Microsoft SC-100 Online Practice Questions and Exam Preparation

Microsoft SC-100 Online Questions & Answers

• Question 171:

  HOTSPOT

  You are evaluating the security of ClaimsApp.

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: No

  Box 2: Yes

  Users will connect to ClaimsApp by using a URL of

  https://claims.fabrikam.com.NeedcertificateforHTTPS.

  TLS/SSL certificates

  To enable the HTTPS protocol for securely delivering content on a Front Door custom domain, you must use a TLS/SSL certificate. You can choose to use a certificate that is managed by Azure Front Door or use your own certificate.

  Box 3: Yes

  By default, Azure Front Door will respond to all user requests regardless of the location where the request is coming from. In some scenarios, you may want to restrict the access to your web application by countries/regions. The Web application firewall (WAF) service in Front Door enables you to define a policy using custom access rules for a specific path on your endpoint to either allow or block access from specified countries/regions.

  Note: Requirements. Security Requirements

  Fabrikam identifies the following security requirements:

  Internet-accessible applications must prevent connections that originate in North Korea.

  References:

  https://techcommunity.microsoft.com/t5/azure-architecture-blog/permit-access-only-from-azure-front-door-to-azure-app-service-as/ba-p/2000173

  https://docs.microsoft.com/en-us/azure/frontdoor/front-door-custom-domain-https#tlsssl-certificates

• Question 172:

  Your company is developing an invoicing application that will use Azure Active Directory (Azure AD) B2C. The application will be deployed as an App Service web app.

  You need to recommend a solution to the application development team to secure the application from identity-related attacks.

  Which two configurations should you recommend? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. Azure AD workbooks to monitor risk detections
  B. Azure AD Conditional Access integration with user flows and custom policies
  C. smart account lockout in Azure AD B2C
  D. access packages in Identity Governance
  E. custom resource owner password credentials (ROPC) flows in Azure AD B2C
  B. Azure AD Conditional Access integration with user flows and custom policies
  C. smart account lockout in Azure AD B2C

  ---

  Explanation

  B. Azure AD Conditional Access integration with user flows and custom policies

  C. Smart account lockout in Azure AD B2C. Conditional Access in Azure Active Directory (Azure AD) is a feature that enables you to enforce security policies and control access to applications based on specific conditions

  https://docs.microsoft.com/en-us/azure/active-directory-b2c/threat-management

  https://docs.microsoft.com/en-us/azure/active-directory-b2c/conditional-access-user-flow?pivots=b2c-user-flow

• Question 173:

  You have an Azure subscription that contains SQL Server on Azure virtual machines located in the West US Azure region. The virtual machines are only accessible by using private IP addresses.

  You plan to deploy a Windows-based Azure App Service web apps in the East US Azure region.

  You need to recommend a solution to provide the web apps access to the SQL Server databases.

  What should you include in the recommendation?

  A. an Azure VPN gateway
  B. a private endpoint
  C. a service endpoint
  D. an Azure Bastion host
  A. an Azure VPN gateway

• Question 174:

  HOTSPOT

  You are designing new Azure applications based on security best practices from the Microsoft Cloud Adoption Framework for Azure.

  Each application will be deployed to a dedicated and secure environment that will contain isolated instances of the following key Azure security resources:

  1. Azure Key Vault

  2. Virtual networks

  3. An Azure subscription

  4. Azure Policy assignments

  5. Network security groups (NSGs)

  6. Role-based access control (RBAC) assignments.

  You need to recommend which type of environment and which module to use to deploy the applications.

  The solution must use infrastructure as code (IaC) to deploy each application environment.

  What should you recommend? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 175:

  Your on-premises network contains an Active Directory Domain Services (AD DS) domain and a hybrid deployment between a Microsoft Exchange Server 2019 organization and an Exchange Online tenant. The AD DS domain contains a group named Group1. Group1 is a member of the Organization Management role group for the Exchange deployment.

  You have a Microsoft 365 E5 subscription that uses Microsoft Defender.

  You have an Azure subscription that uses Microsoft Sentinel.

  You need to recommend a solution to ensure that Group1 is marked as a sensitive group and that any changes made to Group1 raises an alert in Microsoft Sentinel. The solution must minimize administrative effort.

  What should you include in the recommendation?

  A. Microsoft Entra ID Protection
  B. Microsoft Defender for Identity
  C. Microsoft Defender for Office 365
  D. Microsoft Entra Privileged Identity Management (PIM)
  B. Microsoft Defender for Identity

• Question 176:

  You have an Azure subscription that contains virtual machines.

  Port 3389 and port 22 are disabled for outside access.

  You need to design a solution to provide administrators with secure remote access to the virtual machines. The solution must meet the following requirements:

  1. Prevent the need to enable ports 3389 and 22 from the internet.

  2. Only provide permission to connect the virtual machines when required.

  3. Ensure that administrators use the Azure portal to connect to the virtual machines.

  Which two actions should you include in the solution? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. Configure Azure VPN Gateway.
  B. Enable Just Enough Administration (JEA).
  C. Configure Azure Bastion.
  D. Enable just-in-time (JIT) VM access.
  E. Enable Azure AD Privileged Identity Management (PIM) roles as virtual machine contributors.
  C. Configure Azure Bastion.
  D. Enable just-in-time (JIT) VM access.

  ---

  Explanation

  C: Bastion provides secure remote access.

  It uses RDP/SSH session is over TLS on port 443.

  Note: Azure Bastion is a service you deploy that lets you connect to a virtual machine using your browser and the Azure portal. The Azure Bastion service is a fully platform-managed PaaS service that you provision inside your virtual network.

  It provides secure and seamless RDP/SSH connectivity to your virtual machines directly from the Azure portal over TLS. When you connect via Azure Bastion, your virtual machines don't need a public IP address, agent, or special client software.

  D: Lock down inbound traffic to your Azure Virtual Machines with Microsoft Defender for Cloud's just-in-time (JIT) virtual machine (VM) access feature. This reduces exposure to attacks while providing easy access when you need to connect to a VM.

  Meets the requirement: Only provide permission to connect the virtual machines when required

  Incorrect:

  Not B: Does not address: Only provide permission to connect the virtual machines when required Just Enough Administration (JEA) is a security technology that enables delegated administration for anything managed by PowerShell. With JEA, you can:

  Reduce the number of administrators on your machines using virtual accounts or group-managed service accounts to perform privileged actions on behalf of regular users.

  Limit what users can do by specifying which cmdlets, functions, and external commands they can run.

  Better understand what your users are doing with transcripts and logs that show you exactly which commands a user executed during their session.

  Not E: Does not help with the remote access.

  Note:

  Classic Virtual Machine Contributor: Lets you manage classic virtual machines, but not access to them, and not the virtual network or storage account they're connected to.

  References:

  https://docs.microsoft.com/en-us/powershell/scripting/learn/remoting/jea/overview?view=powershell-7.2

  https://docs.microsoft.com/en-us/azure/defender-for-cloud/just-in-time-access-usage

  https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles

• Question 177:

  HOTSPOT

  You have a hybrid cloud infrastructure.

  You plan to deploy the Azure applications shown in the following table.

  

  What should you use to meet the requirement of each app? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: Azure Application Gateway Web Application Firewall policies

  Azure Application Gateway is a web traffic load balancer that enables you to manage traffic to your web applications.

  Azure Web Application Firewall is a cloud-native service that protects web apps from common web-hacking techniques such as SQL injection and security vulnerabilities such as cross-site scripting.

  Box 2: Azure Active Directory B2C with Conditional Access

  You can set up sign-up and sign-in with a LinkedIn account using Azure Active Directory B2C.

  You can enhance the security of Azure Active Directory B2C (Azure AD B2C) with Azure AD Identity Protection and Conditional Access.

  Incorrect:

  * Azure VPN Gateway with network security group rules NSGs cannot protect against XSS.

  References:

  https://learn.microsoft.com/en-us/azure/application-gateway/overview

  https://azure.microsoft.com/en-us/products/web-application-firewall/#overview

  https://learn.microsoft.com/en-us/azure/active-directory-b2c/identity-provider-linkedin

• Question 178:

  You have a Microsoft 365 subscription. You have an Azure subscription.

  You need to implement a Microsoft Purview communication compliance solution for Microsoft Teams and Yammer. The solution must meet the following requirements:

  1. Assign compliance policies to Microsoft 365 groups based on custom Microsoft Exchange Online attributes.

  2. Minimize the number of compliance policies

  3. Minimize administrative effort

  What should you include in the solution?

  A. Azure AD Information Protection labels
  B. Microsoft 365 Defender user tags
  C. adaptive scopes
  D. administrative units
  C. adaptive scopes

• Question 179:

  You have an Azure subscription that has Microsoft Defender for Cloud enabled. Suspicious authentication activity alerts have been appearing in the Workload protections dashboard.

  You need to recommend a solution to evaluate and remediate the alerts by using workflow automation. The solution must minimize development effort.

  What should you include in the recommendation?

  A. Azure Monitor webhooks
  B. Azure Logics Apps
  C. Azure Event Hubs
  D. Azure Functions apps
  B. Azure Logics Apps

  ---

  Explanation

  The workflow automation feature of Microsoft Defender for Cloud feature can trigger Logic Apps on security alerts, recommendations, and changes to regulatory compliance.Note: Azure Logic Apps is a cloud-based platform for creating and running automated workflows that integrate your apps, data, services, and systems. With this platform, you can quickly develop highly scalable integration solutions for your enterprise and business-to-business (B2B) scenarios.

• Question 180:

  HOTSPOT

  You have an Azure subscription that contains the resources shown in the following table.

  

  You need to recommend a network security solution for App1. The solution must meet the following requirements:

  1. Only the virtual machines that are connected to Subnet1 must be able to connect to D81.

  2. DB1 must be inaccessible from the internet

  3. Costs must be minimized.

  What should you include in the recommendation? To answer, select the options in the answer area. NOTE: Each correct answer is worth one point.