Microsoft SC-100 Online Practice Questions and Exam Preparation

Microsoft SC-100 Online Questions & Answers

• Question 261:

  DRAG DROP

  You have an Azure Storage account named storage1.

  You plan to secure storage1 by using a Bring Your Own Key (BYOK) strategy.

  You create an Azure key vault named AKV1 and upload a compatible key.

  You need to configure storage1 to use the key stored in AKV1 for encryption.

  Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  

• Question 262:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  Your on-premises network contains an e-commerce web app that was developed in Angular and Node,js. The web app uses a MongoDB database.

  You plan to migrate the web app to Azure. The solution architecture team proposes the following architecture as an Azure landing zone.

  

  You need to provide recommendations to secure the connection between the web app and the database. The solution must follow the Zero Trust model.

  Solution: You recommend implementing Azure Key Vault to store credentials.

  Does this meet the goal?

  A. Yes
  B. No
  B. No

  ---

  Explanation

  Instead use solution: You recommend creating private endpoints for the web app and the database layer.

  Note:

  How to Use Azure Private Endpoints to Restrict Public Access to WebApps.

  As an Azure administrator or architect, you are sometimes asked the question: "How can we safely deploy internal business applications to Azure App Services?"

  These applications characteristically are:

  Not accessible from the public internet.

  Accessible from within the on-premises corporate network Accessible via an authorized VPN client from outside the corporate network.

  For such scenarios, we can use Azure Private Links, which enables private and secure access to Azure PaaS services over Azure Private Endpoints, along with the Site-to-Site VPN, Point-to-Site VPN, or the Express Route. Azure Private Endpoint is a read-only network interface service associated with the Azure PAAS Services. It allows you to bring deployed sites into your virtual network, limiting access to them at the network level.

  It uses one of the private IP addresses from your Azure VNet and associates it with the Azure App Services. These services are called Private Link resources. They can be Azure Storage, Azure Cosmos DB, SQL, App Services Web App, your own / partner owned services, Azure Backups, Event Grids, Azure Service Bus, or Azure Automations.

  References:

  https://www.varonis.com/blog/securing-access-azure-webapps

• Question 263:

  You have an Azure subscription with 100 virtual machines, a virtual network named VNet1, and 20 users. The virtual machines are running Windows Server and are connected to VNet1. The users are remote and access Azure resources from Linux workstations.

  You need to ensure that the users can connect to the virtual machines from their workstations using Secure Shell (SSH), while meeting the following requirements:

  1. Users must authenticate using their Microsoft Entra credentials.

  2. Users should be prevented from transferring files from the virtual machines via SSH.

  3. Users must not be allowed to directly access the virtual machines using the public IP addresses.

  What should you include in the solution?

  A. Azure NAT Gateway
  B. just-in-time (JIT) VM access
  C. Azure Bastion
  D. Point-to-Site (P2S) VPN
  C. Azure Bastion

  ---

  Explanation

  Azure Bastion is a fully managed service that provides more secure and seamless Remote Desktop Protocol (RDP) and Secure Shell Protocol (SSH) access to virtual machines (VMs) without any exposure through public IP addresses.

  Azure Bastion supports Kerberos Entra authentication.

  Incorrect:

  * just-in-time (JIT) VM access

  How JIT operates with network resources in Azure and AWS When a user requests access to a VM, Defender for Cloud checks that the user has Azure role-based access control (Azure RBAC) permissions for that VM. If the request is approved, Defender for Cloud configures the NSGs and Azure Firewall to allow inbound traffic to the selected ports from the relevant IP address (or range), for the amount of time that was specified. In AWS, Defender for Cloud creates a new EC2 security group that allows inbound traffic to the specified ports. After the time has expired, Defender for Cloud restores the NSGs to their previous states. Connections that are already established aren't interrupted.

  References:

  https://learn.microsoft.com/en-us/azure/bastion/bastion-overview

• Question 264:

  HOTSPOT

  Your network contains an on-premises Active Directory Domain Services (AD DS) domain. The domain contains a server that runs Windows Server and hosts shared folders. The domain syncs with Azure AD by using Azure AD Connect.

  Azure AD Connect has group writeback enabled.

  You have a Microsoft 365 subscription that uses Microsoft SharePoint Online.

  You have multiple project teams. Each team has an AD DS group that syncs with Azure AD.

  Each group has permissions to a unique SharePoint Online site and a Windows Server shared folder for its project. Users routinely move between project teams.

  You need to recommend an Azure AD Identity Governance solution that meets the following requirements:

  1. Project managers must verify that their project group contains only the current members of their project team.

  2. The members of each project team must only have access to the resources of the project to which they are assigned.

  3. Users must be removed from a project group automatically if the project manager has NOT verified the group's membership for 30 days.

  4. Administrative effort must be minimized.

  What should you include in the recommendation? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 265:

  You have an Azure subscription that has Microsoft Defender for Cloud enabled.

  You have an Amazon Web Services (AWS) implementation.

  You plan to extend the Azure security strategy to the AWS implementation. The solution will NOT use Azure Arc.

  Which three services can you use to provide security for the AWS resources? Each correct answer presents a complete solution.

  NOTE: Each correct selection is worth one point.

  A. Microsoft Defender for Containers
  B. Microsoft Defender for servers
  C. Azure Active Directory (Azure AD) Conditional Access
  D. Azure Active Directory (Azure AD) Privileged Identity Management (PIM)
  E. Azure Policy
  A. Microsoft Defender for Containers
  C. Azure Active Directory (Azure AD) Conditional Access
  E. Azure Policy

  ---

  Explanation

  Environment settings page (in preview) (recommended) - This preview page provides a greatly improved, simpler, onboarding experience (including auto provisioning). This mechanism also extends Defender for Cloud's enhanced security features to your AWS resources:

  *(A) Microsoft Defender for Containers brings threat detection and advanced defenses to your Amazon EKS clusters. This plan includes Kubernetes threat protection, behavioral analytics, Kubernetes best practices, admission control recommendations and more.

  * Microsoft Defender for Servers, though it requires Arc.

  C: AWS installations can benefit from Conditional Access. Defender for Cloud Apps integrates with Azure AD Conditional Access to enforce additional restrictions, and monitors and protects sessions after sign-in. Defender for Cloud Apps uses user behavior analytics (UBA) and other AWS APIs to monitor sessions and users and to support information protection.

  E: Kubernetes data plane hardening.

  For a bundle of recommendations to protect the workloads of your Kubernetes containers, install the Azure Policy for Kubernetes. You can also auto deploy this component as explained in enable auto provisioning of agents and extensions.

  With the add-on on your AKS cluster, every request to the Kubernetes API server will be monitored against the predefined set of best practices before being persisted to the cluster. You can then configure to enforce the best practices and mandate them for future workloads.

  Incorrect:

  Not B: To enable the Defender for Servers plan you need Azure Arc for servers installed on your EC2 instances.

  References:

  https://docs.microsoft.com/en-us/azure/defender-for-cloud/quickstart-onboard-aws?pivots=env-settings

  https://docs.microsoft.com/en-us/azure/defender-for-cloud/defender-for-containers-introduction

  https://docs.microsoft.com/en-us/azure/architecture/reference-architectures/aws/aws-azure-security-solutions

• Question 266:

  HOTSPOT

  You have an Azure subscription.

  You need to create an Azure policy to ensure that all the resources in the subscription have tags assigned.

  The solution must ensure that the policy can remediate noncompliant resources automatically.

  How should you configure the policy? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 267:

  You have a Microsoft 365 tenant named contoso.com.

  You need to ensure that users can authenticate only to contoso.com, while meeting the following requirements:

  1. Prevent users from authenticating to other Microsoft 365 tenants.

  2. Minimize administrative effort.

  What should you use?

  A. Microsoft Entra Private Access
  B. Microsoft Defender for Endpoint
  C. Microsoft Entra Internet Access
  D. Microsoft Defender for Cloud Apps
  A. Microsoft Entra Private Access

  ---

  Explanation

  Microsoft Entra Private Access unlocks the ability to specify the fully qualified domain names (FQDNs) and IP addresses that you consider private or internal, so you can manage how your organization accesses them. With Private Access, you can modernize how your organization's users access private apps and resources. Remote workers don't need to use a VPN to access these resources if they have the Global Secure Access Client installed. The client quietly and seamlessly connects them to the resources they need.

  Private Access provides two ways to configure the private resources that you want to tunnel through the service. You can configure Quick Access, which is the primary group of FQDNs and IP addresses that you want to secure. You can also configure a Global Secure Access app for per-app access, which allows you to specify a subset of private resources that you want to secure. The Global Secure Access app provides a granular approach to securing your private resources.

  The features of Microsoft Entra Private Access provide a quick and easy way to replace your VPN to allow secure access to your internal resources with an easy-one time configuration, using the secure capabilities of Conditional Access.

  Incorrect:

  Not C:

  Microsoft Entra Internet Access provides an identity-centric Secure Web Gateway (SWG) solution for Software as a Service (SaaS) applications and other Internet traffic. It protects users, devices, and data from the Internet's wide threat landscape with best-in-class security controls and visibility through Traffic Logs.

  Web content filtering

  The key introductory feature for Microsoft Entra Internet Access for all apps is Web content filtering. This feature provides granular access control for web categories and Fully Qualified Domain Names (FQDNs). By explicitly blocking known inappropriate, malicious, or unsafe sites, you protect your users and their devices from any Internet connection whether they're remote or within the corporate network. Web content filtering is implemented using filtering policies, which are grouped into security profiles, which can be linked to Conditional Access policies.

  References:

  https://learn.microsoft.com/en-us/entra/global-secure-access/concept-private-access

  https://learn.microsoft.com/en-us/entra/global-secure-access/concept-internet-access

• Question 268:

  You have an Azure subscription that contains multiple Azure Data Lake Storage accounts.

  You need to recommend a solution to encrypt the content of the accounts by using service-side encryption and customer-managed keys. The solution must ensure that individual encryption keys are applied at the most granular level.

  At which level should you recommend the encryption be applied?

  A. account
  B. folder
  C. file
  D. container
  D. container

• Question 269:

  HOTSPOT

  Your company has two offices: Office1 and Office2, containing 1,000 on-premises Windows 11 devices that are Microsoft Entra joined.

  You have a Microsoft 365 subscription and use Microsoft Intune. You plan to deploy Microsoft Entra Internet Access from the offices to Microsoft 365.

  You have enabled the Microsoft 365 profile and configured the following:

  A traffic policy for all Microsoft 365 traffic

  A linked Conditional Access policy with the following configurations:

  1. Applies to all users

  2. Performs compliant network checks

  3. Allows Microsoft 365 traffic from compliant devices

  4. An assignment to all devices

  5. An assignment to the remote network associated with Office1

  You deploy the Global Secure Access client to all devices in Office2 and establish connections.

  Which users can access Microsoft 365 services from compliant devices, and which users are blocked from accessing Microsoft 365 services when using noncompliant devices?

  To answer, select the appropriate options in the answer area.Each correct selection is worth one point.

  

  

  ---

  Box 1: Office1 and Office2

  Compliant devices

  * Office1

  Global Secure Access

  Enable compliant network check with Conditional Access Organizations who use Conditional Access along with the Global Secure Access, can prevent malicious access to Microsoft apps, third-party SaaS apps, and private line-of-business (LoB) apps using multiple conditions to provide defense-in-depth. These conditions might include device compliance, location, and more to provide protection against user identity or token theft. Global Secure Access introduces the concept of a compliant network within Microsoft Entra ID Conditional Access. This compliant network check ensures users connect from a verified network connectivity model for their specific tenant and are compliant with security policies enforced by administrators.

  The Global Secure Access Client installed on devices or users behind configured remote networks allows administrators to secure resources behind a compliant network with advanced Conditional Access controls. This compliant network feature makes it easier for administrators to manage access policies, without having to maintain a list of egress IP addresses. This removes the requirement to hairpin traffic through organization's VPN.

  * Office2

  The Global Secure Access client allows organizations control over network traffic at the end-user computing device, giving organizations the ability to route specific traffic profiles through Microsoft Entra Internet Access and Microsoft Entra Private Access. Routing traffic in this method allows for more controls like continuous access evaluation (CAE), device compliance, or multifactor authentication to be required for resource access.

  Box 2: Office1 only

  Noncompliant devices References:

  https://learn.microsoft.com/en-us/entra/global-secure-access/how-to-compliant-network https://learn.microsoft.com/en-us/entra/global-secure-access/concept-clients

• Question 270:

  You have an on-premises app named App1. Remote users access App1 by using VPN connections.

  You have a third-party software as a service (SaaS) app named App2.

  You need to deploy Global Secure Access to manage access to App1 and App2.

  What should you use for each app?

  A. Microsoft Entra Private Access for App1 and Microsoft Entra Internet Access for App2
  B. Microsoft Entra Private Access for App1 and App2
  C. Microsoft Entra Internet Access for App1 and App2
  D. Microsoft Entra Private Access for App2 and Microsoft Entra Internet Access for App1
  A. Microsoft Entra Private Access for App1 and Microsoft Entra Internet Access for App2