Microsoft SC-100 Online Practice Questions and Exam Preparation

Microsoft SC-100 Online Questions & Answers

• Question 251:

  You have a Microsoft 365 subscription and an Azure subscription. Microsoft 365 Defender and Microsoft Defender for Cloud are enabled.

  The Azure subscription contains 50 virtual machines. Each virtual machine runs different applications on Windows Server 2019.

  You need to recommend a solution to ensure that only authorized applications can run on the virtual machines. If an unauthorized application attempts to run or be installed, the application must be blocked automatically until an administrator authorizes the application.

  Which security control should you recommend?

  A. app discovery anomaly detection policies in Microsoft Defender for Cloud Apps
  B. Azure AD Conditional Access App Control policies
  C. adaptive application controls in Defender for Cloud
  D. app protection policies in Microsoft Endpoint Manager
  C. adaptive application controls in Defender for Cloud

  ---

  Explanation

  Use adaptive application controls to reduce your machines' attack surfaces

  Adaptive application controls are an intelligent and automated solution for defining allowlists of known-safe applications for your machines.

  When you've enabled and configured adaptive application controls, you'll get security alerts if any application runs other than the ones you've defined as safe.

  Incorrect:

  Not A: A Cloud Discovery anomaly detection policy enables you to set up and configure continuous monitoring of unusual increases in cloud application usage. Increases in downloaded data, uploaded data, transactions, and users are considered for each cloud application. Each increase is compared to the normal usage pattern of the application as learned from past usage. The most extreme increases trigger security alerts.

  References:

  https://learn.microsoft.com/en-us/azure/defender-for-cloud/adaptive-application-controls

• Question 252:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  Your on-premises network contains an e-commerce web app that was developed in Angular and Node,js. The web app uses a MongoDB database.

  You plan to migrate the web app to Azure. The solution architecture team proposes the following architecture as an Azure landing zone.

  

  You need to provide recommendations to secure the connection between the web app and the database. The solution must follow the Zero Trust model.

  Solution: You recommend creating private endpoints for the web app and the database layer.

  Does this meet the goal?

  A. Yes
  B. No
  A. Yes

  ---

  Explanation

  How to Use Azure Private Endpoints to Restrict Public Access to WebApps.

  As an Azure administrator or architect, you are sometimes asked the question: "How can we safely deploy internal business applications to Azure App Services?"

  These applications characteristically are:

  Not accessible from the public internet.

  Accessible from within the on-premises corporate network Accessible via an authorized VPN client from outside the corporate network.

  For such scenarios, we can use Azure Private Links, which enables private and secure access to Azure PaaS services over Azure Private Endpoints, along with the Site-to-Site VPN, Point-to-Site VPN, or the Express Route. Azure Private Endpoint is a read-only network interface service associated with the Azure PAAS Services. It allows you to bring deployed sites into your virtual network, limiting access to them at the network level.

  It uses one of the private IP addresses from your Azure VNet and associates it with the Azure App Services. These services are called Private Link resources. They can be Azure Storage, Azure Cosmos DB, SQL, App Services Web App, your own / partner owned services, Azure Backups, Event Grids, Azure Service Bus, or Azure Automations.

  References:

  https://www.varonis.com/blog/securing-access-azure-webapps

• Question 253:

  HOTSPOT

  You have a Microsoft Entra tenant. The tenant contains a security group named Group1. Group1 contains the members of your company's IT support team.

  You have an Azure subscription. The subscription contains 800 Windows devices that are Microsoft Entra joined and 200 Windows devices that are Microsoft Entra registered.

  You have 200 standalone macOS devices.

  You deploy 10 Windows devices that are Microsoft Entra joined and have the Microsoft Entra ExtensionAttribute1 value set to SecureWorkstation.

  You need to recommend a Conditional Access solution that meets the following requirements:

  Only allows access to Microsoft Entra resources from devices that run Windows 10 or Windows 11

  Restricts Windows Azure Service Management API access to the following users:

  1. The members of Group1.

  2. Users that authenticate by using multifactor authentication (MFA)

  3. Users that connect from a device that has the SecureWorkstation ExtensionAttribute1.

  The solution must minimize the number of required policies and maximize security.

  What should include in the recommendation? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 254:

  You have on-premises Windows 11 devices with the Global Secure Access client deployed.

  Your Microsoft 365 subscription includes Microsoft SharePoint Online and Exchange Online.

  You deploy Microsoft Entra Internet Access from your on-premises network to Microsoft 365. This deployment has the Microsoft 365 profile enabled, with the following configuration:

  1. Default traffic policies for Microsoft 365 services

  2. A linked Conditional Access policy that performs compliant network checks with continuous access evaluation (CAE) applied to all users

  3. An assignment to all devices

  4. An assignment to a remote network associated with the on-premises network

  Which Microsoft 365 resources are protected using continuous access evaluation (CAE)?

  A. SharePoint Online only
  B. Exchange Online only
  C. both SharePoint Online and Exchange Online
  A. SharePoint Online only

  ---

  Explanation

  Compliant network check enforcement

  Compliant network enforcement reduces the risk of token theft/replay attacks. Compliant network enforcement happens at the authentication plane (generally available) and at the data plane (preview). Authentication plane enforcement is performed by Microsoft Entra ID at the time of user authentication. If an adversary has stolen a session token and attempts to replay it from a device that is not connected to your organization's compliant network (for example, requesting an access token with a stolen refresh token), Entra ID will immediately deny the request and further access will be blocked. Data plane enforcement works with services that support Continuous Access Evaluation (CAE) - currently, *only SharePoint Online*. With apps that support CAE, stolen access tokens that are replayed outside your tenant's compliant network will be rejected by the application in near-real time. Without CAE, a stolen access token will last up to its full lifetime (default 60-90 minutes).

  References:

  https://learn.microsoft.com/en-us/entra/global-secure-access/how-to-compliant-network

• Question 255:

  Your network contains an Active Directory Domain Services (AD DS) domain named Domain1. You have a Microsoft Entra tenant. Domain1 syncs with the tenant by using Microsoft Entra Connect. You need to monitor Domain1 for privilege escalation attacks.

  What should you use?

  A. Microsoft Entra ID Protection
  B. Microsoft Defender for Servers
  C. Microsoft Defender for Identity
  D. Privileged Identity Management (PIM)
  C. Microsoft Defender for Identity

• Question 256:

  HOTSPOT

  You have an Azure subscription that contains a Microsoft Sentinel workspace named WS1.

  You need to configure WS1 to meet the following requirements:

  1. Create custom dashboards to visualize the workload of security analysts who use Microsoft Sentinel.

  2. Enable automated responses for the security alerts generated by Microsoft Sentinel analytics rules.

  What should you use for each requirement?

  To answer, select the options in the answer area. Each correct answer is worth one point

  

  

  ---

  Box 1: Workbooks

  Create custom dashboards to visualize the workload of security analysts that use Microsoft Sentinel.

  Visualize and monitor your data by using workbooks in Microsoft Sentinel After you connect your data sources to Microsoft Sentinel, visualize and monitor the data using workbooks in Microsoft Sentinel. Microsoft Sentinel workbooks are based on Azure Monitor workbooks, and add tables and charts with analytics for your logs and queries to the tools already available in Azure.

  Box 2: Playbooks

  Enable automated responses for the security alerts generated by Microsoft Sentinel analytics rules.

  You can create and use Microsoft Sentinel automation rules to manage response Design your automation rule Before you create your automation rule, we recommend that you determine its scope and design, including the trigger, conditions, and actions that make up your rule.

  Add actions

  Choose the actions you want this automation rule to take. Available actions include Assign owner, Change status, Change severity, Add tags, and Run playbook. You can add as many actions as you like.

  Note:

  Only the Run playbook action is available in automation rules using the alert trigger.

  References:

  https://learn.microsoft.com/en-us/azure/sentinel/monitor-your-data

• Question 257:

  Your company has on-premises network in Seattle and an Azure subscription. The on-premises network contains a Remote Desktop server.

  The company contracts a third-party development firm from France to develop and deploy resources to the virtual machines hosted in the Azure subscription.

  Currently, the firm establishes an RDP connection to the Remote Desktop server. From the Remote Desktop connection, the firm can access the virtual machines hosted in Azure by using custom administrative tools installed on the Remote Desktop server. All the traffic to the Remote Desktop server is captured by a firewall, and the firewall only allows specific connections from France to the server.

  You need to recommend a modern security solution based on the Zero Trust model. The solution must minimize latency for developers.

  Which three actions should you recommend? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. Configure network security groups (NSGs) to allow access from only specific logical groupings of IP address ranges.
  B. Deploy a Remote Desktop server to an Azure region located in France.
  C. Migrate from the Remote Desktop server to Azure Virtual Desktop.
  D. Implement Azure Firewall to restrict host pool outbound access.
  E. Configure Azure Active Directory (Azure AD) Conditional Access with multi-factor authentication (MFA) and named locations.
  C. Migrate from the Remote Desktop server to Azure Virtual Desktop.
  D. Implement Azure Firewall to restrict host pool outbound access.
  E. Configure Azure Active Directory (Azure AD) Conditional Access with multi-factor authentication (MFA) and named locations.

  ---

  Explanation

  E: Organizations can use this location for common tasks like: Requiring multi-factor authentication for users accessing a service when they're off the corporate network.

  Blocking access for users accessing a service from specific countries or regions.

  The location is determined by the public IP address a client provides to Azure Active Directory or GPS coordinates provided by the Microsoft Authenticator app. Conditional Access policies by default apply to all IPv4 and IPv6 addresses.

  CD: Use Azure Firewall to protect Azure Virtual Desktop deployments.

  Azure Virtual Desktop is a desktop and app virtualization service that runs on Azure. When an end user connects to an Azure Virtual Desktop environment, their session is run by a host pool. A host pool is a collection of Azure virtual machines that register to Azure Virtual Desktop as session hosts. These virtual machines run in your virtual network and are subject to the virtual network security controls. They need outbound Internet access to the Azure Virtual Desktop service to operate properly and might also need outbound Internet access for end users. Azure Firewall can help you lock down your environment and filter outbound traffic.

  References:

  https://docs.microsoft.com/en-us/azure/firewall/protect-azure-virtual-desktop

• Question 258:

  HOTSPOT

  You have four Azure subscriptions: Sub1, Sub2, Sub3, and Sub4. Each subscription is linked to a unique Microsoft Entra tenant and a Microsoft 365 subscription. Sub1 contains a user named User1.

  You plan to implement Microsoft Sentinel and need to ensure that User1 can monitor Microsoft Entra ID events and Microsoft 365 events for Sub2, Sub3, and Sub4 using Microsoft Sentinel. The solution must minimize administrative effort.

  What is the minimum number of Microsoft Sentinel workspaces you should create, and which Azure service should you use?

  To answer, select the appropriate options in the answer area.

  

  

  ---

  Box 1: 3

  Number of workspace

  One for Sub2, one for Sub3, and one for Sub4.

  Note: Extend Microsoft Sentinel across workspaces and tenants.

  When you onboard Microsoft Sentinel, your first step is to select your Log Analytics workspace. While you can get the full benefit of the Microsoft Sentinel experience with a single workspace, in some cases, you might want to extend your workspace to query and analyze your data across workspaces and tenants.

  Box 2: Azure Lighthouse

  Service

  Manage workspaces across tenants using Azure Lighthouse

  As mentioned above, in many scenarios, the different Log Analytics workspaces enabled for Microsoft Sentinels can be located in different Microsoft Entra tenants. You can use Azure Lighthouse to extend all cross-workspace activities across tenant boundaries, allowing users in your managing tenant to work on workspaces across all tenants. 66 Once Azure Lighthouse is onboarded, use the directory + subscription selector on the Azure portal to select all the subscriptions containing workspaces you want to manage, in order to ensure that they'll all be available in the different workspace selectors in the portal.

  When using Azure Lighthouse, it's recommended to create a group for each Microsoft Sentinel role and delegate permissions from each tenant to those groups.

  References:

  https://learn.microsoft.com/en-us/azure/sentinel/extend-sentinel-across-workspaces-tenants

  https://learn.microsoft.com/en-us/azure/sentinel/multiple-tenants-service-providers

• Question 259:

  You receive a security alert in Microsoft Defender for Cloud as shown in the exhibit. (Click the Exhibit tab.)

  

  After remediating the threat which policy definition should you assign to prevent the threat from reoccurring?

  A. Storage account public access should be disallowed
  B. Azure Key Vault Managed HSM should have purge protection enabled
  C. Storage accounts should prevent shared key access
  D. Storage account keys should not be expired
  A. Storage account public access should be disallowed

  ---

  Explanation

  Anonymous public read access to containers and blobs in Azure Storage is a convenient way to share data, but may also present a security risk. It's important to manage anonymous access judiciously and to understand how to evaluate anonymous access to your data. Operational complexity, human error, or malicious attack against data that is publicly accessible can result in costly data breaches. Microsoft recommends that you enable anonymous access only when necessary for your application scenario.

  Note: Attackers have been crawling for public containers using tools such as MicroBurst.

  Exploiting Anonymous Blob Access

  Now, there are thousands of articles explaining how this can be abused and how to search for insecure storage in Azure. One of the easiest way is to use MicroBurst, provide the storage account name to search for, and it'll check if the containers exists based on a wordlist saved in the Misc/permutations.txt

  References:

  https://docs.microsoft.com/en-us/azure/storage/blobs/anonymous-read-access-prevent

  https://hackingthe.cloud/azure/anonymous-blob-access/

• Question 260:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You are designing a security strategy for providing access to Azure App Service web apps through an Azure Front Door instance.

  You need to recommend a solution to ensure that the web apps only allow access through the Front Door instance.

  Solution: You recommend access restrictions that allow traffic from the Front Door service tags.

  Does this meet the goal?

  A. Yes
  B. No
  B. No

  ---

  Explanation

  Correct Solution: You recommend access restrictions based on HTTP headers that have the Front Door ID.

  Restrict access to a specific Azure Front Door instance.

  Traffic from Azure Front Door to your application originates from a well-known set of IP ranges defined in the AzureFrontDoor.Backend service tag. Using a service tag restriction rule, you can restrict traffic to only originate from Azure Front Door. To ensure traffic only originates from your specific instance, you will need to further filter the incoming requests based on the unique http header that Azure Front Door sends.

  

  References:

  https://docs.microsoft.com/en-us/azure/app-service/app-service-ip-restrictions#managing-access-restriction-rules