Microsoft Microsoft Certified: Cybersecurity Architect Expert SC-100 Questions & Answers

• Question 151:

  HOTSPOT

  You need to recommend a multi-tenant and hybrid security solution that meets to the business requirements and the hybrid requirements.

  What should you recommend? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: Azure AD B2C

  Scenario: Provide centralized, cross-tenant subscription management without the overhead of maintaining guest accounts.

  Azure AD B2C

  Azure Active Directory B2C provides business-to-customer identity as a service. Your customers use their preferred social, enterprise, or local account identities to get single sign-on access to your applications and APIs.

  By serving as the central authentication authority for your web applications, mobile apps, and APIs, Azure AD B2C enables you to build a single sign-on (SSO) solution for them all. Centralize the collection of user profile and preference

  information, and capture detailed analytics about sign-in behavior and sign-up conversion.

  Note: Azure AD B2C is a customer identity access management (CIAM) solution capable of supporting millions of users and billions of authentications per day. It takes care of the scaling and safety of the authentication platform, monitoring,

  and automatically handling threats like denial-of-service, password spray, or brute force attacks.

  Incorrect:

  Azure Lighthouse

  Cross-tenant management experiences

  As a service provider, you can use Azure Lighthouse to manage resources for multiple customers from within your own Azure Active Directory (Azure AD) tenant.

  With Azure Lighthouse, the onboarding process specifies users within the service provider's tenant who will be able to work on delegated subscriptions and resource groups in the customer's tenant. These users can then sign in to the Azure

  portal using their own credentials. Within the Azure portal, they can manage resources belonging to all customers to which they have access.

  Box 2: Azure Arc

  Azure Arc simplifies governance and management by delivering a consistent multi-cloud and on-premises management platform.

  Note:

  Requirements. Hybrid Requirements

  Litware identifies the following hybrid cloud requirements:

  *Enable the management of on-premises resources from Azure, including the following:

  Use Azure Policy for enforcement and compliance evaluation.

  Provide change tracking and asset inventory.

  Implement patch management.

  Incorrect:

  *

  Azure Stack Edge acts as a cloud storage gateway and enables eyes-off data transfers to Azure, while retaining local access to files.

  *

  Microsoft Azure Stack Hub is a hybrid cloud platform that lets you deliver services from your datacenter.

  Reference: https://docs.microsoft.com/en-us/azure/active-directory-b2c/overview https://docs.microsoft.com/en-us/azure/azure-arc/overview https://docs.microsoft.com/en-us/azure/lighthouse/concepts/cross-tenant-management-experience

• Question 152:

  HOTSPOT

  You need to recommend a strategy for App Service web app connectivity. The solution must meet the landing zone requirements.

  What should you recommend? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: Virtual network integration

  Integrate your app with an Azure virtual network.

  With Azure virtual networks, you can place many of your Azure resources in a non-internet-routable network. The App Service virtual network integration feature enables your apps to access resources in or through a virtual network.

  Box 2: Private endpoints

  Ensure that the Azure virtual machines in each landing zone communicate with Azure App Service web apps in the same zone over the Microsoft backbone network, rather than over public endpoints.

  A virtual machine can connect to the web app across the private endpoint.

  Reference: https://docs.microsoft.com/en-us/azure/app-service/overview-vnet-integration

  https://docs.microsoft.com/en-us/azure/private-link/tutorial-private-endpoint-webapp-portal

• Question 153:

  HOTSPOT

  You need to recommend a solution to evaluate regulatory compliance across the entire managed environment. The solution must meet the regulatory compliance requirements and the business requirements.

  What should you recommend? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: Azure Policy initiatives to management groups

  If your organization has many Azure subscriptions, you may need a way to efficiently manage access, policies, and compliance for those subscriptions. Management groups provide a governance scope above subscriptions. You organize

  subscriptions into management groups the governance conditions you apply cascade by inheritance to all associated subscriptions.

  If you plan to apply a policy definition to multiple subscriptions, the location must be a management group that contains the subscriptions you assign the policy to. The same is true for an initiative definition.

  With an initiative definition, you can group several policy definitions to achieve one overarching goal. An initiative evaluates resources within scope of the assignment for compliance to the included policies.

  Incorrect:

  Not: Azure Policy initiatives to subscriptions

  Must use a management group as we have multiple subscriptions.

  Scenario:

  Requirements. Business Requirements

  Litware identifies the following business requirements:

  1.

  Minimize any additional on-premises infrastructure.

  2.

  Minimize the operational costs associated with administrative overhead.

  Box 2: Azure Arc

  With Azure Arc:

  Meet governance and compliance standards for apps, infrastructure, and data with Azure Policy.

  Take advantage of elastic scale, consistent on-premises and multicloud management, and cloud-style billing models.

  Note: Azure Arc is a bridge that extends the Azure platform to help you build applications and services with the flexibility to run across datacenters, at the edge, and in multicloud environments. Develop cloud-native applications with a

  consistent development, operations, and security model. Azure Arc runs on both new and existing hardware, virtualization and Kubernetes platforms, IoT devices, and integrated systems. Reference: https://docs.microsoft.com/en-us/azure/governance/management-groups/overview https://azure.microsoft.com/en-us/services/azure-arc/#product-overview

• Question 154:

  You need to recommend a strategy for securing the litware.com forest. The solution must meet the identity requirements.

  What should you include in the recommendation? To answer, select the appropriate options in the answer area. NOTE; Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: Microsoft defender for cloud

  Scenario: Prevent AD DS user accounts from being locked out by brute force attacks that target Azure AD user accounts.

  When Microsoft Defender for Cloud detects a Brute-force attack, it triggers an alert to bring you awareness that a brute force attack took place. The automation uses this alert as a trigger to block the traffic of the IP by creating a security rule in

  the NSG attached to the VM to deny inbound traffic from the IP addresses attached to the alert. In the alerts of this type, you can find the attacking IP address appearing in the 'entities' field of the alert.

  Box 2: An account lockout policy in AD DS

  Scenario:

  Detect brute force attacks that directly target AD DS user accounts.

  Smart lockout helps lock out bad actors that try to guess your users' passwords or use brute-force methods to get in. Smart lockout can recognize sign-ins that come from valid users and treat them differently than ones of attackers and other

  unknown sources. Attackers get locked out, while your users continue to access their accounts and be productive.

  Verify on-premises account lockout policy

  To verify your on-premises AD DS account lockout policy, complete the following steps from a domain-joined system with administrator privileges:

  1.

  Open the Group Policy Management tool.

  2.

  Edit the group policy that includes your organization's account lockout policy, such as, the Default Domain Policy.

  3.

  Browse to Computer Configuration > Policies > Windows Settings > Security Settings > Account Policies > Account Lockout Policy.

  4.

  Verify your Account lockout threshold and Reset account lockout counter after values.

  Reference: https://techcommunity.microsoft.com/t5/microsoft-defender-for-cloud/automation-to-block-brute-force-attacked-ip-detected-by/ba-p/1616825 https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-password-smart-lockout#verify-on-premises-account-lockout-policy

• Question 155:

  HOTSPOT

  You need to recommend a SIEM and SOAR strategy that meets the hybrid requirements, the Microsoft Sentinel requirements, and the regulatory compliance requirements.

  What should you recommend? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: Azure tenant

  Microsoft Sentinel multiple workspace architecture

  There are cases where a single SOC (Security Operations Center) needs to centrally manage and monitor multiple Microsoft Sentinel workspaces, potentially across Azure Active Directory (Azure AD) tenants.

  An MSSP Microsoft Sentinel Service.

  A global SOC serving multiple subsidiaries, each having its own local SOC.

  A SOC monitoring multiple Azure AD tenants within an organization.

  To address these cases, Microsoft Sentinel offers multiple-workspace capabilities that enable central monitoring, configuration, and management, providing a single pane of glass across everything covered by the SOC. This diagram shows

  an example architecture for such use cases.

  

  This model offers significant advantages over a fully centralized model in which all data is copied to a single workspace.

  Scenario:

  Requirements. Microsoft Sentinel Requirements

  Litware plans to leverage the security information and event management (SIEM) and security orchestration automated response (SOAR) capabilities of Microsoft Sentinel. The company wants to centralize Security Operations Center (SOC)

  by using Microsoft Sentinel.

  Hybrid Requirements

  Litware identifies the following hybrid cloud requirements:

  Provide centralized, cross-tenant subscription management without the overhead of maintaining guest accounts.

  Box 2: Azure Lighthouse subscription onboarding process

  You can use Azure Lighthouse to extend all cross-workspace activities across tenant boundaries, allowing users in your managing tenant to work on Microsoft Sentinel workspaces across all tenants.

  Azure Lighthouse enables you to see and manage Azure resources from different tenancies, in the one place, with the power of delegated administration. That tenancy may be a customer (for example, if you're a managed services provider

  with a support contract arrangement in place), or a separate Azure environment for legal or financial reasons (like franchisee groups or Enterprises with large brand groups).

  Incorrect:

  * not Azure AD B2B

  Azure AD B2B uses guest account, which goes against the requirements in this scenario,

  Note: Azure Active Directory (Azure AD) B2B collaboration is a feature within External Identities that lets you invite guest users to collaborate with your organization.

  Reference: https://docs.microsoft.com/en-us/azure/sentinel/extend-sentinel-across-workspaces-tenants https://docs.microsoft.com/en-us/azure/sentinel/best-practices-workspace-architecture https://techcommunity.microsoft.com/t5/itops-talk-blog/onboarding-to-azure-lighthouse-using-a-template/ba-p/1091786 https://docs.microsoft.com/en-us/azure/active-directory/external-identities/what-is-b2b

• Question 156:

  HOTSPOT

  You need to recommend a solution to meet the AWS requirements.

  What should you include in the recommendation? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: Microsoft Defender for servers

  Scenario: Notify security administrators at Fabrikam if any AWS EC2 instances are noncompliant with secure score recommendations.

  Defender for Servers is one of the enhanced security features available in Microsoft Defender for Cloud. You can use it to add threat detection and advanced defenses to your Windows and Linux machines that exist in hybrid and multicloud

  environments.

  Available Defender for Server plans

  Defender for Servers offers you a choice between two paid plans.

  Both include automatic onboarding for resources in Azure, AWS, GCP.

  

  Plan 1 includes the following benefits:

  Automatic onboarding for resources in Azure, AWS, GCP

  Microsoft threat and vulnerability management

  Flexibility to use Microsoft Defender for Cloud or Microsoft 365 Defender portal

  A Microsoft Defender for Endpoint subscription that includes access to alerts, software inventory, Vulnerability Assessment and an automatic integration with Microsoft Defender for Cloud.

  Plan 2 includes everything in Plan 1 plus some additional benefits.

  Box 2: Microsoft Sentinel

  Scenario: AWS Requirements

  Fabrikam identifies the following security requirements for the data hosted in ContosoAWS1:

  Ensure that the security administrators can query AWS service logs directly from the Azure environment.

  Use the Amazon Web Services (AWS) connectors to pull AWS service logs into Microsoft Sentinel.

  Note: These connectors work by granting Microsoft Sentinel access to your AWS resource logs. Setting up the connector establishes a trust relationship between Amazon Web Services and Microsoft Sentinel. This is accomplished on AWS

  by creating a role that gives permission to Microsoft Sentinel to access your AWS logs.

  Reference: https://docs.microsoft.com/en-us/azure/defender-for-cloud/defender-for-servers-introduction

  https://docs.microsoft.com/en-us/azure/defender-for-cloud/recommendations-reference-aws

  https://docs.microsoft.com/en-us/azure/sentinel/connect-aws

• Question 157:

  What should you create in Azure AD to meet the Contoso developer requirements?

  Hot Area:

  

  Correct Answer:

  

  Box 1: A synced user account

  Need to use a synched user account.

  Incorrect:

  *

  Not A user account in the fabrikam.onmicrosoft.com tenant

  The Contoso developers must use their existing contoso.onmicrosoft.com credentials to access the resources in Sub1.

  *

  Guest accounts would not meet the requirements.

  Note: Developers at Contoso will connect to the resources of Fabrikam to test or update applications. The developers will be added to a security group named ContosoDevelopers in fabrikam.onmicrosoft.com that will be assigned to roles in

  Sub1.

  The ContosoDevelopers group is assigned the db_owner role for the ClaimsDB database.

  Contoso Developers Requirements

  Fabrikam identifies the following requirements for the Contoso developers:

  Every month, the membership of the ContosoDevelopers group must be verified.

  The Contoso developers must use their existing contoso.onmicrosoft.com credentials to access the resources in Sub1.

  The Contoso developers must be prevented from viewing the data in a column named MedicalHistory in the ClaimDetails table.

  Box 2: An access review

  Scenario: Every month, the membership of the ContosoDevelopers group must be verified.

  Azure Active Directory (Azure AD) access reviews enable organizations to efficiently manage group memberships, access to enterprise applications, and role assignments. User's access can be reviewed on a regular basis to make sure only

  the right people have continued access.

  Access review is part of Azure AD Identity governance.

  Reference:

  https://docs.microsoft.com/en-us/azure/active-directory-domain-services/synchronization

  https://docs.microsoft.com/en-us/azure/active-directory/governance/access-reviews-overview

• Question 158:

  HOTSPOT

  You need to recommend a solution to meet the requirements for connections to ClaimsDB.

  What should you recommend using for each requirement? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: A private endpoint Scenario: An Azure SQL database named ClaimsDB that contains a table named ClaimDetails

  Requirements. ClaimsApp Deployment.

  Fabrikam plans to implement an internet-accessible application named ClaimsApp that will have the following specifications:

  1.

  ClaimsApp will be deployed to Azure App Service instances that connect to Vnet1 and Vnet2.

  2.

  Users will connect to ClaimsApp by using a URL of https://claims.fabrikam.com.

  3.

  ClaimsApp will access data in ClaimsDB.

  4.

  ClaimsDB must be accessible only from Azure virtual networks.

  5.

  The app services permission for ClaimsApp must be assigned to ClaimsDB.

  Web app private connectivity to Azure SQL Database. Architecture: Workflow

  

  1.

  Using Azure App Service regional VNet Integration, the web app connects to Azure through an AppSvcSubnet delegated subnet in an Azure Virtual Network.

  2.

  In this example, the Virtual Network only routes traffic and is otherwise empty, but other subnets and workloads could also run in the Virtual Network.

  3.

  The App Service and Private Link subnets could be in separate peered Virtual Networks, for example as part of a hub-and-spoke network configuration.

  4.

  Azure Private Link sets up a private endpoint for the Azure SQL Database in the PrivateLinkSubnet of the Virtual Network.

  5.

  The web app connects to the SQL Database private endpoint through the PrivateLinkSubnet of the Virtual Network.

  The database firewall allows only traffic coming from the PrivateLinkSubnet to connect, making the database inaccessible from the public internet.

  Box 2: A managed identity Managed identities for Azure resources provide Azure services with an automatically managed identity in Azure Active Directory. Using a managed identity, you can authenticate to any service that supports Azure AD authentication without managing credentials.

  Reference: https://docs.microsoft.com/en-us/azure/architecture/example-scenario/private-web-app/private-web-app https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/managed-identities-status

• Question 159:

  HOTSPOT

  You need to recommend a solution to meet the compliance requirements.

  What should you include in the recommendation? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: A blueprint Scenario: Requirements. Compliance Requirements Fabrikam wants to automatically remediate the virtual machines in Sub1 to be compliant with the HIPAA HITRUST standard.

  Microsoft releases automation for HIPAA/HITRUST compliance I am excited to share our new Azure Security and Compliance Blueprint for HIPAA/HITRUST

• Question 160:

  HOTSPOT

  You are evaluating the security of ClaimsApp.

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: No Box 2: Yes

  Users will connect to ClaimsApp by using a URL of https://claims.fabrikam.com.

  Need certificate for HTTPS.

  TLS/SSL certificates

  To enable the HTTPS protocol for securely delivering content on a Front Door custom domain, you must use a TLS/SSL certificate. You can choose to use a certificate that is managed by Azure Front Door or use your own certificate.

  Box 3: Yes

  By default, Azure Front Door will respond to all user requests regardless of the location where the request is coming from. In some scenarios, you may want to restrict the access to your web application by countries/regions. The Web

  application firewall (WAF) service in Front Door enables you to define a policy using custom access rules for a specific path on your endpoint to either allow or block access from specified countries/regions.

  Note: Requirements. Security Requirements

  Fabrikam identifies the following security requirements:

  Internet-accessible applications must prevent connections that originate in North Korea.

  Reference: https://techcommunity.microsoft.com/t5/azure-architecture-blog/permit-access-only-from-azure-front-door-to-azure-app-service-as/ba-p/2000173

  https://docs.microsoft.com/en-us/azure/frontdoor/front-door-custom-domain-https#tlsssl-certificates