Microsoft SC-100 Online Practice Questions and Exam Preparation

Microsoft SC-100 Online Questions & Answers

• Question 271:

  You have an Azure subscription.

  You intend to deploy enterprise-scale landing zones using the Microsoft Cloud Adoption Framework for Azure.

  The deployment will consist of a single platform landing zone for all shared services, as well as three application landing zones, each dedicated to hosting a distinct Azure application.

  You are tasked with recommending which resources should be deployed to each landing zone.

  The solution must adhere to the best-practice recommendations outlined in the Cloud Adoption Framework for enterprise-scale landing zones.

  What resources should you recommend for deployment?

  A. an Azure firewall
  B. an Azure virtual network gateway
  C. an Azure Private DNS zone
  D. an Azure key vault
  C. an Azure Private DNS zone

  ---

  Explanation

  Azure landing zones consist of a set of resources and configuration. Some of these items, like management groups, policies, and role assignments, are stored at either a tenant or management group level within the Azure landing zone architecture. These resources aren't deployed to a particular region and instead are deployed globally. However, you still need to specify a deployment region because Azure tracks some of the resource metadata in a regional metadata store.

  If you deploy a networking topology, you also need to select an Azure region to deploy the networking resources to. This region can be different from the region that you use for the resources listed in the preceding list. Depending on the topology you select, the networking resources that you deploy might include:

  Azure Virtual WAN, including a Virtual WAN hub Azure virtual networks

  VPN gateway

  Azure ExpressRoute gateway

  Azure Firewall

  Azure DDoS Protection plans

  *-> Azure private DNS zones, including zones for Azure Private Link Resource groups, to contain the preceding resources

  References:

  https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ready/considerations/regions

• Question 272:

  HOTSPOT

  You have two on-premises servers, Server1 and Server2, that run Windows Server. Server1 contains an app named App1 and is isolated from the internet.

  You have a Microsoft Entra tenant, and you plan to deploy Global Secure Access to provide remote access to App1.

  You need to configure the tenant and Server2 to support the planned deployment. The solution must ensure that when users attempt to access App1, they must authenticate using their Microsoft Entra credentials.

  What should you create in the tenant, and what should you install on Server2?

  To answer, select the appropriate options in the answer area.

  

  

  ---

  Box 1: An enterprise application Quick Access and Global Secure Access apps.

  When you configure the Quick Access and Global Secure Access apps, you create a new enterprise application. The app serves as a container for the private resources that you want to secure. The application has its own Microsoft Entra private network connector to broker the connection between the service and the internal resource. You can assign users and groups to the app, and then use Conditional Access policies to control access to the app.

  Box 2: Microsoft Entra private network connector

  Global Secure Access, How to configure private network connectors for Microsoft Entra Private Access and Microsoft Entra application proxy Connectors are lightweight agents that sit on a server in a private network and facilitate the outbound connection to the Global Secure Access service. Connectors must be installed on a Windows Server that has access to the backend resources and applications. You can organize connectors into connector groups, with each group handling traffic to specific applications.

  User identities must be synchronized from an on-premises directory or created directly within your Microsoft Entra tenants. Identity synchronization allows Microsoft Entra ID to pre-authenticate users before granting them access to application proxy published applications and to have the necessary user identifier information to perform single sign-on (SSO).

  References:

  https://learn.microsoft.com/en-us/entra/global-secure-access/concept-private-access

  https://learn.microsoft.com/en-us/entra/global-secure-access/how-to-configure-connectors

• Question 273:

  You have two Azure subscriptions named Sub1 and Sub2 that contain the vaults shown in the following table.

  

  You need to design a multi-user authorization (MUA) solution for security operations on the vaults. The solution must meet the following requirements:

  RSVault1 and RSVault2 must require MUA for disabling soft delete, removing MUA protection, and disabling immutability.

  BackupVault1 and BackupVault2 must require MUA for disabling soft delete and removing MUA protection.

  What is the minimum number of Resource Guard resources required?

  A. 1
  B. 2
  C. 3
  D. 4
  C. 3

• Question 274:

  You have a Microsoft 365 subscription that contains 500 users. Each user is assigned a Microsoft 365 E5 license and uses a Windows device.

  Microsoft Purview data loss prevention (DLP) policies are applied to Microsoft Exchange Online email and SharePoint Online sites.

  You plan to monitor the usage of third-party generative AI apps by using Microsoft Purview Data Security Posture Management for AI (DSPM for AI).

  What should you do first?

  A. Enable Microsoft Purview insider risk management for all the users.
  B. Onboard all endpoint devices to Microsoft Purview.
  C. Configure Microsoft Purview data connectors for the generative AI apps.
  D. License all the users for Microsoft 365 Copilot.
  B. Onboard all endpoint devices to Microsoft Purview.

• Question 275:

  HOTSPOT

  You have a Microsoft 365 subscription.

  Microsoft Purview is configured to protect data in only Microsoft Exchange Online and SharePoint Online. Custom sensitive information types (SITs) have been created to identify confidential data.

  You discover that users access third-party generative AI websites from their Windows devices.

  You need to recommend a solution to block AI prompts that contain confidential data and scan the AI prompts submitted to the third-party websites.

  What should you recommend for each requirement? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 276:

  You have an Azure Kubernetes Service (AKS) cluster that hosts Linux nodes.

  You need to recommend a solution to ensure that deployed worker nodes have the latest kernel updates.

  The solution must minimize administrative effort.

  What should you recommend?

  A. The nodes must restart after the updates are applied.
  B. The updates must first be applied to the image used to provision the nodes.
  C. The AKS cluster version must be upgraded.
  B. The updates must first be applied to the image used to provision the nodes.

• Question 277:

  HOTSPOT

  For a Microsoft cloud environment, you are designing a security architecture based on the Microsoft Cybersecurity Reference Architectures (MCRA).

  You need to protect against the following external threats of an attack chain:

  1. An attacker attempts to exfiltrate data to external websites.

  2. An attacker attempts lateral movement across domain-joined computers.

  What should you include in the recommendation for each threat? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: Microsoft Defender for Identity

  An attacker attempts to exfiltrate data to external websites.

  Exfiltration alerts

  Typically, cyberattacks are launched against any accessible entity, such as a low-privileged user, and then quickly move laterally until the attacker gains access to valuable assets. Valuable assets can be sensitive accounts, domain administrators, or highly sensitive data. Microsoft Defender for Identity identifies these advanced threats at the source throughout the entire attack kill chain and classifies them into the following phases:

  Reconnaissance

  Compromised credentials

  Lateral Movements

  Domain dominance

  Exfiltration

  Box 2: Microsoft Defender for Identity

  An attacker attempts lateral movement across domain-joined computers.

  Microsoft Defender for Identity Lateral Movement Paths (LMPs)

  Lateral movement is when an attacker uses non-sensitive accounts to gain access to sensitive accounts throughout your network. Lateral movement is used by attackers to identify and gain access to the sensitive accounts and machines in your network that share stored sign-in credentials in accounts, groups and machines. Once an attacker makes successful lateral moves towards your key targets, the attacker can also take advantage and gain access to your domain controllers. Lateral movement attacks are carried out using many of the methods described in Microsoft Defender for Identity Security Alerts.

  A key component of Microsoft Defender for Identity's security insights are Lateral Movement Paths or LMPs. Defender for Identity LMPs are visual guides that help you quickly understand and identify exactly how attackers can move laterally inside your network.

  References:

  https://learn.microsoft.com/en-us/defender-for-identity/exfiltration-alerts

• Question 278:

  You are designing a security operations strategy based on the Zero Trust framework.

  You need to minimize the operational load on Tier 1 Microsoft Security Operations Center (SOC) analysts.

  What should you do?

  A. Enable built-in compliance policies in Azure Policy.
  B. Enable self-healing in Microsoft 365 Defender.
  C. Automate data classification.
  D. Create hunting queries in Microsoft 365 Defender.
  B. Enable self-healing in Microsoft 365 Defender.

• Question 279:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You are designing a security strategy for providing access to Azure App Service web apps through an Azure Front Door instance.

  You need to recommend a solution to ensure that the web apps only allow access through the Front Door instance.

  Solution: You recommend configuring gateway-required virtual network integration.

  Does this meet the goal?

  A. Yes
  B. No
  B. No

  ---

  Explanation

  Instead: You recommend access restrictions based on HTTP headers that have the Front Door ID.

  Restrict access to a specific Azure Front Door instance Traffic from Azure Front Door to your application originates from a well-known set of IP ranges defined in the AzureFrontDoor.Backend service tag. Using a service tag restriction rule, you can restrict traffic to only originate from Azure Front Door. To ensure traffic only originates from your specific instance, you will need to further filter the incoming requests based on the unique http header that Azure Front Door sends.

  Incorrect:

  Virtual Network (VNet) integration for an Azure service enables you to lock down access to the service to only your virtual network infrastructure. The VNet infrastructure also includes peered virtual networks and on-premises networks.

  VNet integration provides Azure services the benefits of network isolation and can be accomplished by one or more of the following methods:

  Deploying dedicated instances of the service into a virtual network. The services can then be privately accessed within the virtual network and from on-premises networks.

  Using Private Endpoint that connects you privately and securely to a service powered by Azure Private Link. Private Endpoint uses a private IP address from your VNet, effectively bringing the service into your virtual network.

  Accessing the service using public endpoints by extending a virtual network to the service, through service endpoints. Service endpoints allow service resources to be secured to the virtual network.

  Using service tags to allow or deny traffic to your Azure resources to and from public IP endpoints.

  References:

  https://docs.microsoft.com/en-us/azure/app-service/app-service-ip-restrictions

  https://docs.microsoft.com/en-us/azure/virtual-network/vnet-integration-for-azure-services

• Question 280:

  HOTSPOT

  Your company is migrating data to Azure. The data contains Personally Identifiable Information (PII).

  The company plans to use Microsoft Information Protection for the PII data store in Azure.

  You need to recommend a solution to discover PII data at risk in the Azure resources.

  What should you include in the recommendation? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: Azure Purview

  Microsoft Purview is a unified data governance service that helps you manage and govern your on-premises, multi-cloud, and software-as-a-service (SaaS) data. Microsoft Purview allows you to:

  Create a holistic, up-to-date map of your data landscape with automated data discovery, sensitive data classification, and end-to-end data lineage.

  Enable data curators to manage and secure your data estate.

  Empower data consumers to find valuable, trustworthy data.

  Box 2: Microsoft Defender for Cloud Microsoft Purview provides rich insights into the sensitivity of your data. This makes it valuable to security teams using Microsoft Defender for Cloud to manage the organization's security posture and protect against threats to their workloads.

  Data resources remain a popular target for malicious actors, making it crucial for security teams to identify, prioritize, and secure sensitive data resources across their cloud environments. The integration with Microsoft Purview expands visibility into the data layer, enabling security teams to prioritize resources that contain sensitive data.

  References:

  https://docs.microsoft.com/en-us/azure/purview/overview

  https://docs.microsoft.com/en-us/azure/purview/how-to-integrate-with-azure-security-products