Microsoft SC-100 Online Practice Questions and Exam Preparation

Microsoft SC-100 Online Questions & Answers

• Question 231:

  HOTSPOT

  You have 1,000 on-premises servers that run Linux.

  You have an Azure subscription that contains a Microsoft Sentinel workspace named WS1 and 1,000 virtual machines that run Linux.

  All the on-premises Linux servers are onboarded to Azure Arc.

  You plan to collect Common Event Format (CEF) logs by using the Azure Monitor Agent connector in Microsoft Sentinel.

  You need to design a solution for collecting specific events from the logs. The solution must meet the following requirements:

  1. Minimize the number of Microsoft Entra ID identities required.

  2. Minimize the number of events delivered to WS1.

  3. Ensure that all the required events are ingested.

  4. Minimize administrative effort.

  What should you include in the solution? To answer, select the options in the answer area.

  NOTE: Each correct answer is worth one point.

  

  

• Question 232:

  You have a Microsoft 365 subscription that contains 1,000 users and a group named Group1. All the users have Windows 11 devices. The users sign in to their devices by using their Microsoft Entra account. The users do NOT have administrative rights to their devices.

  The members of Group1 remotely assist the users by taking control of user sessions. The remote control sessions run in the security context of the users they are assisting.

  You need to recommend a solution that will enable the Group1 members to run apps that require administrative rights to the users' devices. The solution must ensure that the apps are run in the context of each signed-in standard user.

  What should you include in the recommendation?

  A. Windows Local Administrator Password Solution (Windows LAPS)
  B. Microsoft Entra Permissions Management
  C. Microsoft Intune Endpoint Privilege Management
  D. Privileged Identity Management (PIM) in Microsoft Entra ID
  C. Microsoft Intune Endpoint Privilege Management

• Question 233:

  Your network contains an Active Directory Domain Services (AD DS) domain.

  You need to ensure that the built-in administrator account for the domain can be used only for interactive sign-ins to domain controllers.

  What should you configure?

  A. the Protected Users group
  B. authentication policies
  C. the User Rights Assignment security policy settings
  D. an authentication policy silo
  B. authentication policies

• Question 234:

  HOTSPOT

  You have an Azure subscription that contains Azure App Service apps. The apps have the following characteristics:

  1. The apps are deployed by using continuous integration and continuous deployment (CI/CD) pipelines in Azure DevOps.

  2. The apps are deployed to a test environment first, and then to a production environment.

  3. The source code for the apps is stored in Azure Repos.

  You plan to implement DevSecOps controls based on the Microsoft Cloud Adoption Framework for Azure.

  You need to recommend testing controls to meet the following requirements:

  1. All the source code must be tested for security vulnerabilities in Azure Repos before deploying the apps.

  2. Once the apps are deployed to the test environment, they must be tested for security vulnerabilities.

  Which testing method should you recommend for each stage? To answer, select the options in the answer area.

  NOTE: Each correct answer is worth one point.

  

  

• Question 235:

  You have an Azure subscription.

  You have a subscription to a third-party cloud provider. The subscription contains 100 virtual machines.

  You manage cloud security for both subscriptions from the Azure subscription.

  You need to recommend a solution to validate the security posture of the virtual machines.

  Which two services should you include in the recommendation? Each correct answer presents part of the solution.

  A. Microsoft Defender for Cloud
  B. Microsoft Defender for Endpoint
  C. Azure Lighthouse
  D. Microsoft Sentinel
  E. Azure Arc
  A. Microsoft Defender for Cloud
  E. Azure Arc

• Question 236:

  You need to recommend a solution to scan the application code. The solution must meet the application development requirements.

  What should you include in the recommendation?

  A. Azure Key Vault
  B. GitHub Advanced Security
  C. Application Insights in Azure Monitor
  D. Azure DevTest Labs
  B. GitHub Advanced Security

  ---

  Explanation

  Requirements. Application Development Requirements

  Fabrikam identifies the following requirements for application development:

  * All the application code must be stored in GitHub Enterprise.

  * All application code changes must be scanned for security vulnerabilities, including application code or configuration files that contain secrets in clear text. Scanning must be done at the time the code is pushed to a repository.

  A GitHub Advanced Security license provides the following additional features: Code scanning - Search for potential security vulnerabilities and coding errors in your code.

  Secret scanning - Detect secrets, for example keys and tokens, that have been checked into the repository. If push protection is enabled, also detects secrets when they are pushed to your repository.

  Dependency review - Show the full impact of changes to dependencies and see details of any vulnerable versions before you merge a pull request.

  Security overview - Review the security configuration and alerts for an organization and identify the repositories at greatest risk.

  Incorrect:

  Not C:

  Scenario: Azure DevTest labs will be used by developers for testing.

  Azure DevTest Labs is a service for easily creating, using, and managing infrastructure-as-a-service (IaaS) virtual machines (VMs) and platform-as-a-service (PaaS) environments in labs. Labs offer preconfigured bases and artifacts for creating VMs, and Azure Resource Manager (ARM) templates for creating environments like Azure Web Apps or SharePoint farms.

  Lab owners can create preconfigured VMs that have tools and software lab users need. Lab users can claim preconfigured VMs, or create and configure their own VMs and environments. Lab policies and other methods track and control lab usage and costs.

  References:

  https://docs.github.com/en/enterprise-cloud@latest/get-started/learning-about-github/about-github-advanced-security

• Question 237:

  HOTSPOT

  You open Microsoft Defender for Cloud as shown in the following exhibit.

  

  Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: Azure Web Application Firewall (WAF)

  Restrict unauthorized network access control: 1 resource out of 11 needs to be addresses.

  Restrict unauthorized network access - Azure offers a suite of tools designed to ensure accesses across your network meet the highest security standards.

  Use these recommendations to manage Defender for Cloud's adaptive network hardening settings, ensure you've configured Azure Private Link for all relevant PaaS services, enable Azure Firewall on your virtual networks, and more.

  Note: Azure Web Application Firewall (WAF) is an optional addition to Azure Application Gateway.

  Azure WAF protects inbound traffic to the web workloads, and the Azure Firewall inspects inbound traffic for the other applications. The Azure Firewall will cover outbound flows from both workload types.

  Incorrect:

  Not network security groups (NSGs).

  Box 2: Microsoft Defender for servers Enable endpoint protection - Defender for Cloud checks your organization's endpoints for active threat detection and response solutions such as Microsoft Defender for Endpoint or any of the major solutions shown in this list.

  When an Endpoint Detection and Response (EDR) solution isn't found, you can use these recommendations to deploy Microsoft Defender for Endpoint (included as part of Microsoft Defender for servers).

  Incorrect:

  Not Microsoft Defender for Resource Manager: Microsoft Defender for Resource Manager does not handle endpoint protection.

  Microsoft Defender for Resource Manager automatically monitors the resource management operations in your organization, whether they're performed through the Azure portal, Azure REST APIs, Azure CLI, or other Azure programmatic clients. Defender for Cloud runs advanced security analytics to detect threats and alerts you about suspicious activity.

  References:

  https://docs.microsoft.com/en-us/azure/defender-for-cloud/secure-score-security-controls

• Question 238:

  You have a multicloud environment that contains an Azure subscription, an Amazon Web Services (AWS) subscription, and a Google Cloud Platform (GCP) subscription.

  You plan to implement Cloud Security Posture Management (CSPM) by using Microsoft Defender for

  You need to design a solution that will provide attack path analysis functionality for each subscription.

  What should you include in the solution?

  A. regulatory compliance
  B. Microsoft Defender External Attack Surface Management (Defender EASM)
  C. agentless scanning
  D. Microsoft Cloud Security Benchmark (MCSB)
  C. agentless scanning

• Question 239:

  HOTSPOT

  You have a Microsoft 365 E5 subscription.

  You plan to deploy Global Secure Access universal tenant restrictions v2.

  Which authentication plane resources and which data plane resources will be protected? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 240:

  Your company is developing a new Azure App Service web app.

  You are providing design assistance to verify the security of the web app.

  You need to recommend a solution to test the web app for vulnerabilities such as insecure server configurations, cross-site scripting (XSS), and SQL injection.

  What should you include in the recommendation?

  A. dynamic application security testing (DAST)
  B. static application security testing (SAST)
  C. interactive application security testing (IAST)
  D. runtime application self-protection (RASP)
  A. dynamic application security testing (DAST)

  ---

  Explanation

  Dynamic application security testing (DAST) is a process of testing an application in an operating state to find security vulnerabilities. DAST tools analyze programs while they are executing to find security vulnerabilities such as memory corruption, insecure server configuration, cross-site scripting, user privilege issues, SQL injection, and other critical security concerns.

  Incorrect:

  Not B: SAST tools analyze source code or compiled versions of code when the code is not executing in order to find security flaws.

  Not C: IAST (interactive application security testing) analyzes code for security vulnerabilities while the app is run by an automated test, human tester, or any activity "interacting" with the application functionality.

  IAST works inside the application, which makes it different from both static analysis (SAST) and dynamic analysis (DAST). This type of testing also doesn't test the entire application or codebase, but only whatever is exercised by the functional test.

  Not D: Runtime Application Self Protection (RASP) is a security solution designed to provide personalized protection to applications. It takes advantage of insight into an application's internal data and state to enable it to identify threats at runtime that may have otherwise been overlooked by other security solutions.

  RASP's focused monitoring makes it capable of detecting a wide range of threats, including zero-day attacks. Since RASP has insight into the internals of an application, it can detect behavioral changes that may have been caused by a novel attack. This enables it to respond to even zero-day attacks based upon how they affect the target application.

  References:

  https://docs.microsoft.com/en-us/azure/security/develop/secure-develop