Microsoft SC-100 Online Practice Questions and Exam Preparation

Microsoft SC-100 Online Questions & Answers

• Question 281:

  You have a Microsoft 365 subscription that contains a group named Group1. The subscription contains 1,000 Windows devices that are joined to a Microsoft Entra tenant and managed by using Microsoft Intune. All users sign in to the devices by using standard user accounts.

  You plan to deploy a new app named App1 to the members of Group1. The Group1 members must have administrative rights to install new versions of App1.

  You need to ensure that the Group1 members can install new versions of App1. The solution must follow the principles of Zero Trust.

  What should you implement?

  A. Microsoft Local Administrator Password Solution (Microsoft LAPS)
  B. Endpoint Privilege Management (EPM)
  C. Privileged Identity Management (PIM)
  D. Microsoft Entra entitlement management
  B. Endpoint Privilege Management (EPM)

• Question 282:

  You have a Microsoft Entra tenant named contoso.com.

  You have an external partner that has a Microsoft Entra tenant named fabnkam.com.

  You need to recommend an identity governance solution for contoso.com that meets the following requirements:

  1. Enables the users in contoso.com and fabrikam.com to communicate by using shared Microsoft Teams channels

  2. Manages access to shared Teams channels in contoso.com by using groups in fabrikam.com

  3. Supports single sign-on (SSO)

  4. Minimizes administrative effort

  5. Maximizes security

  What should you include in the recommendation?

  A. Cross-tenant synchronization
  B. Microsoft Entra B2B collaboration
  C. B2B direct connect
  D. Microsoft Entra Connect Sync
  C. B2B direct connect

• Question 283:

  HOTSPOT

  You need to recommend an identity security solution for the Azure AD tenant of Litware. The solution must meet the identity requirements and the regulatory compliance requirements.

  What should you recommend? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: Azure AD administrative units

  Implement delegated management of users and groups in the Azure AD tenant of Litware, including support for:

  * The delegation of user management based on business units

  Without Azure AD administrative units, assigning a user to the User Administrator role in Azure AD gives them rights to manage all Azure AD users. With administrative units, the user is delegated the same role, User Administrator, but that role only applies to the specified administrative unit. The administrative unit contains the users and groups that are under the scope of management.

  Box 2: Enable password hash synchronization in the Azure AD Connect deployment

  Existing environment: Azure AD Connect is used to implement pass-through authentication.

  Password hash synchronization

  Risk detections like leaked credentials require the presence of password hashes for detection to occur.

  References:

  https://4sysops.com/archives/an-introduction-to-azure-ad-administrative-units/

  https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/concept-identity-protection-risks#password-hash-synchronization

• Question 284:

  Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem.

  After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.

  You have a Microsoft 365 subscription that uses Microsoft Defender XDR. The subscription contains 500 devices that are enrolled in Microsoft Intune. The subscription contains 500 users that connect to external software as a service (SaaS) apps by using the devices.

  You need to implement a solution that meets the following requirements:

  Allows user access to SaaS apps that Microsoft has identified as low risk.

  Blocks user access to Saas apps that Microsoft has identified as high risk.

  Solution: From Microsoft Defender for Cloud Apps, you configure a cloud discovery policy and unsanction risky apps.

  Does this meet the goal?

  A. Yes
  B. No
  A. Yes

• Question 285:

  HOTSPOT

  You have a Microsoft 365 subscription that is protected by using Microsoft 365 Defender.

  You are designing a security operations strategy that will use Microsoft Sentinel to monitor events from Microsoft 365 and Microsoft 365 Defender.

  You need to recommend a solution to meet the following requirements:

  1. Integrate Microsoft Sentinel with a third-party security vendor to access information about known malware.

  2. Automatically generate incidents when the IP address of a command-and-control server is detected in the events.

  What should you configure in Microsoft Sentinel to meet each requirement? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 286:

  You have a Microsoft 365 E5 subscription.

  You are designing a solution to protect confidential data in Microsoft SharePoint Online sites that contain more than one million documents.

  You need to recommend a solution to prevent Personally Identifiable Information (Pll) from being shared.

  Which two components should you include in the recommendation? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. data loss prevention (DLP) policies
  B. retention label policies
  C. eDiscovery cases
  D. sensitivity label policies
  A. data loss prevention (DLP) policies
  D. sensitivity label policies

  ---

  Explanation

  A: Data loss prevention in Office 365. Data loss prevention (DLP) helps you protect sensitive information and prevent its inadvertent disclosure. Examples of sensitive information that you might want to prevent from leaking outside your organization include financial data or personally identifiable information (PII) such as credit card numbers, social security numbers, or health records. With a data loss prevention (DLP) policy, you can identify, monitor, and automatically protect sensitive information across Office 365.

  D: Sensitivity labels

  Sensitivity labels from Microsoft Purview Information Protection let you classify and protect your organization's data without hindering the productivity of users and their ability to collaborate.

  Plan for integration into a broader information protection scheme. On top of coexistence with OME, sensitivity labels can be used along-side capabilities like Microsoft Purview Data Loss Prevention (DLP) and Microsoft Defender for Cloud Apps.

  Incorrect:

  Not B: Retention labels help you retain what you need and delete what you don't at the item level (document or email). They are also used to declare an item as a record as part of a records management solution for your Microsoft 365 data.

  Not C: eDiscovery cases in eDiscovery (Standard) and eDiscovery (Premium) let you associate specific searches and exports with a specific investigation. You can also assign members to a case to control who can access the case and view the contents of the case. Place content locations on legal hold.

  References:

  https://motionwave.com.au/keeping-your-confidential-data-secure-with-microsoft-office-365/

  https://docs.microsoft.com/en-us/microsoft-365/solutions/information-protection-deploy-protect-information?view=o365-worldwide#sensitivity-labels

• Question 287:

  Your company is moving all on-premises workloads to Azure and Microsoft 365.

  You need to design a security orchestration, automation, and response (SOAR) strategy in Microsoft Sentinel that meets the following requirements:

  1. Minimizes manual intervention by security operation analysts

  2. Supports triaging alerts within Microsoft Teams channels

  What should you include in the strategy?

  A. KQL
  B. playbooks
  C. data connectors
  D. KQLworkbooks
  B. playbooks

  ---

  Explanation

  Playbooks in Microsoft Sentinel are based on workflows built in Azure Logic Apps, a cloud service that helps you schedule, automate, and orchestrate tasks and workflows across systems throughout the enterprise.

  A playbook is a collection of these remediation actions that can be run from Microsoft Sentinel as a routine. A playbook can help automate and orchestrate your threat response; it can be run manually or set to run automatically in response to specific alerts or incidents, when triggered by an analytics rule or an automation rule, respectively.

  Incorrect:

  Not A: Kusto Query Language is a powerful tool to explore your data and discover patterns, identify anomalies and outliers, create statistical modeling, and more. The query uses schema entities that are organized in a hierarchy similar to SQL's: databases, tables, and columns.

  Not D: Workbooks provide a flexible canvas for data analysis and the creation of rich visual reports within the Azure portal. They allow you to tap into multiple data sources from across Azure, and combine them into unified interactive experiences.

  Workbooks allow users to visualize the active alerts related to their resources.

  References:

  https://docs.microsoft.com/en-us/azure/sentinel/automate-responses-with-playbooks

  https://docs.microsoft.com/en-us/azure/azure-monitor/visualize/workbooks-overview

• Question 288:

  HOTSPOT

  Your company wants to optimize using Azure to protect its resources from ransomware.

  You need to recommend which capabilities of Azure Backup and Azure Storage provide the strongest protection against ransomware attacks. The solution must follow Microsoft Security Best Practices.

  What should you recommend? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 289:

  You have an Azure subscription and an Azure DevOps organization.

  You need to recommend a solution for connecting Azure DevOps pipelines to the resources in the subscription by using Azure Resource Manager (ARM) service connections. The solution must align with Microsoft Cloud Adoption Framework for Azure best practices, including the principle of least privilege.

  What should you include in the recommendation?

  A. workload identity federation and system-assigned managed identities
  B. service principals and secrets
  C. workload identity federation and user-assigned managed identities
  D. workload identity federation and service principals
  C. workload identity federation and user-assigned managed identities

• Question 290:

  You have a Microsoft Entra tenant that syncs with an Active Directory Domain Services (AD DS) domain. Client computers run Windows and are hybrid-joined to Microsoft Entra.

  You are designing a strategy to protect endpoints against ransomware. The strategy follows Microsoft Security Best Practices.

  You plan to remove all the domain accounts from the Administrators groups on the Windows computers.

  You need to recommend a solution that will provide users with administrative access to the Windows computers only when access is required. The solution must minimize the lateral movement of ransomware attacks if an administrator account on a computer is compromised.

  What should you include in the recommendation?

  A. Local Administrator Password Solution (LAPS)
  B. Azure AD Identity Protection
  C. Azure AD Privileged Identity Management (PIM)
  D. Privileged Access Workstations (PAWs)
  A. Local Administrator Password Solution (LAPS)

  ---

  Explanation

  Microsoft's "Local Administrator Password Solution" (LAPS) provides management of local administrator account passwords for domain-joined computers. Passwords are randomized and stored in Active Directory (AD), protected by ACLs, so only eligible users can read it or request its reset.

  Microsoft LAPS is short for Microsoft Local Administrator Password Solution. When installed and enabled on domain-joined computers it takes over the management of passwords of local accounts. Passwords are automatically changed to random characters that meet the domain's password policy requirements at a frequency that you define through Group Policy.

  The passwords are stored in a protected "confidential" attribute on the Computer object in AD. Unlike most other attributes which can be read by all domain users by default, the confidential attributes require extra privileges to be granted in order to read them, thus securing the managed passwords.

  Incorrect:

  Not B: Integrate on-premises Active Directory domains with Azure Active Directory Validate security configuration and policy, Actively monitor Azure AD for signs of suspicious activity

  Consider using Azure AD Premium P2 edition, which includes Azure AD Identity Protection. Identity Protection uses adaptive machine learning algorithms and heuristics to detect anomalies and risk events that may indicate that an identity has been compromised. For example, it can detect potentially unusual activity such as irregular sign-in activities, sign-ins from unknown sources or from IP addresses with suspicious activity, or sign-ins from devices that may be infected.

  Identity Protection uses this data to generate reports and alerts that enable you to investigate these risk events and take appropriate action.

  Not C: Azure AD PIM is a service in Azure AD that enables you to manage, control, and monitor access to resources in Azure AD, Azure, and other Microsoft Online Services such as Microsoft 365 or Microsoft Intune.

  Not D: Privileged Access Workstations (PAWs) provide a dedicated operating system for sensitive tasks that is protected from Internet attacks and threat vectors. Separating these sensitive tasks and accounts from the daily use workstations and devices provides very strong protection from phishing attacks, application and OS vulnerabilities, various impersonation attacks, and credential theft attacks such as keystroke logging, Pass-the-Hash, and Pass-The-Ticket.

  References:

  https://craighays.com/microsoft-laps/

  https://learn.microsoft.com/en-us/azure/architecture/reference-architectures/identity/azure-ad