Microsoft SC-100 Online Practice Questions and Exam Preparation

Microsoft SC-100 Online Questions & Answers

• Question 291:

  DRAG DROP

  You have an Azure environment that contains multiple workloads deployed across multiple subscriptions.

  You need to recommend a solution to assess and improve the security posture of the workloads.

  The solution must meet the following requirements:

  1. Use the Microsoft Cloud Adoption Framework for Azure to evaluate compliance with cloud governance policies.

  2. Use the Azure Well-Architected Framework to secure individual workloads.

  What should you include in the recommendation for each requirement? To answer, drag the appropriate recommendations to the correct requirements. Each recommendation may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

  NOTE: Each correct selection is worth one point.

  Select and Place:

  

  

• Question 292:

  You have an Azure subscription that contains several storage accounts. The storage accounts are accessed by legacy applications that are authenticated by using access keys.

  You need to recommend a solution to prevent new applications from obtaining the access keys of the storage accounts. The solution must minimize the impact on the legacy applications.

  What should you include in the recommendation?

  A. Apply read-only locks on the storage accounts.
  B. Set the AllowSharcdKeyAccess property to false.
  C. Set the AllowBlobPublicAcccss property to false.
  D. Configure automated key rotation.
  A. Apply read-only locks on the storage accounts.

  ---

  Explanation

  A read-only lock on a storage account prevents users from listing the account keys. A POST request handles the Azure Storage List Keys operation to protect access to the account keys. The account keys provide complete access to data in the storage account.

  Incorrect:

  Not A:

  If any clients are currently accessing data in your storage account with Shared Key, then Microsoft recommends that you migrate those clients to Azure AD before disallowing Shared Key access to the storage account.

  However, in this scenario we cannot migrate to Azure AD due to the legacy applications.

  Note: Shared Key

  A shared key is a very long string. You can simply access Azure storage by using this long string. It's almost like a password. Actually, it's worse: this is a master password. It gives you all sorts of rights on the Azure storage account. You can imagine why this isn't my favorite mechanism of accessing Azure storage. What happens when this key is compromised? You don't get an alert. Perhaps you can set up monitoring to see misuse of your Azure storage account. But it's still less than an ideal situation. Alerts will tell you of damage after it has already occurred.

  Not C: Data breaches caused by cloud misconfiguration have been seen for the past few years. One of the most common misconfigurations is granting public access to cloud storage service. Such a data is often unprotected, making them to be accessed without any authentication method. Microsoft recently introduced a new protection feature to help avoid public access on storage account. The feature introduces a new property named allowBlobPublicAccess.

  Not D: Key rotation would improve security.

  Automated key rotation in Key Vault allows users to configure Key Vault to automatically generate a new key version at a specified frequency.

  You can use rotation policy to configure rotation for each individual key. Our recommendation is to rotate encryption keys at least every two years to meet cryptographic best practices.

  This feature enables end-to-end zero-touch rotation for encryption at rest for Azure services with customer-managed key (CMK) stored in Azure Key Vault.

  References:

  https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/lock-resources

  https://docs.microsoft.com/en-us/azure/storage/common/shared-key-authorization-prevent

  https://docs.microsoft.com/en-us/azure/key-vault/keys/how-to-configure-key-rotation

• Question 293:

  Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem.

  After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.

  You have a Microsoft 365 subscription that uses Microsoft Defender XDR. The subscription contains 500 devices that are enrolled in Microsoft Intune. The subscription contains 500 users that connect to external software as a service (SaaS) apps by using the devices.

  You need to implement a solution that meets the following requirements:

  Allows user access to SaaS apps that Microsoft has identified as low risk.

  Blocks user access to Saas apps that Microsoft has identified as high risk.

  Solution: You configure app protection policies in Intune, and you create a Conditional Access policy.

  Does this meet the goal?

  A. Yes
  B. No
  B. No

• Question 294:

  HOTSPOT

  You are designing a privileged access strategy for a company named Contoso, Ltd. and its partner company named Fabrikam, Inc. Contoso has an Azure AD tenant named contoso.com. Fabrikam has an Azure AD tenant named fabrikam.com. Users at Fabrikam must access the resources in contoso.com.

  You need to provide the Fabrikam users with access to the Contoso resources by using access packages. The solution must meet the following requirements:

  Ensure that the Fabrikam users can use the Contoso access packages without explicitly creating guest accounts in contoso.com.

  Allow non-administrative users in contoso.com to create the access packages.

  What should you use for each requirement? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: A connected organization Ensure that the Fabrikam users can use the Contoso access packages without explicitly creating guest accounts in contoso.com.

  How access works for external users

  The following diagram and steps provide an overview of how external users are granted access to an access package.

  1. You add a connected organization for the Azure AD directory or domain you want to collaborate with. You can also configure a connected organization for a social identity provider.

  2. You check the catalog setting Enabled for external users in the catalog to contain the access package is Yes.

  3. Etc.

  Box 2: Catalogs

  Allow non-administrative users in contoso.com to create the access packages.

  Note: Govern access for external users in entitlement management Entitlement management uses Azure AD business-to-business (B2B) to share access so you can collaborate with people outside your organization. With Azure AD B2B, external users authenticate to their home directory, but have a representation in your directory. The representation in your directory enables the user to be assigned access to your resources.

  References:

  https://learn.microsoft.com/en-us/azure/active-directory/governance/entitlement-management-external-users

• Question 295:

  You are designing a ransomware response plan that follows Microsoft Security Best Practices.

  You need to recommend a solution to minimize the risk of a ransomware attack encrypting local user files.

  What should you include in the recommendation?

  A. Windows Defender Device Guard
  B. Microsoft Defender for Endpoint
  C. Azure Files
  D. BitLocker Drive Encryption (BitLocker)
  E. protected folders
  E. protected folders

• Question 296:

  HOTSPOT

  Your network contains an on-premises Active Directory Domain Services (AO DS) domain. The domain contains a server that runs Windows Server and hosts shared folders.

  The domain syncs with Azure AD by using Azure AD Connect Azure AD Connect has group writeback enabled.

  You have a Microsoft 365 subscription that uses Microsoft SharePoint Online.

  You have multiple project teams. Each team has an AD DS group that syncs with Azure AD Each group has permissions to a unique SharePoint Online site and a Windows Server shared folder for its project. Users routinely move between project teams.

  You need to recommend an Azure AD identity Governance solution that meets the following requirements:

  1. Project managers must verify that their project group contains only the current members of their project team

  2. The members of each project team must only have access to the resources of the project to which they are assigned

  3. Users must be removed from a project group automatically if the project manager has MOT verified the group s membership for 30 days.

  4. Administrative effort must be minimized.

  What should you include in the recommendation? To answer select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 297:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Azure subscription that has Microsoft Defender for Cloud enabled.

  You are evaluating the Azure Security Benchmark V3 report.

  In the Secure management ports controls, you discover that you have 0 out of a potential 8 points.

  You need to recommend configurations to increase the score of the Secure management ports controls.

  Solution: You recommend onboarding all virtual machines to Microsoft Defender for Endpoint.

  Does this meet the goal?

  A. Yes
  B. No
  B. No

  ---

  Explanation

  Note: Secure management ports - Brute force attacks often target management ports. Use these recommendations to reduce your exposure with tools like just-in-time VM access and network security groups.

  Recommendations:

  - Internet-facing virtual machines should be protected with network security groups

  - Management ports of virtual machines should be protected with just-in-time network access control

  - Management ports should be closed on your virtual machines

  References:

  https://docs.microsoft.com/en-us/azure/defender-for-cloud/secure-score-security-controls

• Question 298:

  You have an Azure subscription. The subscription contains 50 virtual machines that run Windows Server and 50 virtual machines that run Linux.

  You need to perform vulnerability assessments on the virtual machines. The solution must meet the following requirements:

  1. Identify missing updates and insecure configurations.

  2. Use the Qualys engine.

  What should you use?

  A. Microsoft Defender for Servers
  B. Microsoft Defender Threat Intelligence (Defender TI)
  C. Microsoft Defender for Endpoint
  D. Microsoft Defender External Attack Surface Management (Defender EASM)
  A. Microsoft Defender for Servers

  ---

  Explanation

  The vulnerability scanner included with Microsoft Defender for Cloud is powered by Qualys. Qualys' scanner is one of the leading tools for real-time identification of vulnerabilities. It's only available with Microsoft Defender for Servers.

  Note: Enable vulnerability scanning with the integrated Qualys scanner

  A core component of every cyber risk and security program is the identification and analysis of vulnerabilities. Defender for Cloud regularly checks your connected machines to ensure they're running vulnerability assessment tools.

  When a machine is found that doesn't have a vulnerability assessment solution deployed, Defender for Cloud generates the security recommendation: Machines should have a vulnerability assessment solution. Use this recommendation to deploy the vulnerability assessment solution to your Azure virtual machines and your Azure Arc-enabled hybrid machines.

  Defender for Cloud includes vulnerability scanning for your machines. You don't need a Qualys license or even a Qualys account - everything's handled seamlessly inside Defender for Cloud.

  References:

  https://learn.microsoft.com/en-us/azure/defender-for-cloud/deploy-vulnerability-assessment-vm

• Question 299:

  HOTSPOT

  You have a Microsoft 365 E5 subscription that uses Microsoft Exchange Online.

  You need to recommend a solution to prevent malicious actors from impersonating the email addresses of internal senders.

  What should you include in the recommendation? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 300:

  You have the following on-premises servers that run Windows Server:

  1. Two domain controllers in an Active Directory Domain Services (AD DS) domain

  2. Two application servers named Server1 and Server2 that run ASP.NET web apps

  3. A VPN server named Served that authenticates by using RADIUS and AD DS

  4. End users use a VPN to access the web apps over the internet.

  You need to redesign a user access solution to increase the security of the connections to the web apps.

  The solution must minimize the attack surface and follow the Zero Trust principles of the Microsoft Cybersecurity Reference Architectures (MCRA).

  What should you include in the recommendation?

  A. Publish the web apps by using Azure AD Application Proxy.
  B. Configure the VPN to use Azure AD authentication.
  C. Configure connectors and rules in Microsoft Defender for Cloud Apps.
  D. Configure web protection in Microsoft Defender for Endpoint.
  A. Publish the web apps by using Azure AD Application Proxy.