Microsoft SC-100 Online Practice Questions and Exam Preparation

Microsoft SC-100 Online Questions & Answers

• Question 311:

  You have Microsoft Defender for Cloud assigned to Azure management groups.

  You have a Microsoft Sentinel deployment.

  During the triage of alerts, you require additional information about the security events, including suggestions for remediation.

  Which two components can you use to achieve the goal? Each correct answer presents a complete solution.

  NOTE: Each correct selection is worth one point.

  A. Microsoft Sentinel threat intelligence workbooks
  B. Microsoft Sentinel notebooks
  C. threat intelligence reports in Defender for Cloud
  D. workload protections in Defender for Cloud
  A. Microsoft Sentinel threat intelligence workbooks
  C. threat intelligence reports in Defender for Cloud

  ---

  Explanation

  A: Workbooks provide insights about your threat intelligence Workbooks provide powerful interactive dashboards that give you insights into all aspects of Microsoft Sentinel, and threat intelligence is no exception. You can use the built-in Threat Intelligence workbook to visualize key information about your threat intelligence, and you can easily customize the workbook according to your business needs. You can even create new dashboards combining many different data sources so you can visualize your data in unique ways. Since Microsoft Sentinel workbooks are based on Azure Monitor workbooks, there is already extensive documentation available, and many more templates.

  C: What is a threat intelligence report?

  Defender for Cloud's threat protection works by monitoring security information from your Azure resources, the network, and connected partner solutions. It analyzes this information, often correlating information from multiple sources, to identify threats.

  Defender for Cloud has three types of threat reports, which can vary according to the attack. The reports available are:

  Activity Group Report: provides deep dives into attackers, their objectives, and tactics.

  Campaign Report: focuses on details of specific attack campaigns.

  Threat Summary Report: covers all of the items in the previous two reports.

  This type of information is useful during the incident response process, where there's an ongoing investigation to understand the source of the attack, the attacker's motivations, and what to do to mitigate this issue in the future.

  Incorrect:

  Not B: When to use Jupyter notebooks While many common tasks can be carried out in the portal, Jupyter extends the scope of what you can do with this data.

  For example, use notebooks to:

  Perform analytics that aren't provided out-of-the box in Microsoft Sentinel, such as some Python machine learning features Create data visualizations that aren't provided out-of-the box in Microsoft Sentinel, such as custom timelines and process trees Integrate data sources outside of Microsoft Sentinel, such as an on-premises data set.

  Not D: Defender for Cloud offers security alerts that are powered by Microsoft Threat Intelligence. It also includes a range of advanced, intelligent, protections for your workloads. The workload protections are provided through Microsoft Defender plans specific to the types of resources in your subscriptions. For example, you can enable Microsoft Defender for Storage to get alerted about suspicious activities related to your Azure Storage accounts.

  References:

  https://docs.microsoft.com/en-us/azure/sentinel/understand-threat-intelligence

  https://docs.microsoft.com/en-us/azure/defender-for-cloud/defender-for-cloud-introduction

  https://docs.microsoft.com/en-us/azure/defender-for-cloud/threat-intelligence-reports

  https://docs.microsoft.com/en-us/azure/sentinel/notebooks

• Question 312:

  Your company plans to follow DevSecOps best practices of the Microsoft Cloud Adoption Framework for Azure.

  You need to perform threat modeling by using a top-down approach based on the Microsoft Cloud Adoption Framework for Azure.

  What should you use to start the threat modeling process?

  A. the STRIDE model
  B. the DREAD model
  C. OWASP threat modeling
  C. OWASP threat modeling

• Question 313:

  HOTSPOT

  You have a Microsoft 365 E5 subscription

  You plan to implement Microsoft Priva Subject Rights Requests for Microsoft 365 data. You need to streamline the creation and processing of subject rights requests. The solution must minimize development effort.

  What should you include in the solution? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 314:

  Your on-premises network contains an Active Directory Domain Services (AD DS) domain. The domain contains 500 Windows 11 devices.

  You have a Microsoft 365 subscription and an Azure subscription.

  You have a Microsoft Entra tenant that syncs with the domain and is linked to the subscriptions. The devices are Microsoft Entra hybrid joined.

  You plan to deploy a solution to mitigate attacks against privileged accounts. The solution will include Microsoft Sentinel rules that will detect attempts to use fake cached credentials.

  You need to recommend a solution to create the fake cached credentials on client computers.

  What should you recommend?

  A. User and Entity Behavior Analytics (UEBA) in Microsoft Sentinel
  B. a deception rule in Microsoft Defender for Endpoint
  C. a Honeytoken tag in Microsoft Defender for Identity
  D. a user risk policy in Microsoft Entra ID Protection
  B. a deception rule in Microsoft Defender for Endpoint

• Question 315:

  HOTSPOT

  You have a Microsoft Entra tenant named contoso.com. You have 30 Azure subscriptions that are linked to contoso.com.

  The tenant contains the management groups shown in the following table.

  

  You need to design a governance solution to manage access to all the Azure Storage accounts across the subscriptions. The solution must meet the following requirements:

  1. Use custom role-based access control (RBAC) to provide granular access to control plane and data plane operations.

  2. Minimize administrative effort.

  At which scope should you assign the roles, and what is the minimum number of assignments per role? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 316:

  You have an Azure subscription.

  You have a DNS domain named contoso.com that is hosted by a third-party DNS registrar.

  Developers use Azure DevOps to deploy web apps to App Service Environments. When a new app is deployed, a CNAME record for the app is registered in contoso.com.

  You need to recommend a solution to secure the DNS record for each web app. The solution must meet the following requirements:

  1. Ensure that when an app is deleted, the CNAME record for the app is removed also.

  2. Minimize administrative effort.

  What should you include in the recommendation?

  A. Microsoft Defender for Cloud Apps
  B. Microsoft Defender for DevOps
  C. Microsoft Defender for App Service
  D. Microsoft Defender for DNS
  C. Microsoft Defender for App Service

• Question 317:

  Your company has a main office and a branch office.

  1. The main office houses 20 on-premises servers running Windows Server, which host applications published via Microsoft Entra application proxy.

  2. The main office also has 500 on-premises computers running Windows

  11. In contrast, the branch office has 100 on-premises Windows 11 computers.

  3. All computers in the main office are enrolled in Microsoft Intune, while the branch office computers are not.

  4. Your company holds a Microsoft 365 E5 subscription and has a Microsoft Entra tenant.

  5. A third-party Software as a Service (SaaS) application is registered within the Microsoft Entra tenant.

  6. You plan to implement Global Secure Access and are considering the use of compliant network checks and Conditional Access policies.

  You need to determine which two scenarios are supported by compliant network check.

  Which two scenarios are supported by compliant network check?

  A. connections to the third-party SaaS app
  B. connections from the branch office computers
  C. Continuous Access Evaluation for Microsoft Exchange Online
  D. connections to the on-premises apps
  A. connections to the third-party SaaS app
  C. Continuous Access Evaluation for Microsoft Exchange Online

  ---

  Explanation

  Global Secure Access, Enable compliant network check with Conditional Access

  A: Organizations who use Conditional Access along with the Global Secure Access, can prevent malicious access to Microsoft apps, third-party SaaS apps, and private line-of-business (LoB) apps using multiple conditions to provide defense-in-depth. These conditions might include device compliance, location, and more to provide protection against user identity or token theft. Global Secure Access introduces the concept of a compliant network within Microsoft Entra ID Conditional Access. This compliant network check ensures users connect from a verified network connectivity model for their specific tenant and are compliant with security policies enforced by administrators.

  C: Compliant network check data plane enforcement (preview) with Continuous Access Evaluation is supported for SharePoint Online and Exchange Online.

  Compliant network check is currently not supported for Private Access applications.

  References:

  https://learn.microsoft.com/en-us/entra/global-secure-access/reference-current-known-limitations

  https://learn.microsoft.com/en-us/entra/global-secure-access/how-to-compliant-network

  Design security solutions for applications and data

• Question 318:

  HOTSPOT

  You have a Microsoft 365 subscription.

  You configure Microsoft Purview Information Protection to apply sensitivity labels automatically.

  You need to recommend a solution that will prevent users from uploading unlabeled files to Microsoft SharePoint Online if the files contain content defined by Microsoft Purview classifiers as sensitive.

  What should you include in the recommendation? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 319:

  Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem.

  After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.

  You have a Microsoft 365 subscription that uses Microsoft Defender XDR. The subscription contains 500 devices that are enrolled in Microsoft Intune. The subscription contains 500 users that connect to external software as a service (SaaS) apps by using the devices. You need to implement a solution that meets the following requirements:

  Allows user access to SaaS apps that Microsoft has identified as low risk.

  Blocks user access to Saas apps that Microsoft has identified as high risk.

  Solution: From Microsoft Defender for Cloud Apps, you configure SaaS security posture management (SSPM) and create an access policy.

  Does this meet the goal?

  A. Yes
  B. No
  A. Yes

• Question 320:

  Your company has an Azure subscription that has enhanced security enabled for Microsoft Defender for Cloud.

  The company signs a contract with the United States government.

  You need to review the current subscription for NIST 800-53 compliance.

  What should you do first?

  A. From Azure Policy, assign a built-in initiative that has a scope of the subscription.
  B. From Microsoft Sentinel, configure the Microsoft Defender for Cloud data connector.
  C. From Defender for Cloud, review the Azure security baseline for audit report.
  D. From Microsoft Defender for Cloud Apps, create an access policy for cloud applications.
  A. From Azure Policy, assign a built-in initiative that has a scope of the subscription.

  ---

  Explanation

  The Azure Policy Regulatory Compliance built-in initiative definition maps to compliance domains and controls in NIST SP 800-53 Rev. 5.

  The following mappings are to the NIST SP 800-53 Rev. 5 controls. Use the navigation on the right to jump directly to a specific compliance domain. Many of the controls are implemented with an Azure Policy initiative definition. To review the complete initiative definition, open Policy in the Azure portal and select the Definitions page. Then, find and select the NIST SP 800-53 Rev. 5 Regulatory Compliance built-in initiative definition.

  References:

  https://docs.microsoft.com/en-us/azure/governance/policy/samples/gov-nist-sp-800-53-r5