Microsoft SC-100 Online Practice Questions and Exam Preparation

Microsoft SC-100 Online Questions & Answers

• Question 221:

  You are designing the security standards for containerized applications onboarded to Azure.

  You are evaluating the use of Microsoft Defender for Containers.

  In which two environments can you use Defender for Containers to scan for known vulnerabilities?

  Each correct answer presents a complete solution.

  NOTE: Each correct selection is worth one point.

  A. Linux containers deployed to Azure Container Instances
  B. Windows containers deployed to Azure Kubernetes Service (AKS)
  C. Windows containers deployed to Azure Container Registry
  D. Linux containers deployed to Azure Container Registry
  E. Linux containers deployed to Azure Kubernetes Service (AKS)
  D. Linux containers deployed to Azure Container Registry
  E. Linux containers deployed to Azure Kubernetes Service (AKS)

  ---

  Explanation

  https://docs.microsoft.com/en-us/azure/defender-for-cloud/supported-machines-endpoint-solutions-clouds-containers?tabs=azure-aks#registries-and-images

  Windows is on preview.

  OS Packages Supported

  1. Alpine Linux 3.12-3.15

  2. Red Hat Enterprise Linux 6, 7, 8

  3. CentOS 6, 7

  4. Oracle Linux 6,6,7,8

  5. Amazon Linux 1,2

  6. openSUSE Leap 42, 15

  7. SUSE Enterprise Linux 11,12, 15 8. Debian GNU/Linux wheezy, jessie, stretch, buster, bullseye

  9. Ubuntu 10.10-22.04

  10. FreeBSD 11.1-13.1

  11. Fedora 32, 33, 34, 35

• Question 222:

  You have a Microsoft 365 tenant.

  You have an Azure subscription that contains Azure App Service web apps. The apps have the following characteristics:

  1. The apps use third-party and open-source components.

  2. The apps were developed by using C#, Python, and Java.

  3. The app deployment process is managed by using Azure DevOps.

  4. The source code for the apps is stored in GitHub Enterprise Cloud repositories and protected by using GitHub Advanced Security.

  You need to reduce the risk of supply chain attacks during the application lifecycle.

  What should you implement?

  A. secret scanning
  B. Dependabot alerts
  C. app governance in Microsoft Defender for Cloud Apps
  D. NuGet Audit
  B. Dependabot alerts

• Question 223:

  HOTSPOT

  You open Microsoft Defender for Cloud as shown in the following exhibit.

  

  Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: Azure Web Application Firewall (WAF)

  Restrict unauthorized network access control: 1 resource out of 11 needs to be addresses.

  Restrict unauthorized network access - Azure offers a suite of tools designed to ensure accesses across your network meet the highest security standards.

  Use these recommendations to manage Defender for Cloud's adaptive network hardening settings, ensure you've configured Azure Private Link for all relevant PaaS services, enable Azure Firewall on your virtual networks, and more.

  Note: Azure Web Application Firewall (WAF) is an optional addition to Azure Application Gateway.

  Azure WAF protects inbound traffic to the web workloads, and the Azure Firewall inspects inbound traffic for the other applications. The Azure Firewall will cover outbound flows from both workload types.

  Incorrect:

  Not network security groups (NSGs).

  Box 2: Microsoft Defender for servers Enable endpoint protection - Defender for Cloud checks your organization's endpoints for active threat detection and response solutions such as Microsoft Defender for Endpoint or any of the major solutions shown in this list.

  When an Endpoint Detection and Response (EDR) solution isn't found, you can use these recommendations to deploy Microsoft Defender for Endpoint (included as part of Microsoft Defender for servers).

  Incorrect:

  Not Microsoft Defender for Resource Manager: Microsoft Defender for Resource Manager does not handle endpoint protection.

  Microsoft Defender for Resource Manager automatically monitors the resource management operations in your organization, whether they're performed through the Azure portal, Azure REST APIs, Azure CLI, or other Azure programmatic clients. Defender for Cloud runs advanced security analytics to detect threats and alerts you about suspicious activity.

  References:

  https://docs.microsoft.com/en-us/azure/defender-for-cloud/secure-score-security-controls

• Question 224:

  You have a Microsoft 365 subscription and an Azure subscription. Microsoft 365 Defender and Microsoft Defender for Cloud are enabled.

  The Azure subscription contains 50 virtual machines. Each virtual machine runs different applications on Windows Server 2019.

  You need to recommend a solution to ensure that only authorized applications can run on the virtual machines. If an unauthorized application attempts to run or be installed, the application must be blocked automatically until an administrator authorizes the application.

  Which security control should you recommend?

  A. Azure Active Directory (Azure AD) Conditional Access App Control policies
  B. OAuth app policies in Microsoft Defender for Cloud Apps
  C. app protection policies in Microsoft Endpoint Manager
  D. application control policies in Microsoft Defender for Endpoint
  D. application control policies in Microsoft Defender for Endpoint

  ---

  Explanation

  https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create#windows-defender-application-control-policy-rules

• Question 225:

  You have an on-premises network that has several legacy applications. The applications perform LDAP queries against an existing directory service.

  You are migrating the on-premises infrastructure to a cloud-only infrastructure.

  You need to recommend an identity solution for the infrastructure that supports the legacy applications. The solution must minimize the administrative effort to maintain the infrastructure.

  Which identity service should you include in the recommendation?

  A. Microsoft Entra External ID
  B. Azure Active Directory Domain Services (Azure AD DS)
  C. Microsoft Entra ID
  D. Active Directory Domain Services (AD DS)
  B. Azure Active Directory Domain Services (Azure AD DS)

  ---

  Explanation

  Lightweight Directory Access Protocol (LDAP) is an application protocol for working with various directory services. Directory services, such as Active Directory, store user and account information, and security information like passwords. The service then allows the information to be shared with other devices on the network. Enterprise applications such as email, customer relationship managers (CRMs), and Human Resources (HR) software can use LDAP to authenticate, access, and find information.

  Azure Active Directory (Azure AD) supports this pattern via Azure AD Domain Services (AD DS). It allows organizations that are adopting a cloud-first strategy to modernize their environment by moving off their on-premises LDAP resources to the cloud. The immediate benefits will be:

  Integrated with Azure AD. Additions of users and groups, or attribute changes to their objects are automatically synchronized from your Azure AD tenant to AD DS. Changes to objects in on-premises Active Directory are synchronized to Azure AD, and then to AD DS.

  Simplify operations. Reduces the need to manually keep and patch on-premises infrastructures.

  Reliable. You get managed, highly available services

  References:

  https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/auth-ldap

• Question 226:

  HOTSPOT

  Your company, named Contoso. Ltd... has an Azure AD tenant namedcontoso.com. Contoso has a partner company named Fabrikam. Inc. that has an Azure AD tenant named fabrikam.com. You need to ensure that helpdesk users at Fabrikam can reset passwords for specific users at Contoso. The solution must meet the following requirements:

  1. Follow the principle of least privilege.

  2. Minimize administrative effort.

  What should you do? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

  

  

• Question 227:

  You have an Azure AD tenant that contains 10 Windows 11 devices and two groups named Group1 and Group2. The Windows 11 devices are joined to the Azure AD tenant and are managed by using Microsoft Intune.

  You are designing a privileged access strategy based on the rapid modernization plan (RaMP).

  The strategy will include the following configurations:

  1. Each user in Group1 will be assigned a Windows 11 device that will be configured as a privileged access device.

  2. The Security Administrator role will be mapped to the privileged access security level.

  3. The users in Group1 will be assigned the Security Administrator role.

  4. The users in Group2 will manage the privileged access devices.

  You need to configure the local Administrators group for each privileged access device. The solution must follow the principle of least privilege.

  What should you include in the solution?

  A. Only add Group2 to the local Administrators group.
  B. Configure Windows Local Administrator Password Solution (Windows LAPS) in legacy Microsoft LAPS emulation mode.
  C. Add Group2 to the local Administrators group. Add the user that is assigned the Security Administrator role to the local Administrators group of the user's assigned privileged access device.
  B. Configure Windows Local Administrator Password Solution (Windows LAPS) in legacy Microsoft LAPS emulation mode.

• Question 228:

  DRAG DROP

  Your company wants to optimize ransomware incident investigations.

  You need to recommend a plan to investigate ransomware incidents based on the Microsoft Detection and Response Team (DART) approach.

  Which three actions should you recommend performing in sequence in the plan? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  

  ---

  Step 1: Assess the current situation and identify the scope.

  The DART approach to conducting ransomware incident investigations

  You should make every effort to determine how the adversary gained access to your assets so that vulnerabilities can be remediated. Otherwise, it is highly likely that the same type of attack will take place again in the future. In some cases, the threat actor takes steps to cover their tracks and destroy evidence, so it is possible that the entire chain of events may not be evident.

  The following are three key steps in DART ransomware investigations:

  1. Assess the current situation Understand the scope

  What initially made you aware of a ransomware attack?

  What time/date did you first learn of the incident?

  What logs are available and is there any indication that the actor is currently accessing systems?

  Step 2: Identify which line-of-business (LOB) apps are unavailable due to a ransomware incident.

  2. Identify the affected line-of-business (LOB) apps Get systems back online

  Does the application require an identity?

  Are backups of the application, configuration, and data available?

  Are the content and integrity of backups regularly verified using a restore exercise?

  Step 3: Identify the compromise recovery process.

  3. Determine the compromise recovery (CR) process Remove attacker control from the environment

  References:

  https://learn.microsoft.com/en-us/security/compass/incident-response-playbook-dart-ransomware-approach

• Question 229:

  You have a Microsoft Entra tenant with 500 Windows devices that have the Global Secure Access client deployed.

  You are planning to implement Global Secure Access to manage access to a third-party Software as a Service (SaaS) app named App1.

  You need to recommend a solution to manage connections to App1, ensuring that users authenticate using their Microsoft Entra credentials before they can access App1.

  What should you include in the recommendation?

  A. a Global Secure Access app
  B. a private access traffic forwarding profile
  C. an internet access traffic forwarding profile
  D. a Quick Access app
  A. a Global Secure Access app

  ---

  Explanation

  A Global Secure Access app is the best solution to manage access to a third-party SaaS application, such as App1. By configuring this app within Microsoft Entra, you can enforce authentication policies that require users to log in with their Microsoft Entra credentials before accessing the SaaS application. This setup provides centralized access management, secure access controls, and ensures consistent user authentication for App1.

• Question 230:

  Your company is moving a big data solution to Azure.

  The company plans to use the following storage workloads:

  1. Azure Storage blob containers

  2. Azure Data Lake Storage Gen2

  3. Azure Storage file shares

  4. Azure Disk Storage

  Which two storage workloads support authentication by using Azure AD? Each correct answer presents a complete solution.

  NOTE: Each correct selection is worth one point.

  A. Azure Storage file shares
  B. Azure Disk Storage
  C. Azure Storage blob containers
  D. Azure Data Lake Storage Gen2
  C. Azure Storage blob containers
  D. Azure Data Lake Storage Gen2

  ---

  Explanation

  C: Azure Storage supports using Azure Active Directory (Azure AD) to authorize requests to blob data. With Azure AD, you can use Azure role-based access control (Azure RBAC) to grant permissions to a security principal, which may be a user, group, or application service principal. The security principal is authenticated by Azure AD to return an OAuth 2.0 token. The token can then be used to authorize a request against the Blob service.

  You can scope access to Azure blob resources at the following levels, beginning with the narrowest scope:

  * An individual container. At this scope, a role assignment applies to all of the blobs in the container, as well as container properties and metadata.

  * The storage account.

  * The resource group.

  * The subscription.

  * A management group.

  D: You can securely access data in an Azure Data Lake Storage Gen2 (ADLS Gen2) account using OAuth 2.0 with an Azure Active Directory (Azure AD) application service principal for authentication. Using a service principal for authentication provides two options for accessing data in your storage account:

  A mount point to a specific file or path Direct access to data

  Incorrect:

  Not A: To enable AD DS authentication over SMB for Azure file shares, you need to register your storage account with AD DS and then set the required domain properties on the storage account. To register your storage account with AD DS, create an account representing it in your AD DS.

  References:

  https://docs.microsoft.com/en-us/azure/storage/blobs/authorize-access-azure-active-directory

  https://docs.microsoft.com/en-us/azure/databricks/data/data-sources/azure/adls-gen2/azure-datalake-gen2-sp-access