Microsoft SC-100 Online Practice Questions and Exam Preparation

Microsoft SC-100 Online Questions & Answers

• Question 131:

  HOTSPOT

  You have an Azure subscription containing an Azure Bastion host and 100 virtual machines running Windows Server 2022. The virtual machines have Microsoft Defender for Servers Plan 2 enabled.

  You need to recommend a security solution for the virtual machines that meets the following requirements:

  1. Administrators must request RDP access to the virtual machines via the Azure portal.

  2. Remote Desktop sessions must be limited to a maximum of three hours.

  3. Agentless scanning must be scheduled to run on each virtual machine.

  What should you recommend using?

  To answer, select the appropriate options in the answer area.Each correct selection is worth one point.

  

  

  ---

  Box 1: Just-in-time (JIT) VM access Administrators must request RDP access to the virtual machines by using the Azure portal. Remote Desktop sessions must be limited to a maximum of three hours.

  From Defender for Cloud, you can enable and configure the JIT VM access.

  1. Open the Workload protections and, in the advanced protections, select Just-in-time VM access.

  2. In the Not configured virtual machines tab, mark the VMs to protect with JIT and select Enable JIT on VMs.

  The JIT VM access page opens listing the ports that Defender for Cloud recommends protecting:

  22 - SSH

  3389 - RDP

  5985 - WinRM

  5986 - WinRM To customize the JIT access:

  3. Select Add.

  4. Select one of the ports in the list to edit it or enter other ports. For each port, you can set the:

  Protocol - The protocol that is allowed on this port when a request is approved Allowed source IPs - The IP ranges that are allowed on this port when a request is approved *-> Maximum request time - The maximum time window during which a specific port can be opened Select OK.

  5. To save the port configuration, select Save.

  When a VM has a JIT enabled, you have to request access to connect to it. You can request access in any of the supported ways, regardless of how you enabled JIT.

  1. From the Just-in-time VM access page, select the Configured tab.

  2. Select the VMs you want to access:

  3. The icon in the Connection Details column indicates whether JIT is enabled on the network security group or firewall. If it's enabled on both, only the firewall icon appears.

  4. The Connection Details column shows the user and ports that can access the VM.

  5. Select Request access. The Request access window opens.

  6. Under Request access, select the ports that you want to open for each VM, the source IP addresses that you want the port opened on, and the time window to open the ports.

  7. Select Open ports.

  Box 2: Microsoft Defender Vulnerability Management

  Agentless scanning must be scheduled to run on each virtual machine.

  Defender for Cloud, Enable agentless scanning for VMs Defender for Cloud already supports different agent-based vulnerability scans, including Microsoft Defender Vulnerability Management (MDVM), BYOL. Agentless scanning extends the visibility of Defender for Cloud to reach more devices.

  When you enable agentless vulnerability assessment:

  * If you have no existing integrated vulnerability assessment solutions enabled on any of your VMs on your subscription, Defender for Cloud automatically enables MDVM by default.

  *-> If you select Microsoft Defender Vulnerability Management as part of an integration with Microsoft Defender for Endpoint, Defender for Cloud shows a unified and consolidated view that optimizes coverage and freshness.

  * Machines covered by just one of the sources (Defender Vulnerability Management or agentless) show the results from that source.

  Incorrect:

  * Qualys scanner

  Defender for Cloud, Enable vulnerability scanning with the integrated Qualys scanner (deprecated) This plan is deprecated as of May 1, 2024.

  References:

  https://learn.microsoft.com/en-us/azure/defender-for-cloud/just-in-time-access-usage

  https://learn.microsoft.com/en-us/azure/defender-for-cloud/enable-agentless-scanning-vms

• Question 132:

  Your company plans to apply the Zero Trust Rapid Modernization Plan (RaMP) to its IT environment.

  You need to recommend the top three modernization areas to prioritize as part of the plan.

  Which three areas should you recommend based on RaMP? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. data, compliance, and governance
  B. infrastructure and development
  C. user access and productivity
  D. operational technology (OT) and IoT
  E. modern security operations
  A. data, compliance, and governance
  C. user access and productivity
  E. modern security operations

  ---

  Explanation

  RaMP initiatives for Zero Trust

  To rapidly adopt Zero Trust in your organization, RaMP offers technical deployment guidance organized in these initiatives.

  Critical security modernization initiatives:

  (C) User access and productivity 1. Explicitly validate trust for all access requests Identities Endpoints (devices) Apps Network

  (A) Data, compliance, and governance

  2. Ransomware recovery readiness

  3. Data

  (E) Modernize security operations

  4. Streamline response

  5. Unify visibility

  6. reduce manual effort

  Incorrect:

  As needed

  Additional initiatives based on Operational Technology (OT) or IoT usage, on-premises and cloud adoption, and security for in-house app development:

  * (not D) OT and Industrial IoT Discover Protect Monitor

  * Datacenter & DevOps Security

  Security Hygiene

  Reduce Legacy Risk

  DevOps Integration

  Microsegmentation

  References:

  https://learn.microsoft.com/en-us/security/zero-trust/zero-trust-ramp-overview

• Question 133:

  DRAG DROP

  You have an Azure subscription that contains a resources group named RG1. RG1 contains multiple Azure Files shares.

  You need to recommend a solution to deploy a backup solution for the shares. The solution must meet the following requirements:

  1. Prevent the deletion of backups and the vault used to store the backups.

  2. Prevent privilege escalation attacks against the backup solution.

  3. Prevent the modification of the backup retention period.

  Which three actions should you recommend be performed in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  

• Question 134:

  You have an Azure subscription that contains the Azure Virtual Machine Scale Sets shown in the following table.

  

  You are evaluating Azure Update Manager and automatic virtual machine guest patching.

  Which virtual machine scale sets will automatic guest patching support?

  A. VMSS1 only
  B. VMSS2 only
  C. VMSS1 and VMSS3 only
  D. VMSS2 and VMSS4 only
  E. VMSS1, VMSS2, VMSS3, and VMSS4
  C. VMSS1 and VMSS3 only

• Question 135:

  You are designing a ransomware mitigation strategy.

  You perform a ransomware risk assessment and identify business-critical assets.

  You need to recommend a solution to mitigate ransomware threats. The solution must follow Microsoft security best practices.

  Which two actions should you include in the recommendation? Each correct answer presents a complete solution.

  NOTE: Each correct answer is worth one point.

  A. Enable firewall logging for auditing, without restricting inbound or outbound traffic.
  B. Use extended patching cycles to reduce the risk of update-related service disruptions.
  C. Implement immutable, offline backups that have restricted access and test restore procedures regularly.
  D. Deploy Privileged Identity Management (PIM) that uses just-in-time (JIT) access and approval workflows.
  C. Implement immutable, offline backups that have restricted access and test restore procedures regularly.
  D. Deploy Privileged Identity Management (PIM) that uses just-in-time (JIT) access and approval workflows.

• Question 136:

  HOTSPOT

  You are designing security for a runbook in an Azure Automation account. The runbook will copy data to Azure Data Lake Storage Gen2.

  You need to recommend a solution to secure the components of the copy process.

  What should you include in the recommendation for each component? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Data Security = Access Keys stored in Azure Key Vault Network access control = Azure Private Link with network service tags

  https://docs.microsoft.com/en-us/azure/automation/automation-security-guidelines#data-security

• Question 137:

  You are designing the security standards for a new Azure environment.

  You need to design a privileged identity strategy based on the Zero Trust model.

  Which framework should you follow to create the design?

  A. Enhanced Security Admin Environment (ESAE)
  B. Microsoft Security Development Lifecycle (SDL)
  C. Rapid Modernization Plan (RaMP)
  D. Microsoft Operational Security Assurance (OSA)
  C. Rapid Modernization Plan (RaMP)

  ---

  Explanation

  RaMP initiatives for Zero Trust.

  To rapidly adopt Zero Trust in your organization, RaMP offers technical deployment guidance organized in these initiatives.

  In particular, meet these deployment objectives to protect your privileged identities with Zero Trust.

  1. Deploy secured privileged access to protect administrative user accounts.

  2. Deploy Azure AD Privileged Identity Management (PIM) for a time-bound, just-in-time approval process for the use of privileged user accounts.

  Note 1: RaMP guidance takes a project management and checklist approach:

  * User access and productivity

  1. Explicitly validate trust for all access requests

  Identities

  Endpoints (devices)

  Apps

  Network

  * Data, compliance, and governance

  2. Ransomware recovery readiness

  3. Data

  * Modernize security operations

  4. Streamline response

  5. Unify visibility

  6. Reduce manual effort

  Note 2: As an alternative to deployment guidance that provides detailed configuration steps for each of the technology pillars being protected by Zero Trust principles, Rapid Modernization Plan (RaMP) guidance is based on initiatives and gives you a set of deployment paths to more quickly implement key layers of protection.

  By providing a suggested mapping of key stakeholders, implementers, and their accountabilities, you can more quickly organize an internal project and define the tasks and owners to drive them to conclusion. By providing a checklist of deployment objectives and implementation steps, you can see the bigger picture of infrastructure requirements and track your progress.

  Incorrect:

  Not B: Enhanced Security Admin Environment (ESAE)

  The Enhanced Security Admin Environment (ESAE) architecture (often referred to as red forest, admin forest, or hardened forest) is an approach to provide a secure environment for Windows Server Active Directory (AD) administrators.

  Microsoft's recommendation to use this architectural pattern has been replaced by the modern privileged access strategy and rapid modernization plan (RAMP) guidance as the default recommended approach for securing privileged users.

  The ESAE hardened administrative forest pattern (on-prem or cloud-based) is now considered a custom configuration suitable only for exception cases listed below.

  What are the valid ESAE use cases?

  While not a mainstream recommendation, this architectural pattern is valid in a limited set of scenarios.

  In these exception cases, the organization must accept the increased technical complexity and operational costs of the solution. The organization must have a sophisticated security program to measure risk, monitor risk, and apply consistent operational rigor to the usage and maintenance of the ESAE implementation.

  Example scenarios include:

  Isolated on-premises environments - where cloud services are unavailable such as offline research laboratories, critical infrastructure or utilities, disconnected operational technology (OT) environments such as Supervisory control and data acquisition (SCADA) / Industrial Control Systems (ICS), and public sector customers that are fully reliant on on-premises technology. Highly regulated environments ?industry or government regulation may specifically require an administrative forest configuration. High level security assurance is mandated - organizations with low risk tolerance that are willing to accept the increased complexity and operational cost of the solution.

  References:

  https://docs.microsoft.com/en-us/security/zero-trust/zero-trust-ramp-overview

  https://docs.microsoft.com/en-us/security/zero-trust/user-access-productivity-validate-trust#identities

  https://docs.microsoft.com/en-us/security/compass/esae-retirement

• Question 138:

  You have a Microsoft 365 subscription that contains a group named Group1. The subscription is linked to a Microsoft Entra ID P1 tenant.

  You have an external software as a service (SaaS) application named App1. App1 is managed by using a web-based admin portal and supports the use of Microsoft Entra ID credentials.

  You need to ensure that only the members of Group1 who sign in from Microsoft Entra joined devices can access the admin portal of App1.

  What should you create first in Microsoft Entra?

  A. an enterprise application
  B. a Microsoft Entra application proxy connector group
  C. a Conditional Access policy
  D. an access package
  A. an enterprise application

• Question 139:

  HOTSPOT

  Your company plans to follow DevSecOps best practices of the Microsoft Cloud Adoption Framework for Azure to integrate DevSecOps processes into continuous integration and continuous deployment (Cl/CD) DevOps pipelines

  You need to recommend which security-related tasks to integrate into each stage of the DevOps pipelines.

  What should recommend? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 140:

  You are creating an application lifecycle management process based on the Microsoft Security Development Lifecycle (SDL).

  You need to recommend a security standard for onboarding applications to Azure.

  The standard will include recommendations for application design, development, and deployment What should you include during the application design phase?

  A. static application security testing (SAST) by using SonarQube
  B. dynamic application security testing (DAST) by using Veracode
  C. threat modeling by using the Microsoft Threat Modeling Tool
  D. software decomposition by using Microsoft Visual Studio Enterprise
  C. threat modeling by using the Microsoft Threat Modeling Tool

  ---

  Explanation

  Threat modeling is a core element of the Microsoft Security Development Lifecycle (SDL). It's an engineering technique you can use to help you identify threats, attacks, vulnerabilities, and countermeasures that could affect your application.

  You can use threat modeling to shape your application's design, meet your company's security objectives, and reduce risk.

  Incorrect:

  Not B: Advantages of Veracode's DAST test solution With a blackbox test tool from Veracode, you can:

  Simulate the actions of an actual attacker to discover vulnerabilities not found by other testing techniques.

  Run tests on applications developed in any language ?JAVA/JSP, PHP and other engine-driven web applications.

  Provide development and QA teams with a report on critical vulnerabilities along with information that lets them recreate the flaws.

  Fix issues more quickly with detailed remediation information.

  Develop long-term strategies for improving application security across your software portfolio using guidance and proactive recommendations from Veracode's expert.

  Not D: SonarQube is a leading automatic code review tool to detect bugs, vulnerabilities and code smells in your code. Using Static Application Security Testing (SAST) you can do an analysis of vulnerabilities in your code, also known as white-box testing to find about 50% of likely issues.

  References:

  https://www.microsoft.com/en-us/securityengineering/sdl/threatmodeling