Microsoft SC-100 Online Practice Questions and Exam Preparation

Microsoft SC-100 Online Questions & Answers

• Question 191:

  You have a Microsoft 365 subscription.

  You have a Conditional Access policy that has the following settings:

  1. Name: Policy 1

  2. Assignments o Users:

  3. Include: All users o Target resources

  4. Include: Select apps; Office

  365. o Network

  5. Include: Any network or location.

  6. Exclude: Selected networks and locations; Site1. o Access controls

  7. Grant: Require multifactor authentication, Require Hybrid Microsoft Entra joined device.

  You plan to implement Zero Trust Rapid Modernization Plan (RaMP).

  You need to ensure that Policy1 aligns with best practice recommendations in RaMP.

  Which setting should you change?

  A. Include: Any network or location
  B. Exclude: Selected networks and locations; Site1
  C. Grant Require Hybrid Microsoft Entra joined device
  D. Grant: Require multifactor authentication
  B. Exclude: Selected networks and locations; Site1

• Question 192:

  You have 50 Azure subscriptions.

  You need to monitor the resource in the subscriptions for compliance with the ISO 27001:2013 standards. The solution must minimize the effort required to modify the list of monitored policy definitions for the subscriptions.

  What are two ways to achieve the goal? Each correct answer presents a complete solution.

  NOTE: Each correct selection is worth one point.

  A. Assign an initiative to a management group.
  B. Assign a policy to each subscription.
  C. Assign a policy to a management group.
  D. Assign an initiative to each subscription.
  E. Assign a blueprint to each subscription.
  F. Assign a blueprint to a management group.
  A. Assign an initiative to a management group.
  F. Assign a blueprint to a management group.

  ---

  Explanation

  An Azure Management group is logical containers that allow Azure Administrators to manage access, policy, and compliance across multiple Azure Subscriptions en masse.

  If your organization has many Azure subscriptions, you may need a way to efficiently manage access, policies, and compliance for those subscriptions. Management groups provide a governance scope above subscriptions. You organize subscriptions into management groups the governance conditions you apply cascade by inheritance to all associated subscriptions.

  F: Blueprint definition locations

  When creating a blueprint definition, you'll define where the blueprint is saved. Blueprints can be saved to a management group or subscription that you have Contributor access to. If the location is a management group, the blueprint is available to assign to any child subscription of that management group.

  A: Create and assign an initiative definition With an initiative definition, you can group several policy definitions to achieve one overarching goal. An initiative evaluates resources within scope of the assignment for compliance to the included policies.

  Note: The Azure Policy Regulatory Compliance built-in initiative definition maps to compliance domains and controls in ISO 27001:2013. The Azure Policy control mapping provides details on policy definitions included within this blueprint and how these policy definitions map to the compliance domains and controls in ISO 27001. When assigned to an architecture, resources are evaluated by Azure Policy for non-compliance with assigned policy definitions.

  Incorrect:

  Not B, D, E: If you plan to apply this policy definition to multiple subscriptions, the location must be a management group that contains the subscriptions you assign the policy to. The same is true for an initiative definition.

  References:

  https://docs.microsoft.com/en-us/azure/governance/management-groups/overview

  https://docs.microsoft.com/en-us/azure/governance/blueprints/overview

  https://docs.microsoft.com/en-us/azure/governance/policy/samples/iso-27001

  https://docs.microsoft.com/en-us/azure/governance/policy/tutorials/create-and-manage

• Question 193:

  HOTSPOT

  Your company has a multi-cloud environment that contains a Microsoft 365 subscription, an Azure subscription, and Amazon Web Services (AWS) implementation.

  You need to recommend a security posture management solution for the following components:

  1. Azure IoT Edge devices

  2. AWS EC2 instances

  Which services should you include in the recommendation? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: Microsoft Defender for IoT Microsoft Defender for IoT is a unified security solution for identifying IoT and OT devices, vulnerabilities, and threats and managing them through a central interface.

  Azure IoT Edge provides powerful capabilities to manage and perform business workflows at the edge. The key part that IoT Edge plays in IoT environments make it particularly attractive for malicious actors.

  Defender for IoT azureiotsecurity provides a comprehensive security solution for your IoT Edge devices. Defender for IoT module collects, aggregates and analyzes raw security data from your Operating System and container system into actionable security recommendations and alerts.

  Box 2: Microsoft Defender for Cloud and Azure Arc Microsoft Defender for Cloud provides the following features in the CSPM (Cloud Security Posture Management) category in the multi-cloud scenario for AWS. Take into account that some of them require Defender plan to be enabled (such as Regulatory Compliance):

  * Detection of security misconfigurations

  * Single view showing Security Center recommendations and AWS Security Hub findings

  * Incorporation of AWS resources into Security Center's secure score calculations

  * Regulatory compliance assessments of AWS resources

  Security Center uses Azure Arc to deploy the Log Analytics agent to AWS instances.

  Incorrect:

  AWS EC2 Microsoft Defender for Cloud Apps Amazon Web Services is an IaaS provider that enables your organization to host and manage their entire workloads in the cloud. Along with the benefits of leveraging infrastructure in the cloud, your organization's most critical assets may be exposed to threats. Exposed assets include storage instances with potentially sensitive information, compute resources that operate some of your most critical applications, ports, and virtual private networks that enable access to your organization.

  Connecting AWS to Defender for Cloud Apps helps you secure your assets and detect potential threats by monitoring administrative and sign-in activities, notifying on possible brute force attacks, malicious use of a privileged user account, unusual deletions of VMs, and publicly exposed storage buckets.

  References:

  https://docs.microsoft.com/en-us/azure/defender-for-iot/device-builders/security-edge-architecture

  https://samilamppu.com/2021/11/04/multi-cloud-security-posture-management-in-microsoft-defender-for-cloud/

• Question 194:

  You have a Microsoft 365 subscription and an Azure subscription. Microsoft 365 Defender and Microsoft Defender for Cloud are enabled.

  The Azure subscription contains 50 virtual machines. Each virtual machine runs different applications on Windows Server 2019.

  You need to recommend a solution to ensure that only authorized applications can run on the virtual machines. If an unauthorized application attempts to run or be installed, the application must be blocked automatically until an administrator authorizes the application.

  Which security control should you recommend?

  A. adaptive application controls in Defender for Cloud
  B. app protection policies in Microsoft Endpoint Manager
  C. app discovery anomaly detection policies in Microsoft Defender for Cloud Apps
  D. Azure Security Benchmark compliance controls in Defender for Cloud
  A. adaptive application controls in Defender for Cloud

  ---

  Explanation

  Adaptive application controls are an intelligent and automated solution for defining allowlists of known-safe applications for your machines.

  Often, organizations have collections of machines that routinely run the same processes. Microsoft Defender for Cloud uses machine learning to analyze the applications running on your machines and create a list of the known-safe software.

  Allowlists are based on your specific Azure workloads, and you can further customize the recommendations using the instructions below.

  When you've enabled and configured adaptive application controls, you'll get security alerts if any application runs other than the ones you've defined as safe.

  Incorrect:

  Not B: App protection policies (APP) are rules that ensure an organization's data remains safe or contained in a managed app. A policy can be a rule that is enforced when the user attempts to access or move "corporate" data, or a set of actions that are prohibited or monitored when the user is inside the app. A managed app is an app that has app protection policies applied to it, and can be managed by Intune.

  Not C: Cloud Discovery anomaly detection policy reference. A Cloud Discovery anomaly detection policy enables you to set up and configure continuous monitoring of unusual increases in cloud application usage. Increases in downloaded data, uploaded data, transactions, and users are considered for each cloud application.

  Not D: The Azure Security Benchmark (ASB) provides prescriptive best practices and recommendations to help improve the security of workloads, data, and services on Azure. This benchmark is part of a set of holistic security guidance.

  References:

  https://docs.microsoft.com/en-us/azure/defender-for-cloud/adaptive-application-controls

  https://docs.microsoft.com/en-us/mem/intune/apps/app-protection-policy

  https://docs.microsoft.com/en-us/defender-cloud-apps/cloud-discovery-anomaly-detection-policy

  https://docs.microsoft.com/en-us/security/benchmark/azure/overview

• Question 195:

  You have a Microsoft 365 subscription that includes 1,000 users, each assigned a Microsoft 365 E5 license.

  The subscription utilizes sensitivity labels to classify corporate documents. All users have Windows 11 devices, which are onboarded to Microsoft Defender for Endpoint, and are configured to sync files to Microsoft OneDrive.

  You need to prevent users from uploading documents from OneDrive to external websites.

  What should you include in the solution?

  A. Microsoft Purview Information Protection
  B. Microsoft Purview data loss prevention (DLP)
  C. web content filtering in Defender for Endpoint
  D. an endpoint security policy
  B. Microsoft Purview data loss prevention (DLP)

  ---

  Explanation

  Microsoft Purview Data Loss Prevention (DLP) policies help protect sensitive information by preventing data leakage and restricting data sharing, even across cloud platforms. By using DLP, you can define rules that prevent users from uploading classified documents, such as those with sensitivity labels, from OneDrive to unauthorized external websites. DLP policies can control actions like copy, download, and upload based on content classification, location, and user context.

• Question 196:

  DRAG DROP

  You need to design a solution to accelerate a Zero Trust security implementation. The solution must be based on the Zero Trust Rapid Modernization Plan (RaMP).

  Which three initiatives should you include in the solution, and in which order should you implement the initiatives?

  Each correct answer presents part of the solution. Each correct selection is worth one point.

  Select and Place:

  

  

• Question 197:

  Your company has a main office and 10 branch offices. Each branch office contains an on-premises file server that runs Windows Server and multiple devices that run either Windows 11 or macOS. The devices are enrolled in Microsoft Intune.

  You have a Microsoft Entra tenant.

  You need to deploy Global Secure Access to implement web filtering for device traffic to the internet.

  The solution must ensure that all the web traffic from the devices in the branch offices is controlled by using Global Secure Access.

  What should you do first in each branch office?

  A. Configure an Intune policy to deploy the Global Secure Access client to each device.
  B. Configure an IPsec tunnel on the router.
  C. Install the Microsoft Entra private network connector on the file server.
  D. Configure an Intune policy to onboard Microsoft Defender for Endpoint to each device.
  B. Configure an IPsec tunnel on the router.

• Question 198:

  Your company is developing a serverless application in Azure that will have the architecture shown in the following exhibit.

  

  You need to recommend a solution to isolate the compute components on an Azure virtual network.

  What should you include in the recommendation?

  A. Microsoft Entra enterprise applications
  B. an Azure App Service Environment (ASE)
  C. Azure service endpoints
  D. an Azure Active Directory (Azure AD) application proxy
  B. an Azure App Service Environment (ASE)

  ---

  Explanation

  The Azure App Service Environment v2 is an Azure App Service feature that provides a fully isolated and dedicated environment for securely running App Service apps at high scale. This capability can host your:

  1. Windows web apps

  2. Linux web apps

  3. Docker containers

  4. Mobile apps

  5. Functions

  App Service environments (ASEs) are appropriate for application workloads that require: Very high scale.

  Isolation and secure network access.

  High memory utilization.

  Customers can create multiple ASEs within a single Azure region or across multiple Azure regions. This flexibility makes ASEs ideal for horizontally scaling stateless application tiers in support of high requests per second (RPS) workloads.

  References:

  https://docs.microsoft.com/en-us/azure/app-service/environment/intro

• Question 199:

  HOTSPOT

  You have an Azure subscription that contains an Azure Kubernetes Service (AKS) cluster named AKS1.

  AKS1 hosts a Windows node pool named Pool1 and a Linux node pool named Pool2.

  You are designing a pool update strategy for AKS1.

  You need to recommend how often to replace the operating system images deployed to the nodes.

  The solution must meet the following requirements:

  1. Minimize how long it takes to apply operating system updates once the updates are released.

  2. Minimize administrative effort.

  What should you recommend for each pool? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 200:

  You have an Azure subscription that contains a web app named App1. App1 uses a Microsoft Entra user account named SRV1 as a service account to authenticate to an Azure SQL database named DB1.

  You discover that a developer accessed DB1 directly by using SRV1.

  You need to recommend a secure authentication method that will prevent credential misuse outside of App1. The solution must minimize administrative effort.

  What should you recommend?

  A. a managed identity
  B. a group managed service account (gMSA)
  C. a delegated managed service account (dMSA)
  D. a federated identity credential
  A. a managed identity