Microsoft SC-100 Online Practice Questions and Exam Preparation

Microsoft SC-100 Online Questions & Answers

• Question 161:

  HOTSPOT

  You are planning the security levels for a security access strategy.

  You need to identify which job roles to configure at which security levels. The solution must meet security best practices of the Microsoft Cybersecurity Reference Architectures (MCRA).

  Which security level should you configure for each job role? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: Specialized security

  Securing devices as part of the privileged access story

  

  Box 2: Enterprise security

  Box 3: Privileged security

  References:

  https://learn.microsoft.com/en-us/security/compass/privileged-access-devices

• Question 162:

  You have an on-premises network and a Microsoft 365 subscription.

  You are designing a Zero Trust security strategy.

  Which two security controls should you include as part of the Zero Trust solution? Each correct answer presents part of the solution.

  NOTE: Each correct answer is worth one point.

  A. Always allow connections from the on-premises network.
  B. Disable passwordless sign-in for sensitive accounts.
  C. Block sign-in attempts from unknown locations.
  D. Block sign-in attempts from noncompliant devices.
  C. Block sign-in attempts from unknown locations.
  D. Block sign-in attempts from noncompliant devices.

• Question 163:

  DRAG DROP

  You have a Microsoft 365 subscription.

  You need to recommend a security solution to monitor the following activities:

  1. User accounts that were potentially compromised

  2. Users performing bulk file downloads from Microsoft SharePoint Online

  What should you include in the recommendation for each activity? To answer, drag the appropriate components to the correct activities. Each component may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

  NOTE: Each correct selection is worth one point.

  Select and Place:

  

  

  ---

  Box 1: Azure Active Directory (Azure AD) Identity Protection

  Risk detections in Azure AD Identity Protection include any identified suspicious actions related to user accounts in the directory. Risk detections (both user and sign-in linked) contribute to the overall user risk score that is found in the Risky Users report.

  Identity Protection provides organizations access to powerful resources to see and respond quickly to these suspicious actions.

  Note:

  Premium sign-in risk detections include:

  * Token Issuer Anomaly - This risk detection indicates the SAML token issuer for the associated SAML token is potentially compromised. The claims included in the token are unusual or match known attacker patterns.

  * Suspicious inbox manipulation rules - This detection is discovered by Microsoft Defender for Cloud Apps. This detection profiles your environment and triggers alerts when suspicious rules that delete or move messages or folders are set on a user's inbox. This detection may indicate that the user's account is compromised, that messages are being intentionally hidden, and that the mailbox is being used to distribute spam or malware in your organization.

  * Etc.

  Incorrect:

  Not: Microsoft 365 Defender for Cloud Part of your incident investigation can include user accounts. You can see the details of user accounts identified in the alerts of an incident in the Microsoft 365 Defender portal from Incidents & alerts > incident > Users.

  Box 2: Microsoft 365 Defender for App Defender for Cloud apps detect mass download (data exfiltration) policy Detect when a certain user accesses or downloads a massive number of files in a short period of time.

  References:

  https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/concept-identity-protection-risks

  https://docs.microsoft.com/en-us/defender-cloud-apps/policies-threat-protection#detect-mass-download-data-exfiltration

  https://docs.microsoft.com/en-us/microsoft-365/security/defender/investigate-users

• Question 164:

  Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem.

  After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.

  You have a Microsoft 365 subscription that uses Microsoft Defender XDR. The subscription contains 500 devices that are enrolled in Microsoft Intune. The subscription contains 500 users that connect to external software as a service (SaaS) apps by using the devices.

  You need to implement a solution that meets the following requirements:

  1. Allows user access to SaaS apps that Microsoft has identified as low risk

  2. Blocks user access to Saas apps that Microsoft has identified as high risk.

  Solution: From the Microsoft Defender portal, you set Web content filtering to On and create a web content filtering policy.

  Does this meet the goal?

  A. Yes
  B. No
  B. No

• Question 165:

  You have a Microsoft 365 tenant. Your company uses a third-party software as a service (SaaS) app named App1. App1 supports authenticating users by using Azure AD credentials.

  You need to recommend a solution to enable users to authenticate to App1 by using their Azure AD credentials.

  What should you include in the recommendation?

  A. Azure AD Application Proxy
  B. Azure AD B2C
  C. an Azure AD enterprise application
  D. a relying party trust in Active Directory Federation Services (AD FS)
  A. Azure AD Application Proxy

• Question 166:

  HOTSPOT

  Your company has offices in New York City and Los Angeles.

  The New York City office contains an on-premises app named Appl.

  You have an Azure subscription. The subscription is linked to a Microsoft Entra tenant that is hosted in North America.

  You plan to manage access to App1 for the users in the Los Angeles office by using Microsoft Entra Private Access. You will deploy Private Access by performing the following actions:

  1. Provision an ExpressRoute circuit from the New York City office to the closest peering location.

  2. Create an Azure virtual network named VNet1 in the East US Azure region.

  3. Deploy a Microsoft Entra application proxy connector to VNet1.

  You need to optimize the network for the planned deployment.

  The solution must meet the following requirements:

  1. Maximize redundancy for connectivity to App1.

  2. Minimize network latency when accessing App1

  3. Minimize complexity.

  4. Minimize costs.

  What should you include in the solution? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 167:

  Your company plans to deploy several Azure App Service web apps. The web apps will be deployed to the West Europe Azure region. The web apps will be accessed only by customers in Europe and the United States.

  You need to recommend a solution to prevent malicious bots from scanning the web apps for vulnerabilities. The solution must minimize the attach surface.

  What should you include in the recommendation?

  A. Azure Firewall Premium
  B. Azure Traffic Manager and application security groups
  C. Azure Application Gateway Web Application Firewall (WAF)
  D. network security groups (NSGs)
  C. Azure Application Gateway Web Application Firewall (WAF)

  ---

  Explanation

  To prevent malicious bots from scanning Azure App Service web apps for vulnerabilities while minimizing the attack surface for customers in Europe and the United States, you should recommend C. Azure Application Gateway Web Application Firewall (WAF).

  C. Azure Application Gateway Web Application Firewall (WAF): Azure Application Gateway with the Web Application Firewall (WAF) is specifically designed for web application security. It provides protection against common web vulnerabilities such as SQL injection, cross-site scripting (XSS), and more. It also includes bot protection capabilities, which can help prevent malicious bots from scanning web apps for vulnerabilities. This aligns with the requirement to prevent bot scanning while minimizing the attack surface.

• Question 168:

  Your company uses Azure Pipelines and Azure Repos to implement continuous integration and continuous deployment (CI/CD) workflows for the deployment of applications to Azure.

  You are updating the deployment process to align with DevSecOps controls guidance in the Microsoft Cloud Adoption Framework for Azure.

  You need to recommend a solution to ensure that all code changes are submitted by using pull requests before being deployed by the CI/CD workflow.

  What should you include in the recommendation?

  A. custom roles in Azure Pipelines
  B. branch policies in Azure Repos
  C. Azure policies
  D. custom Azure roles
  B. branch policies in Azure Repos

  ---

  Explanation

  Securing Azure Pipelines

  YAML pipelines offer the best security for your Azure Pipelines. In contrast to classic build and release pipelines, YAML pipelines:

  * Can be code reviewed. YAML pipelines are no different from any other piece of code. You can prevent malicious actors from introducing malicious steps in your pipelines by enforcing the use of Pull Requests to merge changes. Branch policies make it easy for you to set this up.

  * Etc.

  References:

  https://learn.microsoft.com/en-us/azure/devops/pipelines/security/overview

• Question 169:

  HOTSPOT

  You have an Azure subscription that contains a Microsoft Sentinel workspace named MSW1. MSW1 includes 50 scheduled analytics rules.

  You need to design a security orchestration automated response (SOAR) solution by using Microsoft Sentinel playbooks. The solution must meet the following requirements:

  1. Ensure that expiration dates can be configured when a playbook runs.

  2. Minimize the administrative effort required to configure individual analytics rules.

  What should you use to invoke the playbooks, and which type of Microsoft Sentinel trigger should you use? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 170:

  You have an on-premises server named Server1. Server1 is an FTP server that can be accessed by only the users at your company.

  You have an Azure subscription.

  You need to recommend a Zero Trust Network Access (ZTNA) solution to enforce Conditional Access policies when users access Server1 from the internet.

  What should you include in the recommendation?

  A. Microsoft Entra application proxy
  B. Microsoft Entra Internet Access
  C. Microsoft Entra Private Access
  D. Azure Application Gateway
  E. Azure Bastion
  C. Microsoft Entra Private Access