Microsoft SC-100 Online Practice Questions and Exam Preparation

Microsoft SC-100 Online Questions & Answers

• Question 121:

  You have an Azure subscription that contains SQL Server on Azure virtual machines located in the West US region. The virtual machines are accessible only through private IP addresses.

  You plan to deploy Windows-based Azure App Service web apps in the East US region.

  You need to recommend a solution that provides the web apps access to the SQL Server databases.

  What should you include in the recommendation?

  A. an Azure VPN gateway
  B. a private endpoint
  C. a service endpoint
  D. an Azure Bastion host
  C. a service endpoint

  ---

  Explanation

  Virtual Network (VNet) service endpoint provides secure and direct connectivity to Azure services over an optimized route over the Azure backbone network. Endpoints allow you to secure your critical Azure service resources to only your virtual networks. Service Endpoints enables private IP addresses in the VNet to reach the endpoint of an Azure service without needing a public IP address on the VNet. Service endpoints are available for the following Azure services and regions. The Microsoft.* resource is in parenthesis. Enable this resource from the subnet side while configuring service endpoints for your service: Generally available

  Azure Storage (Microsoft.Storage): Generally available in all Azure regions.

  Azure Storage cross-region service endpoints (Microsoft.Storage.Global): Generally available in all Azure regions.

  *->

  Azure SQL Database (Microsoft.Sql): Generally available in all Azure regions.

  Etc.

  References:

  https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-service-endpoints-overview

• Question 122:

  You have a Microsoft Entra tenant named contoso.onmicrosoft.com and an Azure subscription named Sub1.

  You need to implement Microsoft Entra Verified ID by using Quick Verified ID setup.

  What should you create first?

  A. a security principal in contoso.onmicrosoft.com
  B. a custom domain in contoso.onmicrosoft.com
  C. a user-assigned managed identity in Sub1
  D. an Azure key vault in Sub1
  B. a custom domain in contoso.onmicrosoft.com

• Question 123:

  HOTSPOT

  Your company uses Microsoft Defender for Cloud and Microsoft Sentinel.

  The company is designing an application that will have the architecture shown in the following exhibit.

  

  You are designing a logging and auditing solution for the proposed architecture. The solution must meet the following requirements:

  1. Integrate Azure Web Application Firewall (WAF) logs with Microsoft Sentinel.

  2. Use Defender for Cloud to review alerts from the virtual machines.

  What should you include in the solution? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: Data connectors

  Microsoft Sentinel connector streams security alerts from Microsoft Defender for Cloud into Microsoft Sentinel.

  Launch a WAF workbook (see step 7 below)

  The WAF workbook works for all Azure Front Door, Application Gateway, and CDN WAFs. Before connecting the data from these resources, log analytics must be enabled on your resource.

  To enable log analytics for each resource, go to your individual Azure Front Door, Application Gateway, or CDN resource:

  1. Select Diagnostic settings.

  2. Select + Add diagnostic setting.

  3. In the Diagnostic setting page (details skipped) 4. On the Azure home page, type Microsoft Sentinel in the search bar and select the Microsoft Sentinel resource.

  5. Select an already active workspace or create a new workspace.

  6. On the left side panel under Configuration select Data Connectors.

  7. Search for Azure web application firewall and select Azure web application firewall (WAF). Select Open connector page on the bottom right.

  8. Follow the instructions under Configuration for each WAF resource that you want to have log analytic data for if you haven't done so previously.

  9. Once finished configuring individual WAF resources, select the Next steps tab. Select one of the recommended workbooks. This workbook will use all log analytic data that was enabled previously. A working WAF workbook should now exist for your WAF resources.

  Box 2: The Log Analytics agent

  Use the Log Analytics agent to integrate with Microsoft Defender for cloud.

  

  The Log Analytics agent is required for solutions, VM insights, and other services such as Microsoft Defender for Cloud.

  Note: The Log Analytics agent in Azure Monitor can also be used to collect monitoring data from the guest operating system of virtual machines. You may choose to use either or both depending on your requirements.

  Azure Log Analytics agent

  Use Defender for Cloud to review alerts from the virtual machines.

  The Azure Log Analytics agent collects telemetry from Windows and Linux virtual machines in any cloud, on-premises machines, and those monitored by System Center Operations Manager and sends collected data to your Log Analytics workspace in Azure Monitor.

  Incorrect:

  The Azure Diagnostics extension does not integrate with Microsoft Defender for Cloud.

  References:

  https://docs.microsoft.com/en-us/azure/web-application-firewall/waf-sentinel

  https://docs.microsoft.com/en-us/azure/defender-for-cloud/enable-data-collection

  https://docs.microsoft.com/en-us/azure/azure-monitor/agents/agents-overview

• Question 124:

  You have an Azure subscription that contains 15 custom apps. The source files for the apps are stored in Git repositories. The apps are deployed by using Azure DevOps.

  You need to recommend a DevSecOps solution to implement static application security testing (SAST) of the app code to identify hard-coded secrets.

  What should you include in the recommendation?

  A. GitHub Advanced Security
  B. Microsoft Defender for Key Vault
  C. Microsoft Dev Box
  D. Microsoft Defender for Cloud DevOps security
  D. Microsoft Defender for Cloud DevOps security

• Question 125:

  HOTSPOT

  You plan to deploy an Azure API Management solution that will enable different groups of developers to access different sets of APIs at random times and rates.

  You need to recommend the pricing tier that should be purchased and the scope at which the rate limit policies should be applied. The solution must meet the following requirements:

  1. Ensure that each group of developers can access only specific sets of APIs.

  2. Ensure that each set of APIs can be configured with specific rate limits.

  3. Minimize development and administrative effort and costs.

  What should you recommend? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 126:

  You have a multicloud environment that contains Azure, Amazon Web Services (AWS), and Google Cloud Platform (GCP) subscriptions.

  You need to discover and review role assignments across the subscriptions.

  What should you use?

  A. Microsoft Entra Permissions Management
  B. Microsoft Defender for Identity
  C. Azure Lighthouse
  D. Microsoft Entra ID Governance
  C. Azure Lighthouse

• Question 127:

  You have an Azure subscription that is used as an Azure landing zone for an application. You need to evaluate the security posture of all the workloads in the landing zone.

  What should you do first?

  A. Configure Continuous Integration/Continuous Deployment (CI/CD) vulnerability scanning.
  B. Obtain Azure AD Premium Plan 2 licenses.
  C. Add Microsoft Sentinel data connectors.
  D. Enable the Defender plan for all resource types in Microsoft Defender for Cloud.
  D. Enable the Defender plan for all resource types in Microsoft Defender for Cloud.

  ---

  Explanation

  You can evaluate security postures by using Microsoft Defender for Cloud.

  Defender for Cloud continually assesses your resources, subscriptions, and organization for security issues. It then aggregates all the findings into a single score so that you can tell, at a glance, your current security situation: the higher the score, the lower the identified risk level.

  

  Note: Security in the Azure landing zone accelerator Security is at the core of the Azure landing zone accelerator. As part of the implementation, many tools and controls are deployed to help organizations quickly achieve a security baseline.

  For example, the following are included:

  Tools:

  Microsoft Defender for Cloud, standard or free tier

  Microsoft Sentinel

  Azure DDoS standard protection plan (optional)

  Azure Firewall

  Web Application Firewall (WAF)

  Privileged Identity Management (PIM)

  Incorrect:

  Not C: Microsoft Sentinel uses data from Microsoft Defender for Cloud, so would need setup Defender for Cloud first.

  References:

  https://learn.microsoft.com/en-us/training/modules/evaluate-security-posture-recommend-technical-strategies-to-manage-risk/3-postures-use-microsoft-defender-for-cloud

  https://learn.microsoft.com/en-us/training/modules/evaluate-security-posture-recommend-technical-strategies-to-manage-risk/5-design-security-for-azure-landing-zone

• Question 128:

  HOTSPOT

  You are creating the security recommendations for an Azure App Service web app named App1.

  App1 has the following specifications:

  1. Users will request access to App1 through the My Apps portal. A human resources manager will approve the requests.

  2. Users will authenticate by using Azure Active Directory (Azure AD) user accounts.

  You need to recommend an access security architecture for App1.

  What should you include in the recommendation? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

  

  

• Question 129:

  You are evaluating an Azure environment for compliance.

  You need to design an Azure Policy implementation that can be used to evaluate compliance without changing any resources.

  Which effect should you use in Azure Policy?

  A. Deny
  B. Modify
  C. Append
  D. Disabled
  D. Disabled

  ---

  Explanation

  This effect is useful for testing situations or for when the policy definition has parameterized the effect. This flexibility makes it possible to disable a single assignment instead of disabling all of that policy's assignments.

  An alternative to the Disabled effect is enforcementMode, which is set on the policy assignment. When enforcementMode is Disabled, resources are still evaluated.

  Incorrect:

  Not A: Deny is used to prevent a resource request that doesn't match defined standards through a policy definition and fails the request.

  Not B: Modify evaluates before the request gets processed by a Resource Provider during the creation or updating of a resource. The Modify operations are applied to the request content when the if condition of the policy rule is met. Each Modify operation can specify a condition that determines when it's applied. Operations with conditions that are evaluated to false are skipped.

  Not C: Append is used to add additional fields to the requested resource during creation or update.

  References:

  https://docs.microsoft.com/en-us/azure/governance/policy/concepts/effects

• Question 130:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Azure subscription that has Microsoft Defender for Cloud enabled.

  You are evaluating the Azure Security Benchmark V3 report.

  In the Secure management ports controls, you discover that you have 0 out of a potential 8 points.

  You need to recommend configurations to increase the score of the Secure management ports controls.

  Solution: You recommend enabling the VMAccess extension on all virtual machines.

  Does this meet the goal?

  A. Yes
  B. No
  B. No

  ---

  Explanation

  Instead: You recommend enabling just-in-time (JIT) VM access on all virtual machines.

  Note:

  Secure management ports - Brute force attacks often target management ports. Use these recommendations to reduce your exposure with tools like just-in-time VM access and network security groups.

  Recommendations:

  - Internet-facing virtual machines should be protected with network security groups

  - Management ports of virtual machines should be protected with just-in-time network access control

  - Management ports should be closed on your virtual machines

  References:

  https://docs.microsoft.com/en-us/azure/defender-for-cloud/secure-score-security-controls