Microsoft SC-100 Online Practice Questions and Exam Preparation

Microsoft SC-100 Online Questions & Answers

• Question 201:

  HOTSPOT

  You are designing an auditing solution for Azure landing zones that will contain the following components:

  1. SQL audit logs for Azure SQL databases

  2. Windows Security logs from Azure virtual machines

  3. Azure App Service audit logs from App Service web apps

  You need to recommend a centralized logging solution for the landing zones. The solution must meet the following requirements:

  1. Log all privileged access.

  2. Retain logs for at least 365 days.

  3. Minimize costs.

  What should you include in the recommendation? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

  

  

• Question 202:

  For a Microsoft cloud environment, you are designing a security architecture based on the Microsoft Cloud Security Benchmark.

  What are three best practices for identity management based on the Azure Security Benchmark? Each correct answer presents a complete solution.

  NOTE: Each correct selection is worth one point.

  A. Manage application identities securely and automatically.
  B. Manage the lifecycle of identities and entitlements
  C. Protect identity and authentication systems.
  D. Enable threat detection for identity and access management.
  E. Use a centralized identity and authentication system.
  A. Manage application identities securely and automatically.
  C. Protect identity and authentication systems.
  E. Use a centralized identity and authentication system.

• Question 203:

  You have an Azure subscription.

  Your company has a governance requirement that resources must be created in the West Europe or North Europe Azure regions.

  What should you recommend using to enforce the governance requirement?

  A. Azure management groups
  B. custom Azure roles
  C. Azure Policy assignments
  D. regulatory compliance standards in Microsoft Defender for Cloud
  C. Azure Policy assignments

  ---

  Explanation

  Azure Policy helps to enforce organizational standards and to assess compliance at-scale.

  Common use cases for Azure Policy include implementing governance for resource consistency, regulatory compliance, security, cost, and management. Policy definitions for these common use cases are already available in your Azure environment as built-ins to help you get started.

  Specifically, some useful governance actions you can enforce with Azure Policy include:

  Ensuring your team deploys Azure resources only to allowed regions Enforcing the consistent application of taxonomic tags Requiring resources to send diagnostic logs to a Log Analytics workspace

  Note: Once your business rules have been formed, the policy definition or initiative is assigned to any scope of resources that Azure supports, such as management groups, subscriptions, resource groups, or individual resources. The assignment applies to all resources within the Resource Manager scope of that assignment.

  References:

  https://learn.microsoft.com/en-us/azure/governance/policy/overview

• Question 204:

  HOTSPOT

  You have an Azure subscription.

  You plan to implement Azure Synapse Analytics SQL dedicated pools and SQL serverless pools.

  You need to recommend a solution to provide additional encryption-at-rest security for each type of pool. The solution must use customer-managed keys, whenever possible.

  What should you recommend for each pool type? To answer, drag the appropriate recommendations to the correct pool types. Each recommendation may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

  NOTE: Each correct selection is worth one point.

  

  

• Question 205:

  You plan to deploy 20 Azure Kubernetes Service (AKS) clusters. The cluster configuration will be managed declaratively by using Kubernetes manifest files stored in Azure Repos.

  You need to recommend a solution to ensure that the configuration of all the clusters remains consistent by using the manifest files stored in Azure Repos.

  What should you include in the recommendation?

  A. Gatekeeper
  B. Dependency Tracker
  C. Dependency
  D. Flux
  D. Flux

• Question 206:

  You have an Azure subscription that is linked to a Microsoft Entra tenant.

  You plan deploy an enterprise application named App1. App1 requires LDAP to look up attributes related to Microsoft Entra users.

  You need to recommend a solution to support the LDAP requirement.

  What should you recommend?

  A. Configure a Conditional Access policy that has a trusted network location.
  B. Deploy Microsoft Entra Private Access.
  C. Deploy Microsoft Entra Domain Services.
  D. Implement pass-through authentication.
  C. Deploy Microsoft Entra Domain Services.

• Question 207:

  HOTSPOT

  You need to recommend a solution to meet the requirements for connections to ClaimsDB.

  What should you recommend using for each requirement? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: A private endpoint

  Scenario: An Azure SQL database named ClaimsDB that contains a table named ClaimDetails Requirements. ClaimsApp Deployment.

  Fabrikam plans to implement an internet-accessible application named ClaimsApp that will have the following specifications:

  1. ClaimsApp will be deployed to Azure App Service instances that connect to Vnet1 and Vnet2.

  2. Users will connect to ClaimsApp by using a URL of

  https://claims.fabrikam.com.

  3. ClaimsApp will access data in ClaimsDB.

  4. ClaimsDB must be accessible only from Azure virtual networks.

  5. The app services permission for ClaimsApp must be assigned to ClaimsDB.

  Web app private connectivity to Azure SQL Database.

  Architecture:

  

  Workflow 1. Using Azure App Service regional VNet Integration, the web app connects to Azure through an AppSvcSubnet delegated subnet in an Azure Virtual Network.

  2. In this example, the Virtual Network only routes traffic and is otherwise empty, but other subnets and workloads could also run in the Virtual Network.

  3. The App Service and Private Link subnets could be in separate peered Virtual Networks, for example as part of a hub-and-spoke network configuration.

  4. Azure Private Link sets up a private endpoint for the Azure SQL Database in the PrivateLinkSubnet of the Virtual Network.

  5. The web app connects to the SQL Database private endpoint through the PrivateLinkSubnet of the Virtual Network.

  The database firewall allows only traffic coming from the PrivateLinkSubnet to connect, making the database inaccessible from the public internet.

  Box 2: A managed identity Managed identities for Azure resources provide Azure services with an automatically managed identity in Azure Active Directory. Using a managed identity, you can authenticate to any service that supports Azure AD authentication without managing credentials.

  References:

  https://docs.microsoft.com/en-us/azure/architecture/example-scenario/private-web-app/private-web-app

  https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/managed-identities-status

• Question 208:

  Your company has an Azure subscription that uses Azure Storage.

  The company plans to share specific blobs with vendors.

  You need to recommend a solution to provide the vendors with secure access to specific blobs without exposing the blobs publicly. The access must be time-limited.

  What should you include in the recommendation?

  A. Configure private link connections.
  B. Configure encryption by using customer-managed keys (CMKs).
  C. Share the connection string of the access key.
  D. Create shared access signatures (SAS).
  D. Create shared access signatures (SAS).

  ---

  Explanation

  A shared access signature (SAS) provides secure delegated access to resources in your storage account. With a SAS, you have granular control over how a client can access your data. For example:

  What resources the client may access.

  What permissions they have to those resources.

  How long the SAS is valid.

  Types of shared access signatures Azure Storage supports three types of shared access signatures:

  User delegation SAS

  Service SAS

  Account SAS

  References:

  https://docs.microsoft.com/en-us/azure/storage/common/storage-sas-overview

• Question 209:

  HOTSPOT

  You have an Azure subscription and an on-premises datacenter. The datacenter contains 100 servers that run Windows Server. All the servers are backed up to a Recovery Services vault by using Azure Backup and the Microsoft Azure Recovery Services (MARS) agent.

  You need to design a recovery solution for ransomware attacks that encrypt the on-premises servers. The solution must follow Microsoft Security Best Practices and protect against the following risks:

  1. A compromised administrator account used to delete the backups from Azure Backup before encrypting the servers

  2. A compromised administrator account used to disable the backups on the MARS agent before encrypting the servers

  What should you use for each risk? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: Soft delete of backups

  How to block intentional or unintentional deletion of backup data?

  Enable Soft delete is enabled to protect backups from accidental or malicious deletes.

  Soft delete is a useful feature that helps you deal with data loss. Soft delete retains backup data for 14 days, allowing the recovery of that backup item before it's permanently lost.

  Box 2: Multi-user authorization by using Resource Guard Ensure Multi-user authorization (MUA) is enabled for an additional layer of protection.

  MUA for Azure Backup uses a new resource called Resource Guard to ensure critical operations, such as disabling soft delete, stopping and deleting backups, or reducing retention of backup policies, are performed only with applicable authorization.

  References:

  https://learn.microsoft.com/en-us/azure/backup/protect-backups-from-ransomware-faq

• Question 210:

  You need to recommend a solution to resolve the virtual machine issue.

  What should you include in the recommendation?(Choose Two)

  A. Onboard the virtual machines to Microsoft Defender for Endpoint.
  B. Onboard the virtual machines to Azure Arc.
  C. Create a device compliance policy in Microsoft Endpoint Manager.
  D. Enable the Qualys scanner in Defender for Cloud.
  A. Onboard the virtual machines to Microsoft Defender for Endpoint.
  D. Enable the Qualys scanner in Defender for Cloud.

  ---

  Explanation

  Scenario: 20 virtual machines that are configured as application servers and are NOT onboarded to Microsoft Defender for Cloud.

  Existing Environment. Problem Statements

  The secure score in Defender for Cloud shows that all the virtual machines generate the following recommendation: Machines should have a vulnerability assessment solution.

  All the virtual machines must be compliant in Defender for Cloud.

  Note: Deploying Microsoft Defender for Endpoint is a two-step process.

  Onboard devices to the service Configure capabilities of the service

  References:

  https://docs.microsoft.com/en-us/azure/defender-for-cloud/deploy-vulnerability-assessment-vm

  https://docs.microsoft.com/en-us/microsoft-365/security/defenderendpoint/switch-to-mde-phase-3?view=o365-worldwide