Microsoft SC-100 Online Practice Questions and Exam Preparation

Microsoft SC-100 Online Questions & Answers

• Question 151:

  You have an Azure subscription.

  You plan to deploy enterprise-scale landing zones based on the Microsoft Cloud Adoption Framework for Azure. The deployment will include a single-platform landing zone for all shared services and three application landing zones that will each host a different Azure application.

  You need to recommend which resource to deploy to each landing zone. The solution must meet the Cloud Adoption Framework best-practice recommendations for enterprise-scale landing zones.

  What should you recommend?

  A. an Azure Private DNS zone
  B. an Azure key vault
  C. an Azure firewall
  D. an Azure virtual network gateway
  A. an Azure Private DNS zone

• Question 152:

  HOTSPOT

  You have a multicloud environment that contains an Azure subscription and an Amazon Web Services (AWS) subscription.

  You need to design a solution that meets the following requirements:

  1. Dynamically discovers the permissions granted to and used by each user

  2. Generates an aggregated metric that evaluates the level of risk associated with the number of unused or excessive permissions

  3. Automatically revokes permissions that have been unused for 90 days

  4. Supports granting on-demand permissions for limited periods of time

  5. Minimizes administrative effort.

  Which cloud service should you use for each subscription? To answer, select the options in the answer area.

  NOTE: Each correct answer is worth one point.

  

  

• Question 153:

  You have an Azure subscription.

  You plan to deploy Azure App Services apps using Azure DevOps.

  You need to recommend a solution to ensure that the deployed apps adhere to Microsoft Cloud Security Benchmark (MCSB) recommendations.

  What should be included in your recommendation?

  A. DevOps security in Microsoft Defender for Cloud
  B. Microsoft Defender for App Service
  C. Azure Policy
  D. a branch policy in Azure DevOps
  C. Azure Policy

  ---

  Explanation

  Security baselines for Azure (MCSB v1), Azure security baseline for App Service This security baseline applies guidance from the Microsoft cloud security benchmark version 1.0 to App Service. The Microsoft cloud security benchmark provides recommendations on how you can secure your cloud solutions on Azure. The content is grouped by the security controls defined by the Microsoft cloud security benchmark and the related guidance applicable to App Service. You can monitor this security baseline and its recommendations using Microsoft Defender for Cloud. Azure Policy definitions will be listed in the Regulatory Compliance section of the Microsoft Defender for Cloud portal page. When a feature has relevant Azure Policy Definitions, they are listed in this baseline to help you measure compliance with the Microsoft cloud security benchmark controls and recommendations. Some recommendations may require a paid Microsoft Defender plan to enable certain security scenarios.

  Incorrect:

  Not A: DevOps security DS-6: Enforce security of workload throughout DevOps lifecycle Other guidance for DS-6

  Deploy code to App Service from a controlled and trusted environment, like a well-managed and secured DevOps deployment pipeline. This avoids code that was not version controlled and verified to be deployed from a malicious host.

  References:

  https://learn.microsoft.com/en-us/security/benchmark/azure/baselines/app-service-security-baseline

• Question 154:

  Your on-premises network contains an Active Directory Domain Services (AD DS) domain. The domain contains a server named Serve1 that runs Windows Server 2022.

  You have an Azure subscription that is linked to a hybrid Microsoft Entra tenant and contains a user named User1. User1 works remotely.

  You need to ensure that User1 can establish RDP connections to Server1 via the internet. The solution must ensure that User1 authenticates by using multifactor authentication (MFA).

  What should you include in the solution?

  A. Windows Admin Center
  B. Microsoft Entra Internet Access
  C. Azure Bastion
  D. Microsoft Entra Private Access
  D. Microsoft Entra Private Access

• Question 155:

  HOTSPOT

  You need to recommend a strategy for App Service web app connectivity. The solution must meet the landing zone requirements.

  What should you recommend? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: Virtual network integration

  Integrate your app with an Azure virtual network.

  With Azure virtual networks, you can place many of your Azure resources in a non-internet-routable network. The App Service virtual network integration feature enables your apps to access resources in or through a virtual network.

  Box 2: Private endpoints

  Ensure that the Azure virtual machines in each landing zone communicate with Azure App Service web apps in the same zone over the Microsoft backbone network, rather than over public endpoints.

  A virtual machine can connect to the web app across the private endpoint.

  References:

  https://docs.microsoft.com/en-us/azure/app-service/overview-vnet-integration

  https://docs.microsoft.com/en-us/azure/private-link/tutorial-private-endpoint-webapp-portal

• Question 156:

  Your company is preparing for cloud adoption.

  You are designing security for Azure landing zones.

  Which two preventative controls can you implement to increase the secure score? Each NOTE: Each correct selection is worth one point.

  A. Azure Firewall
  B. Azure Web Application Firewall (WAF)
  C. Microsoft Defender for Cloud alerts
  D. Azure Active Directory (Azure AD Privileged Identity Management (PIM)
  E. Microsoft Sentinel
  A. Azure Firewall
  B. Azure Web Application Firewall (WAF)

  ---

  Explanation

  This question is to increase secure score. Here is a long reference page from Microsoft of security recommendations that can increase your secure score. Sentinel & PIM are not on it. The explanation makes a great point about alerts not being preventive, which is a key aspect of the required solution.

  https://docs.microsoft.com/en-us/azure/defender-for-cloud/secure-score-security-controls

• Question 157:

  You have a Microsoft 365 tenant that uses Microsoft SharePoint Online and Microsoft Purview. Within Microsoft Purview, there is a sensitivity label named Label1 that is applied to the files stored on SharePoint Online sites.

  You need to recommend a Microsoft Purview Data Loss Prevention (DLP) policy that fulfills the following requirements:

  1. Prevents users from uploading the files to third-party external websites.

  2. Allows users to upload the files to Microsoft OneDrive for Business.

  To which location should the DLP policy be applied?

  A. Devices
  B. OneDrive accounts
  C. SharePoint sites
  D. Microsoft Defender for Cloud Apps
  A. Devices

  ---

  Explanation

  To prevent users from uploading files with a specific sensitivity label (like Label1) to third-party external websites while allowing uploads to Microsoft OneDrive for Business, you would apply the Microsoft Purview Data Loss Prevention (DLP) policy to Devices. Applying the DLP policy to Devices allows control over what users do with files on their endpoints, enabling you to prevent data from being shared to untrusted locations while allowing uploads to trusted services such as OneDrive for Business.

• Question 158:

  HOTSPOT

  What should you create in Azure AD to meet the Contoso developer requirements?

  

  

  ---

  Box 1: A synced user account Need to use a synched user account.

  Incorrect:

  * Not A user account in the fabrikam.onmicrosoft.com tenant

  The Contoso developers must use their existing contoso.onmicrosoft.com credentials to access the resources in Sub1.

  * Guest accounts would not meet the requirements.

  Note: Developers at Contoso will connect to the resources of Fabrikam to test or update applications. The developers will be added to a security group named ContosoDevelopers in fabrikam.onmicrosoft.com that will be assigned to roles in Sub1.

  The ContosoDevelopers group is assigned the db_owner role for the ClaimsDB database.

  Contoso Developers Requirements

  Fabrikam identifies the following requirements for the Contoso developers: Every month, the membership of the ContosoDevelopers group must be verified.

  The Contoso developers must use their existing contoso.onmicrosoft.com credentials to access the resources in Sub1.

  The Contoso developers must be prevented from viewing the data in a column named MedicalHistory in the ClaimDetails table.

  Box 2: An access review

  Scenario: Every month, the membership of the ContosoDevelopers group must be verified.

  Azure Active Directory (Azure AD) access reviews enable organizations to efficiently manage group memberships, access to enterprise applications, and role assignments. User's access can be reviewed on a regular basis to make sure only the right people have continued access.

  Access review is part of Azure AD Identity governance.

  References:

  https://docs.microsoft.com/en-us/azure/active-directory-domain-services/synchronization

  https://docs.microsoft.com/en-us/azure/active-directory/governance/access-reviews-overview

• Question 159:

  Your company plans to provision blob storage by using an Azure Storage account. The blob storage will be accessible from 20 application servers on the internet.

  You need to recommend a solution to ensure that only the application servers can access the storage account.

  What should you recommend using to secure the blob storage?

  A. managed rule sets in Azure Web Application Firewall (WAF) policies
  B. inbound rules in network security groups (NSGs)
  C. firewall rules for the storage account
  D. inbound rules in Azure Firewall
  E. service tags in network security groups (NSGs)
  C. firewall rules for the storage account

  ---

  Explanation

  Configure Azure Storage firewalls and virtual networks.

  To secure your storage account, you should first configure a rule to deny access to traffic from all networks (including internet traffic) on the public endpoint, by default. Then, you should configure rules that grant access to traffic from specific VNets. You can also configure rules to grant access to traffic from selected public internet IP address ranges, enabling connections from specific internet or on-premises clients. This configuration enables you to build a secure network boundary for your applications.

  Storage firewall rules apply to the public endpoint of a storage account. You don't need any firewall access rules to allow traffic for private endpoints of a storage account. The process of approving the creation of a private endpoint grants implicit access to traffic from the subnet that hosts the private endpoint.

  Incorrect:

  Not B: You can use an Azure network security group to filter network traffic to and from Azure resources in an Azure virtual network. A network security group contains security rules that allow or deny inbound network traffic to, or outbound network traffic from, several types of Azure resources. For each rule, you can specify source and destination, port, and protocol.

  Not E: A service tag represents a group of IP address prefixes from a given Azure service. Microsoft manages the address prefixes encompassed by the service tag and automatically updates the service tag as addresses change, minimizing the complexity of frequent updates to network security rules.

  References:

  https://docs.microsoft.com/en-us/azure/storage/common/storage-network-security

• Question 160:

  Your company has an Azure subscription that has enhanced security enabled for Microsoft Defender for Cloud.

  The company signs a contract with the United States government.

  You need to review the current subscription for NIST 800-53 compliance.

  What should you do first?

  A. From Azure Policy, assign a built-in initiative that has a scope of the subscription.
  B. From Azure Policy, assign a built-in policy definition that has a scope of the subscription.
  C. From Defender for Cloud, review the Azure security baseline for audit report.
  D. From Microsoft Defender for Cloud Apps, create an access policy for cloud applications.
  A. From Azure Policy, assign a built-in initiative that has a scope of the subscription.

  ---

  Explanation

  How are regulatory compliance standards represented in Defender for Cloud?

  Industry standards, regulatory standards, and benchmarks are represented in Defender for Cloud's regulatory compliance dashboard. Each standard is an initiative defined in Azure Policy.

  References:

  https://learn.microsoft.com/en-us/azure/defender-for-cloud/update-regulatory-compliance-packages