Microsoft SC-100 Online Practice Questions and Exam Preparation

Microsoft SC-100 Online Questions & Answers

• Question 21:

  You have an Azure subscription. The subscription contains multiple Azure App Service web apps that are distributed across multiple Azure regions and are accessed via the internet.

  You need to ensure that all incoming requests to the apps are inspected for threats based on the Core Rule Set (CRS) from the Open Web Application Security Project (OWASP). The solution must meet the following requirements:

  1. Support the use of Microsoft-managed X.509 certificates.

  2. Route users to the geographically closest app.

  3. Minimize administrative effort.

  What should you use?

  A. Azure Firewall Premium
  B. Azure Front Door with a web application firewall (WAF)
  C. Azure Firewall Standard
  D. Azure Application Gateway with a web application firewall (WAF)
  B. Azure Front Door with a web application firewall (WAF)

• Question 22:

  HOTSPOT

  You have a multi-cloud environment that contains an Azure subscription and an Amazon Web Services (AWS) account.

  You need to implement security services in Azure to manage the resources in both subscriptions. The solution must meet the following requirements:

  1. Automatically identify threats found in AWS CloudTrail events.

  2. Enforce security settings on AWS virtual machines by using Azure policies.

  What should you include in the solution for each requirement? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: Microsoft Sentinel

  Automatically identify threats found in AWS CloudTrail events.

  AWSCloudTrail

  CloudTrail logs, which ingested from Sentinel's connector, holds all your data and management events of your Amazon Wev Services account.

  Box 2: Azure Arc

  Enforce security settings on AWS virtual machines by using Azure policies.

  You can manage Azure policies and deploy the Azure monitoring agent extension to Azure Arc Linux and Windows servers.

  Use Azure Arc-enabled servers to assign Azure policies to VMs outside of Azure, whether they are on-premises or on other clouds. With this feature you can now use Azure Policy to audit settings in the operating system of an Azure Arc-enabled server, if a setting is not compliant you can also trigger a remediation task.

  In this case, you will assign a policy to audit if the Azure Arc-connected machine has the Log Analytics agent installed. If not, use the extensions feature to automatically deploy it to the VM, an enrollment experience that levels to Azure VMs.

  This approach can be used to make sure all your servers are onboard to services such as Azure Monitor, Microsoft Defender for Cloud, Microsoft Sentinel, and so on.

  Type of supported VMs outside Azure include:

  GCP Ubuntu instance

  GCP Windows instance

  AWS Ubuntu EC2 instance

  AWS Amazon Linux 2 EC2 instance

  VMware vSphere Ubuntu VM

  VMware vSphere Windows Server VM Vagrant Ubuntu box Vagrant Windows box

  References:

  https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/awscloudtrail

  https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/manage/hybrid/server/best-practices/arc-policies-mma

• Question 23:

  You have a Microsoft 365 subscription that contains 1,000 users. Each user is assigned a Microsoft 365 E5 license.

  The subscription uses sensitivity labels to classify corporate documents. All the users have Windows 11 devices that are onboarded to Microsoft Defender for Endpoint and are configured to sync files to Microsoft OneDrive.

  You need to prevent the users from uploading the documents from OneDrive to external websites.

  What should you include in the solution?

  A. Microsoft Purview Information Protection
  B. Microsoft Purview data loss prevention (DLP)
  C. web content filtering in Defender for Endpoint
  D. an endpoint security policy
  B. Microsoft Purview data loss prevention (DLP)

• Question 24:

  You use Azure Pipelines with Azure Repos to implement continuous integration and continuous deployment (CI/CD) workflows for the deployment of applications to Azure. You need to recommend what to include in dynamic application security testing (DAST) based on the principles of the Microsoft Cloud Adoption Framework for Azure.

  What should you recommend?

  A. unit testing
  B. penetration testing
  C. dependency checks
  D. threat modeling
  B. penetration testing

  ---

  Explanation

  Dynamic application security testing (DAST)

  In a classical waterfall development model, security was typically introduced at the last step, right before going to production. One of the most popular security approaches is penetration testing or pen testing. Penetration testing lets a team look at the application from a black-box security perspective, as in, closest to an attacker mindset.

  References:

  https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/secure/devsecops-controls

  https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-devops-security

• Question 25:

  HOTSPOT

  You have an Azure subscription that contains an Azure key vault named Vault1.

  You plan to deploy multiple virtual machines that will host a custom app named App1. App1 will use secrets stored in Vault1. The virtual machines will be redeployed regularly based on the usage demands of App1.

  You need to recommend a solution that will enable App1 to access the secrets stored in Vault1. The solution must meet the following requirements:

  Minimize the number of security principals that can access Vault1. Minimize the storage of sensitive data on the virtual machines.

  Minimize administrative effort.

  Which type of endpoint should App1 use to access the secrets, and which type of identity should App1 use? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 26:

  You have a Microsoft 365 subscription and an Azure subscription. Microsoft 365 Defender and Microsoft Defender for Cloud are enabled.

  The Azure subscription contains 50 virtual machines. Each virtual machine runs different applications on Windows Server 2019.

  You need to recommend a solution to ensure that only authorized applications can run on the virtual machines. If an unauthorized application attempts to run or be installed, the application must be blocked automatically until an administrator authorizes the application.

  Which security control should you recommend?

  A. Azure AD Conditional Access App Control policies
  B. Azure Security Benchmark compliance controls in Defender for Cloud
  C. app protection policies in Microsoft Endpoint Manager
  D. application control policies in Microsoft Defender for Endpoint
  D. application control policies in Microsoft Defender for Endpoint

  ---

  Explanation

  Windows Defender Application Control is designed to protect devices against malware and other untrusted software. It prevents malicious code from running by ensuring that only approved code, that you know, can be run.

  Application Control is a software-based security layer that enforces an explicit list of software that is allowed to run on a PC.

  Note: Windows Defender Application Control is designed to protect devices against malware and other untrusted software. It prevents malicious code from running by ensuring that only approved code, that you know, can be run.

  Application Control is a software-based security layer that enforces an explicit list of software that is allowed to run on a PC.

  Incorrect:

  Not C: App protection policies (APP) are rules that ensure an organization's data remains safe or contained in a managed app. A policy can be a rule that is enforced when the user attempts to access or move "corporate" data, or a set of actions that are prohibited or monitored when the user is inside the app. A managed app is an app that has app protection policies applied to it, and can be managed by Intune.

  Mobile Application Management (MAM) app protection policies allows you to manage and protect your organization's data within an application. Many productivity apps, such as the Microsoft Office apps, can be managed by Intune MAM.

  References:

  https://learn.microsoft.com/en-us/defender-cloud-apps/proxy-intro-aad

  https://learn.microsoft.com/en-us/mem/intune/apps/app-protection-policy

• Question 27:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Azure subscription that has Microsoft Defender for Cloud enabled.

  You are evaluating the Azure Security Benchmark V3 report.

  In the Secure management ports controls, you discover that you have 0 out of a potential 8 points.

  You need to recommend configurations to increase the score of the Secure management ports controls.

  Solution: You recommend enabling just-in-time (JIT) VM access on all virtual machines.

  Does this meet the goal?

  A. Yes
  B. No
  A. Yes

  ---

  Explanation

  Secure management ports - Brute force attacks often target management ports. Use these recommendations to reduce your exposure with tools like just-in-time VM access and network security groups.

  Recommendations:

  - Internet-facing virtual machines should be protected with network security groups

  - Management ports of virtual machines should be protected with just-in-time network access control

  - Management ports should be closed on your virtual machines

  References:

  https://docs.microsoft.com/en-us/azure/defender-for-cloud/secure-score-security-controls

• Question 28:

  HOTSPOT

  You have a Microsoft 365 subscription. The subscription contains Windows 11 devices that are protected by using Microsoft Defender XDR.

  You need to block access to file sharing sites from the devices. The solution must meet the following requirements:

  1. Identify file sharing sites to which users have connected during the last 90 days.

  2. Prevent the users from connecting to the identified file sharing sites.

  3. Minimize administrative effort.

  What should you use to identify the file sharing sites, and which Microsoft Defender service should you use to prevent the users from connecting to the sites? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 29:

  Your company has a Microsoft 365 subscription and uses Microsoft Defender for Identity.

  You are informed about incidents that relate to compromised identities.

  You need to recommend a solution to expose several accounts for attackers to exploit. When the attackers attempt to exploit the accounts, an alert must be triggered.

  Which Defender for Identity feature should you include in the recommendation?

  A. sensitivity labels
  B. custom user tags
  C. standalone sensors
  D. honeytoken entity tags
  D. honeytoken entity tags

  ---

  Explanation

  Honeytoken entities are used as traps for malicious actors. Any authentication associated with these honeytoken entities triggers an alert.

  Incorrect:

  Not B: custom user tags

  After you apply system tags or custom tags to users, you can use those tags as filters in alerts, reports, and investigation.

  References:

  https://docs.microsoft.com/en-us/microsoft-365/security/defender-identity/entity-tags

• Question 30:

  HOTSPOT

  You have a Microsoft 365 E5 subscription that uses Microsoft Defender XDR and Microsoft Purview.

  You need to recommend a data protection solution. The solution must ensure that you can identify users that download atypical amounts of data from Microsoft SharePoint Online.

  Which service should you include in the recommendation, and which policy should be configured? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.