Microsoft SC-100 Online Practice Questions and Exam Preparation

Microsoft SC-100 Online Questions & Answers

• Question 141:

  You have an Azure subscription that contains virtual machines, storage accounts, and Azure SQL databases.

  All resources are backed up multiple times a day by using Azure Backup.

  You are developing a strategy to protect against ransomware attacks.

  You need to recommend which controls must be enabled to ensure that Azure Backup can be used to restore the resources in the event of a successful ransomware attack.

  Which two controls should you include in the recommendation? Each correct answer presents a complete solution.

  NOTE: Each correct selection is worth one point.

  A. Enable soft delete for backups.
  B. Require PINs for critical operations.
  C. Encrypt backups by using customer-managed keys (CMKs).
  D. Perform offline backups to Azure Data Box.
  E. Use Azure Monitor notifications when backup configurations change.
  A. Enable soft delete for backups.
  B. Require PINs for critical operations.

  ---

  Explanation

  https://docs.microsoft.com/en-us/azure/security/fundamentals/backup-plan-to-protect-against-ransomware

• Question 142:

  HOTSPOT

  You have the resources shown in the following table.

  

  You need to configure multi-user authorization (MUA) for Azure Backup to protect the Recovery Services vaults.

  The solution must maximize the security of the MUA configuration.

  To which location should you deploy Resource Guard, and which role-based access control (RBAC) role should you assign to the team responsible for managing the backup of Resource Guard? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 143:

  You have a Microsoft 365 subscription with 1,000 Microsoft Exchange Online mailboxes.

  Incoming email from the internet is currently scanned for security threats by a third-party cloud service.

  You are evaluating the possibility of replacing the third-party service with Microsoft Defender for Office 365.

  What should you modify to ensure that all incoming email is scanned exclusively by Defender for Office 365?

  A. the accepted domains in Exchange Online
  B. the DNS records
  C. the Exchange Online transport rule
  D. the Exchange Online connectors
  D. the Exchange Online connectors

  ---

  Explanation

  Configure mail flow using connectors in Exchange Online Connectors are a collection of instructions that customize the way your email flows to and from your Microsoft 365 or Office 365 organization.

  What do connectors do?

  Connectors are used in the following scenarios: Enable mail flow between Microsoft 365 or Office 365 and email servers that you have in your on-premises environment (also known as on-premises email servers).

  *-> Apply security restrictions or controls to email that's sent between your Microsoft 365 or Office 365 organization and a business partner or service provider.

  Relay mail from devices, applications, or other non-mailbox entities in your on-premises environment through Microsoft 365 or Office 365. Avoid graylisting that would otherwise occur due to the large volume of mail that's regularly sent between your Microsoft 365 or Office 365 organization and your on-premises environment or partners.

  References:

  https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/use-connectors-to-configure-mail-flow/use-connectors-to-configure-mail-flow

• Question 144:

  HOTSPOT

  You need to recommend a multi-tenant and hybrid security solution that meets to the business requirements and the hybrid requirements.

  What should you recommend? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: Azure AD B2C

  Scenario: Provide centralized, cross-tenant subscription management without the overhead of maintaining guest accounts.

  Azure AD B2C

  Azure Active Directory B2C provides business-to-customer identity as a service. Your customers use their preferred social, enterprise, or local account identities to get single sign-on access to your applications and APIs.

  By serving as the central authentication authority for your web applications, mobile apps, and APIs, Azure AD B2C enables you to build a single sign-on (SSO) solution for them all. Centralize the collection of user profile and preference information, and capture detailed analytics about sign-in behavior and sign-up conversion.

  Note: Azure AD B2C is a customer identity access management (CIAM) solution capable of supporting millions of users and billions of authentications per day. It takes care of the scaling and safety of the authentication platform, monitoring, and automatically handling threats like denial-of-service, password spray, or brute force attacks.

  Incorrect:

  Azure Lighthouse

  Cross-tenant management experiences

  As a service provider, you can use Azure Lighthouse to manage resources for multiple customers from within your own Azure Active Directory (Azure AD) tenant.

  With Azure Lighthouse, the onboarding process specifies users within the service provider's tenant who will be able to work on delegated subscriptions and resource groups in the customer's tenant. These users can then sign in to the Azure portal using their own credentials. Within the Azure portal, they can manage resources belonging to all customers to which they have access.

  Box 2: Azure Arc

  Azure Arc simplifies governance and management by delivering a consistent multi-cloud and on-premises management platform.

  Note:

  Requirements. Hybrid Requirements

  Litware identifies the following hybrid cloud requirements: *Enable the management of on-premises resources from Azure, including the following: Use Azure Policy for enforcement and compliance evaluation.

  Provide change tracking and asset inventory.

  Implement patch management.

  Incorrect:

  * Azure Stack Edge acts as a cloud storage gateway and enables eyes-off data transfers to Azure, while retaining local access to files.

  * Microsoft Azure Stack Hub is a hybrid cloud platform that lets you deliver services from your datacenter.

  References:

  https://docs.microsoft.com/en-us/azure/active-directory-b2c/overview

  https://docs.microsoft.com/en-us/azure/azure-arc/overview

  https://docs.microsoft.com/en-us/azure/lighthouse/concepts/cross-tenant-management-experience

• Question 145:

  Your company has a Microsoft 365 E5 subscription.

  The company plans to deploy 45 mobile self-service kiosks that will run Windows 10.

  You need to provide recommendations to secure the kiosks. The solution must meet the following requirements:

  1. Ensure that only authorized applications can run on the kiosks.

  2. Regularly harden the kiosks against new threats.

  Which two actions should you include in the recommendations? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. Implement Automated investigation and Remediation (AIR) in Microsoft Defender for Endpoint.
  B. Onboard the kiosks to Microsoft intune and Microsoft Defender for Endpoint.
  C. Implement threat and vulnerability management in Microsoft Defender for Endpoint.
  D. Onboard the kiosks to Azure Monitor.
  E. Implement Privileged Access Workstation (PAW) for the kiosks.
  B. Onboard the kiosks to Microsoft intune and Microsoft Defender for Endpoint.
  C. Implement threat and vulnerability management in Microsoft Defender for Endpoint.

  ---

  Explanation

  B and C are the recommended actions to secure the kiosks. Implementing threat and vulnerability management in Microsoft Defender for Endpoint and onboarding the kiosks to Microsoft Intune and Microsoft Defender for Endpoint will help ensure that only authorized applications can run on the kiosks and that the kiosks are regularly hardened against new threats.

• Question 146:

  You have an Azure subscription that has Microsoft Defender for Cloud enabled.

  You need to enforce ISO 27001:2013 standards for new resources deployed to the subscription. The solution must ensure that noncompliant resources are automatically detected.

  What should you use?

  A. Azure Policy
  B. Azure Blueprints
  C. the regulatory compliance dashboard in Defender for Cloud
  D. Azure role-based access control (Azure RBAC)
  A. Azure Policy

  ---

  Explanation

  Control mapping of the ISO 27001 Shared Services blueprint sample

  The following mappings are to the ISO 27001:2013 controls. Use the navigation on the right to jump directly to a specific control mapping. Many of the mapped controls are implemented with an Azure Policy initiative.

  Open Policy in the Azure portal and select the Definitions page. Then, find and select the [Preview] Audit ISO 27001:2013 controls and deploy specific VM Extensions to support audit requirements built-in policy initiative.

  Note: Security Center can now auto provision the Azure Policy's Guest Configuration extension (in preview)

  Azure Policy can audit settings inside a machine, both for machines running in Azure and Arc connected machines. The validation is performed by the Guest Configuration extension and client.

  With this update, you can now set Security Center to automatically provision this extension to all supported machines.

  Enforcing a secure configuration, based on a specific recommendation, is offered in two modes:

  Using the Deny effect of Azure Policy, you can stop unhealthy resources from being created Using the Enforce option, you can take advantage of Azure Policy's DeployIfNotExist effect and automatically remediate non-compliant resources upon creation

  References:

  https://docs.microsoft.com/en-us/azure/governance/blueprints/samples/iso27001-shared/control-mapping

  https://docs.microsoft.com/en-us/azure/defender-for-cloud/release-notes-archive

  https://docs.microsoft.com/en-us/azure/defender-for-cloud/prevent-misconfigurations

• Question 147:

  HOTSPOT

  You have 1,000 on-premises servers running Windows Server 2022 and 500 on-premises servers running Linux.

  Your Azure subscription contains the following resources:

  1. A Log Analytics workspace

  2. A Microsoft Defender Cloud Security Posture Management (CSPM) plan

  You need to deploy Update Management for the servers.

  What should you configure? To answer, select the appropriate options in the answer area. Each correct selection is worth one point.

  

  

  ---

  Box 1: Microsoft Defender for Servers Plan 2 Azure resource

  Incorrect:

  * An Azure Automation account

  Update Manager offers many new features and provides enhanced and native functionalities. Following are some of the benefits:

  * Provides native experience with zero on-boarding.

  - No dependency on Log Analytics and Azure Automation.

  - Etc.

  * Etc.

  Box 2: Azure connected machine agent Agent on the servers

  For the Azure Update Manager, both AMA and MMA aren't a requirement to manage software update workflows as it relies on the Microsoft Azure VM Agent for Azure VMs and Azure connected machine agent for Arc-enabled servers.

  References:

  https://learn.microsoft.com/en-us/azure/defender-for-cloud/plan-defender-for-servers-select-plan

  https://learn.microsoft.com/en-us/azure/update-manager/overview

  https://learn.microsoft.com/en-us/azure/update-manager/migration-overview

• Question 148:

  Your company has a hybrid cloud infrastructure.

  The company plans to hire several temporary employees within a brief period. The temporary employees will need to access applications and data on the company' premises network.

  The company's security policy prevents the use of personal devices for accessing company data and applications.

  You need to recommend a solution to provide the temporary employee with access to company resources. The solution must be able to scale on demand.

  What should you include in the recommendation?

  A. Deploy Azure Virtual Desktop, Azure AD Conditional Access, and Microsoft Defender for Cloud Apps.
  B. Redesign the VPN infrastructure by adopting a split tunnel configuration.
  C. Deploy Microsoft Endpoint Manager and Azure AD Conditional Access.
  D. Migrate the on-premises applications to cloud-based applications.
  A. Deploy Azure Virtual Desktop, Azure AD Conditional Access, and Microsoft Defender for Cloud Apps.

  ---

  Explanation

  You can connect an Azure Virtual Desktop to an on-premises network using a virtual private network (VPN), or use Azure ExpressRoute to extend the on-premises network into the Azure cloud over a private connection.

  * Azure AD: Azure Virtual Desktop uses Azure AD for identity and access management. Azure AD integration applies Azure AD security features like conditional access, multi-factor authentication, and the Intelligent Security Graph, and helps maintain app compatibility in domain-joined VMs.

  * Azure Virtual Desktop, enable Microsoft Defender for Cloud.

  We recommend enabling Microsoft Defender for Cloud's enhanced security features to: Manage vulnerabilities.

  Assess compliance with common frameworks like PCI.

  * Microsoft Defender for Cloud Apps, formerly known as Microsoft Cloud App Security, is a comprehensive solution for security and compliance teams enabling users in the organization, local and remote, to safely adopt business applications without compromising productivity.

  References:

  https://docs.microsoft.com/en-us/azure/architecture/example-scenario/wvd/windows-virtual-desktop

  https://docs.microsoft.com/en-us/azure/virtual-desktop/security-guide

  https://techcommunity.microsoft.com/t5/security-compliance-and-identity/announcing-microsoft-defender-for-cloud-apps/ba-p/2835842

• Question 149:

  Your company has 10 branch offices, each with a local internet connection that uses a static IP address.

  You have an Azure subscription containing a storage account named storage1 that stores blobs. Users in the branch offices access the blobs via the internet.

  You need to recommend a solution that ensures the data in storage1 is accessible only from the branch office static IP addresses, while minimizing costs.

  What should you include in the recommendation?

  A. Azure Private Link
  B. an Azure Firewall policy
  C. Azure Storage firewall rules
  D. a network security group (NSG)
  A. Azure Private Link

  ---

  Explanation

  Azure Private Link enables you to access Azure PaaS Services (for example, Azure Storage and SQL Database) and Azure hosted customer-owned/partner services over a private endpoint in your virtual network. Traffic between your virtual network and the service travels the Microsoft backbone network. Exposing your service to the public internet is no longer necessary. You can create your own private link service in your virtual network and deliver it to your customers. Setup and consumption using Azure Private Link is consistent across Azure PaaS, customer-owned, and shared partner services.

  Azure Private Link provides the following benefits:

  * Privately access services on the Azure platform: Connect your virtual network using private endpoints to all services that can be used as application components in Azure. Service providers can render their services in their own virtual network and consumers can access those services in their local virtual network. The Private Link platform will handle the connectivity between the consumer and services over the Azure backbone network.

  * Etc.

  Note: Private endpoint support for statically defined IP addresses is generally available.

  References:

  https://learn.microsoft.com/en-us/azure/private-link/private-link-overview

• Question 150:

  HOTSPOT

  You have an Azure DevOps organization that is used to manage the development and deployment of internal apps to multiple Azure subscriptions. You need to implement a DevSecOps strategy based on Microsoft Cloud Adoption Framework

  for Azure principles. The solution must meet the following requirements:

  All pull requests must be enforced.

  All deployments to production must be approved.

  What should you include in the solution for each requirement? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.