Microsoft SC-100 Online Practice Questions and Exam Preparation

Microsoft SC-100 Online Questions & Answers

• Question 241:

  You have an Azure subscription that uses Microsoft Defender for Cloud.

  You have Amazon Web Services (AWS), Google Cloud Platform (GCP), and Oracle Cloud Infrastructure (OCI) subscriptions.

  You create a custom security standard in Defender for Cloud.

  To which subscriptions can the Defender for Cloud standard be applied?

  A. Azure and AWS only
  B. Azure and GCP only
  C. Azure, AWS, and GCP only
  D. Azure, AWS, and OCI only
  E. Azure, AWS, GCP, and OCI
  C. Azure, AWS, and GCP only

• Question 242:

  HOTSPOT

  You have a Microsoft 365 E5 subscription that uses Microsoft Purview, SharePoint Online, and OneDrive for Business.

  You need to recommend a ransomware protection solution that meets the following requirements:

  1. Mitigates attacks that make copies of files, encrypt the copies, and then delete the original files

  2. Mitigates attacks that encrypt files in place

  3. Minimizes administrative effort

  What should you include in the recommendation? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 243:

  You have an Azure AD tenant that syncs with an Active Directory Domain Services (AD DS) domain.

  You have an on-premises datacenter that contains 100 servers. The servers run Windows Server and are backed up by using Microsoft Azure Backup Server (MABS).

  You are designing a recovery solution for ransomware attacks. The solution follows Microsoft Security Best Practices.

  You need to ensure that a compromised administrator account cannot be used to delete the backups.

  What should you do?

  A. From Azure Backup, configure multi-user authorization by using Resource Guard.
  B. From Microsoft Azure Backup Setup, register MABS with a Recovery Services vault.
  C. From a Recovery Services vault, generate a security PIN for critical operations.
  D. From Azure AD Privileged Identity Management (PIM), create a role assignment for the Backup Contributor role.
  C. From a Recovery Services vault, generate a security PIN for critical operations.

  ---

  Explanation

  Security features to help protect hybrid backups that use Azure Backup Prevent attacks Checks have been added to make sure only valid users can perform various operations. These include adding an extra layer of authentication, and maintaining a minimum retention range for recovery purposes.

  Authentication to perform critical operations

  As part of adding an extra layer of authentication for critical operations, you're prompted to enter a security PIN when you perform Stop Protection with Delete data and Change Passphrase operations.

  To receive this PIN:

  1. Sign in to the Azure portal.

  2. Browse to Recovery Services vault > Settings > Properties.

  3. Under Security PIN, select Generate. This opens a pane that contains the PIN to be entered in the Azure Recovery Services agent user interface. This PIN is valid for only five minutes, and it gets generated automatically after that period.

  References:

  https://learn.microsoft.com/en-us/azure/backup/backup-azure-security-feature

• Question 244:

  For an Azure deployment, you are designing a security architecture based on the Microsoft Cloud Security Benchmark.

  You need to recommend a best practice for implementing service accounts for Azure API management.

  What should you include in the recommendation?

  A. application registrations in Azure AD
  B. managed identities in Azure
  C. Azure service principals with usernames and passwords
  D. device registrations in Azure AD
  E. Azure service principals with certificate credentials
  B. managed identities in Azure

  ---

  Explanation

  IM-3: Manage application identities securely and automatically

  Features Managed Identities Description: Data plane actions support authentication using managed identities.

  Configuration Guidance: Use a Managed Service Identity generated by Azure Active Directory (Azure AD) to allow your API Management instance to easily and securely access other Azure AD-protected resources, such as Azure Key Vault instead of using service principals. Managed identity credentials are fully managed, rotated, and protected by the platform, avoiding hard-coded credentials in source code or configuration files.

  References:

  https://learn.microsoft.com/en-us/security/benchmark/azure/baselines/api-management-security-baseline

• Question 245:

  HOTSPOT

  You have a Microsoft 365 E5 subscription.

  You need to mitigate ransomware attacks against messages posted to Microsoft Teams channels and files stored in Teams channels.

  What should you include in the solution for each type of content? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 246:

  You need to recommend a strategy for routing internet-bound traffic from the landing zones. The solution must meet the landing zone requirements.

  What should you recommend as part of the landing zone deployment?

  A. service chaining
  B. local network gateways
  C. forced tunneling
  D. a VNet-to-VNet connection
  A. service chaining

  ---

  Explanation

  Service chaining.

  Service chaining enables you to direct traffic from one virtual network to a virtual appliance or gateway in a peered network through user-defined routes. You can deploy hub-and-spoke networks, where the hub virtual network hosts infrastructure components such as a network virtual appliance or VPN gateway. All the spoke virtual networks can then peer with the hub virtual network. Traffic flows through network virtual appliances or VPN gateways in the hub virtual network.

  Virtual network peering enables the next hop in a user-defined route to be the IP address of a virtual machine in the peered virtual network, or a VPN gateway. You can't route between virtual networks with a user-defined route that specifies an Azure ExpressRoute gateway as the next hop type.

  Incorrect:

  Not B: Forced tunneling lets you redirect or "force" all Internet-bound traffic back to your on-premises location via a Site-to-Site VPN tunnel for inspection and auditing. This is a critical security requirement for most enterprise IT policies. If you don't configure forced tunneling, Internet-bound traffic from your VMs in Azure always traverses from the Azure network infrastructure directly out to the Internet, without the option to allow you to inspect or audit the traffic. Unauthorized Internet access can potentially lead to information disclosure or other types of security breaches.

  ExpressRoute forced tunneling is not configured via this mechanism, but instead, is enabled by advertising a default route via the ExpressRoute BGP peering sessions.

  Note:

  Requirements. Planned Changes

  Litware plans to implement the following changes:

  Design a landing zone strategy to refactor the existing Azure environment of Litware and deploy all future Azure workloads.

  Requirements. Azure Landing Zone Requirements

  Litware identifies the following landing zone requirements:

  1. Route all internet-bound traffic from landing zones through Azure Firewall in a dedicated Azure subscription.

  2. Provide a secure score scoped to the landing zone.

  3. Ensure that the Azure virtual machines in each landing zone communicate with Azure App Service web apps in the same zone over the Microsoft backbone network, rather than over public endpoints.

  4. Minimize the possibility of data exfiltration.

  5. Maximize network bandwidth.

  The landing zone architecture will include the dedicated subscription, which will serve as the hub for internet and hybrid connectivity. Each landing zone will have the following characteristics:

  1. Be created in a dedicated subscription.

  2. Use a DNS namespace of litware.com.

  References:

  https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-peering-overview#service-chaining

  https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-forced-tunneling-rm

• Question 247:

  HOTSPOT

  You plan to implement an Azure environment based on Microsoft Cloud Adoption Framework for enterprise-scale landing zone architecture principles.

  The environment will host three apps that have the following characteristics:

  1. Each app will have a development environment, a test environment, and a production environment.

  2. Each environment will be managed by a separate team.

  3. Each app will store its secrets in Azure Key Vault.

  You need to recommend how many Azure subscriptions and key vaults to deploy to the application landing zones.

  What should you recommend? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 248:

  You have an on-premises datacenter and an Azure Kubernetes Service (AKS) cluster named AKS1.

  You need to restrict internet access to the public endpoint of AKS1. The solution must ensure that AKS1 can be accessed only from the public IP addresses associated with the on-premises datacenter.

  What should you use?

  A. a private endpoint
  B. a network security group (NSG)
  C. a service endpoint
  D. an authorized IP range
  D. an authorized IP range

  ---

  Explanation

  By default, the Kubernetes API server uses a public IP address and a fully qualified domain name (FQDN). You can limit access to the API server endpoint using authorized IP ranges. You can also create a fully private cluster to limit API server access to your virtual network.

  References:

  https://learn.microsoft.com/en-us/azure/aks/concepts-security

• Question 249:

  You have a Microsoft 365 subscription with 1,000 users and a group named Group1. All users use Windows 11 devices and sign in to their devices with their Microsoft Entra accounts. These users do not have administrative rights to their devices.

  Members of Group1 remotely assist users by taking control of their sessions. These remote control sessions run in the security context of the users they are assisting.

  You need to recommend a solution that will allow members of Group1 to run applications that require administrative rights on the users' devices, ensuring that the apps are executed in the context of the signed-in standard user.

  What should you include in the recommendation?

  A. Windows Local Administrator Password Solution (Windows LAPS)
  B. Microsoft Entra Permissions Management
  C. Microsoft Intune Endpoint Privilege Management
  D. Privileged Identity Management (PIM) in Microsoft Entra ID
  C. Microsoft Intune Endpoint Privilege Management

  ---

  Explanation

  With Microsoft Intune Endpoint Privilege Management (EPM) your organization's users can run as a standard user (without administrator rights) and complete tasks that require elevated privileges. Tasks that commonly require administrative privileges are application installs (like Microsoft 365 Applications), updating device drivers, and running certain Windows diagnostics. Endpoint Privilege Management supports your Zero Trust journey by helping your organization achieve a broad user base running with least privilege, while allowing users to still run tasks allowed by your organization to remain productive.

  For more information, see Zero Trust with Microsoft Intune.

  Incorrect:

  Not A:

  Windows Local Administrator Password Solution (Windows LAPS) is a Windows feature that automatically manages and backs up the password of a local administrator account on your Microsoft Entra joined or Windows Server Active Directory-joined devices. You also can use Windows LAPS to automatically manage and back up the Directory Services Restore Mode (DSRM) account password on your Windows Server Active Directory domain controllers. An authorized administrator can retrieve the DSRM password and use it.

  Not B:

  Microsoft Entra Permissions Management is a cloud infrastructure entitlement management (CIEM) solution that provides comprehensive visibility into permissions assigned to all identities (users and workloads), actions, and resources across cloud infrastructures. It detects, right-sizes, and monitors unused and excessive permissions and enables Zero Trust security through least privilege access in Microsoft Azure, Amazon Web Services (AWS), and Google Cloud Platform (GCP).

  Not D:

  Privileged Identity Management provides time-based and approval-based role activation to mitigate the risks of excessive, unnecessary, or misused access permissions on resources that you care about.

  References:

  https://learn.microsoft.com/en-us/mem/intune/protect/epm-overview

• Question 250:

  HOTSPOT

  You have a Microsoft Entra tenant and an Azure subscription.

  You are evaluating the use of a risk-based Conditional Access policy to control the access of workload identities to resources.

  To which type of identity should you apply the policy, and which signal source can you use as part of the policy? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.