data in Azure Blob storage encrypted by using customer-provided keys.
  C. Store the cardholder data in an Azure SQL database that is encrypted by using keys stored in Azure Key Vault Managed HSM.
  D. Store the insurance claim data in Azure Files encrypted by using Azure Key Vault Managed HSM.
  B. Store the insurance claim data in Azure Blob storage encrypted by using customer-provided keys.
  C. Store the cardholder data in an Azure SQL database that is encrypted by using keys stored in Azure Key Vault Managed HSM.

  ---

  Explanation

  -C: Encrypt cardholder - "managed by company" but can be store in Azure Key Vault Managed HSM, (BYOK)

  -B :Encrypt insurance - "key hosted on prem" - only customer-provided key is store in customer store in on-prem, (HYOK). Take a look at table under link and read article.

  https://learn.microsoft.com/en-us/azure/storage/common/storage-service-encryption#about-encryption-key-management

  https://azure.microsoft.com/en-us/blog/customer-provided-keys-with-azure-storage-service-encryption/

• Question 120:

  HOTSPOT

  You have a Microsoft Entra tenant named contoso.com that syncs with an Active Directory Domain Services (AD DS) domain named corp.contoso.com.

  The domain contains 100 devices that have the following configurations:

  1. Hybrid joined

  2. Enrolled in Microsoft Intune.

  3. Disabled built-in local administrator account.

  4. Contain a local user account named User1 that is a member of the local administrators group.

  You need to recommend a solution that meets the following requirements:

  1. Ensures that the Directory Services Restore Mode (DSRM) credentials of each domain controller are backed up to the AD DS database

  2. Ensures that the password of User1 changes automatically every 60 days

  3. Ensures that the credentials of User1 are stored in an encrypted store

  4. Prevents the User1 password from being changed manually

  5. Whenever possible, stores all credentials in contoso.com

  6. Minimizes administrative effort.

  What should you include in the recommendation? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.