Microsoft SC-100 Online Practice Questions and Exam Preparation

Microsoft SC-100 Online Questions & Answers

• Question 321:

  HOTSPOT

  You have three Microsoft Entra tenants named Tenant 1. Tenant2. and Tenant3.

  You have three Azure subscriptions named Sub1, Sub2, and Sub3. Each tenant is associated with multiple Azure subscriptions.

  Each subscription contains a single Microsoft Sentinel workspace as shown in the following table.

  

  You need to recommend a solution that meets the following requirements:

  1. Ensures that the users in Tenant1 can manage the resources in Sub2 and Sub3 without having to switch subscriptions or sign in to a different tenant

  2. Implements multiple workspace view for Sentinel2 and Sentinel3

  What should you use to delegate permissions, and which Microsoft Sentinel feature will users be able to manage in multiple workspace view? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 322:

  You have an Azure subscription that has Microsoft Defender for Cloud enabled.

  Suspicious authentication activity alerts have been appearing in the Workload protections dashboard.

  You need to recommend a solution to evaluate and remediate the alerts by using a workflow automation feature of Microsoft Defender for Cloud.

  What should you include in the recommendation?

  A. Azure Monitor webhooks
  B. Azure Event Hubs
  C. Azure Functions apps
  D. Azure Logic Apps
  D. Azure Logic Apps

  ---

  Explanation

  The workflow automation feature of Microsoft Defender for Cloud feature can trigger Logic Apps on security alerts, recommendations, and changes to regulatory compliance.

  Note: Azure Logic Apps is a cloud-based platform for creating and running automated workflows that integrate your apps, data, services, and systems. With this platform, you can quickly develop highly scalable integration solutions for your enterprise and business-to-business (B2B) scenarios.

  Incorrect:

  Not C: Using Azure Functions apps would require more effort.

  References:

  https://docs.microsoft.com/en-us/azure/defender-for-cloud/workflow-automation

• Question 323:

  DRAG DROP

  You are designing a security operations strategy based on the Zero Trust framework.

  You need to increase the operational efficiency of the Microsoft Security Operations Center (SOC).

  Based on the Zero Trust framework, which three deployment objectives should you prioritize in sequence? To answer move the appropriate objectives from the list of objectives to the answer area and arrange them in the correct order.

  Select and Place:

  

  

  ---

  Step 1: Establish visibility

  Visibility, automation, and orchestration Zero Trust deployment objectives.

  When implementing an end-to-end Zero Trust framework for visibility, automation, and orchestration, we recommend you focus first on these initial deployment objectives:

  I. Establish visibility.

  The first step is to establish visibility by enabling Microsoft Threat Protection (MTP).

  Step 2: Enable automation

  II. Enable automation.

  After these are completed, focus on these additional deployment objectives:

  Step 3: Enable additional protection and detection controls III. Enable additional protection and detection controls.

  Incorrect:

  * Establish ransomware recovery readiness

  * Implement disaster recovery

  References:

  https://learn.microsoft.com/en-us/security/zero-trust/deploy/visibility-automation-orchestration

• Question 324:

  You need to recommend a solution to meet the security requirements for the InfraSec group.

  What should you use to delegate the access?

  A. a subscription
  B. a custom role-based access control (RBAC) role
  C. a resource group
  D. a management group
  B. a custom role-based access control (RBAC) role

  ---

  Explanation

  Scenario: Requirements. Security Requirements include:

  Only members of a group named InfraSec must be allowed to configure network security groups (NSGs) and instances of Azure Firewall, WAF, and Front Door in Sub1.

  If the Azure built-in roles don't meet the specific needs of your organization, you can create your own custom roles. Just like built-in roles, you can assign custom roles to users, groups, and service principals at management group (in preview only), subscription, and resource group scopes.

  Incorrect:

  Not D: Management groups are useful when you have multiple subscriptions. This is not what is addressed in this question.

  Scenario: Fabrikam has a single Azure subscription named Sub1.

  Note: If your organization has many Azure subscriptions, you may need a way to efficiently manage access, policies, and compliance for those subscriptions. Management groups provide a governance scope above subscriptions. You organize subscriptions into management groups the governance conditions you apply cascade by inheritance to all associated subscriptions.

  Management groups give you enterprise-grade management at scale no matter what type of subscriptions you might have. However, all subscriptions within a single management group must trust the same Azure Active Directory (Azure AD) tenant.

  References:

  https://docs.microsoft.com/en-us/azure/role-based-access-control/custom-roles

• Question 325:

  Your company has a Microsoft 365 E5 subscription.

  Users use Microsoft Teams, Exchange Online, SharePoint Online, and OneDrive for sharing and collaborating.

  The company identifies protected health information (PHI) within stored documents and communications.

  What should you recommend using to prevent the PHI from being shared outside the company?

  A. sensitivity label policies
  B. data loss prevention (DLP) policies
  C. insider risk management policies
  D. retention policies
  B. data loss prevention (DLP) policies

  ---

  Explanation

  DLP policies in Microsoft 365 allow you to identify, monitor, and protect sensitive information, such as PHI, within your organization. You can create DLP policies that identify PHI within stored documents and communications and then set rules to prevent the PHI from being shared outside the company. For example, you can create a DLP policy that blocks emails containing PHI from being sent to external recipients, or that prevents documents containing PHI from being shared outside the organization.

  Sensitivity label policies allow you to classify and protect sensitive information, but they do not specifically prevent the information from being shared outside the organization. Insider risk management policies are designed to detect and mitigate risks posed by insider threats, but they are not directly related to preventing the sharing of sensitive information. Retention policies allow you to specify how long certain types of information should be retained, but they do not prevent the sharing of sensitive information.

• Question 326:

  HOTSPOT

  You have an Azure subscription that contains App Service apps in four Azure regions. Users connect to the apps from the internet.

  You plan to block requests to the apps if the requests contain security threats specified in the Core Rule Set (CRS) of the Open Web Application Security Project (OWASP).

  You need to design a solution to block the requests. The solution must meet the following requirements:

  1. Maintain access to the apps in the event of a region outage.

  2. Minimize the number of resources required.

  What should you include in the design? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 327:

  You have an on-premises network with an Active Directory Domain Services (AD DS) domain named corp.contoso.com and an AD DS-integrated application named App1. Your perimeter network contains a server named Server1 running Windows Server. You have a Microsoft Entra tenant named contoso.com that syncs with corp.contoso.com.

  You plan to implement a security solution with the following configurations:

  1. Manage access to App1 using Microsoft Entra Private Access.

  2. Deploy a Microsoft Entra application proxy connector to Server1.

  3. Implement single sign-on (SSO) for App1 using Kerberos constrained delegation.

  For Server1, you plan to configure the following rules in Windows Defender Firewall with Advanced Security:

  1. Rule1: Allow TCP 443 inbound from a designated set of Azure URLs.

  2. Rule2: Allow TCP 443 outbound to a designated set of Azure URLs.

  3. Rule3: Allow TCP 80 outbound to a designated set of Azure URLs.

  4. Rule4: Allow TCP 389 outbound to the domain controllers on corp.contoso.com.

  You need to maximize security for the planned implementation while minimizing the impact on the connector.

  Which rule should you remove?

  A. Rule1
  B. Rule2
  C. Rule3
  D. Rule4
  C. Rule3

  ---

  Explanation

  allows TCP 80 outbound traffic to a designated set of Azure URLs. TCP 80 is associated with Rule3 unencrypted HTTP traffic, which poses a security risk because it does not encrypt data, potentially exposing sensitive information in transit.

  By removing this rule, you can ensure that all communication between Server1 and Azure is encrypted, which aligns with security best practices for minimizing data exposure. Additionally, this change will not impact the functioning of the application proxy connector, as secure HTTPS (TCP 443) connections are still allowed for necessary communications.

• Question 328:

  Your company is preparing for cloud adoption.

  You are designing security for Azure landing zones.

  Which two solutions should you include in the design to ensure that preventative controls are implemented to increase the secure score? Each correct answer presents a complete solution.

  NOTE: Each correct selection is worth one point.

  A. Azure Web Application Firewall (WAF)
  B. Azure AD Privileged Identity Management (PIM)
  C. Microsoft Sentinel
  D. Azure Firewall
  E. Microsoft Defender for Cloud alerts
  B. Azure AD Privileged Identity Management (PIM)
  C. Microsoft Sentinel

  ---

  Explanation

  B: Azure identity and access for landing zones, Privileged Identity Management (PIM)

  Use Azure AD Privileged Identity Management (PIM) to establish zero-trust and least privilege access. Map your organization's roles to the minimum access levels needed. Azure AD PIM can use Azure native tools, extend current tools and processes, or use both current and native tools as needed.

  Azure identity and access for landing zones, Design recommendations include:

  * (B) Use Azure AD managed identities for Azure resources to avoid credential-based authentication. Many security breaches of public cloud resources originate with credential theft embedded in code or other text. Enforcing managed identities for programmatic access greatly reduces the risk of credential theft.

  * Etc.

  C: Improve landing zone security, onboard Microsoft Sentinel

  You can enable Microsoft Sentinel, and then set up data connectors to monitor and protect your environment. After you connect your data sources using data connectors, you choose from a gallery of expertly created workbooks that surface insights based on your data. These workbooks can be easily customized to your needs.

  Note: Landing zone security best practices

  The following list of reference architectures and best practices provides examples of ways to improve landing zone security:

  Microsoft Defender for Cloud: Onboard a subscription to Defender for Cloud.

  Microsoft Sentinel: Onboard to Microsoft Sentinel to provide a security information event management (SIEM) and security orchestration automated response (SOAR) solution.

  Secure network architecture: Reference architecture for implementing a perimeter network and secure network architecture.

  Identity management and access control: Series of best practices for implementing identity and access to secure a landing zone in Azure.

  Network security practices: Provides additional best practices for securing the network.

  Operational security provides best practices for increasing operational security in Azure.

  The Security Baseline discipline: Example of developing a governance-driven security baseline to enforce security requirements.

  Incorrect:

  Not E: Implementing alerts is not a preventive measure.

  References:

  https://docs.microsoft.com/en-us/azure/cloud-adoption-framework/ready/landing-zone/design-area/identity-access-landing-zones

  https://docs.microsoft.com/en-us/azure/sentinel/quickstart-onboard

• Question 329:

  HOTSPOT

  You need to recommend a SIEM and SOAR strategy that meets the hybrid requirements, the Microsoft Sentinel requirements, and the regulatory compliance requirements.

  What should you recommend? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: Azure tenant

  Microsoft Sentinel multiple workspace architecture

  There are cases where a single SOC (Security Operations Center) needs to centrally manage and monitor multiple Microsoft Sentinel workspaces, potentially across Azure Active Directory (Azure AD) tenants.

  An MSSP Microsoft Sentinel Service.

  A global SOC serving multiple subsidiaries, each having its own local SOC.

  A SOC monitoring multiple Azure AD tenants within an organization.

  To address these cases, Microsoft Sentinel offers multiple-workspace capabilities that enable central monitoring, configuration, and management, providing a single pane of glass across everything covered by the SOC. This diagram shows an example architecture for such use cases.

  

  This model offers significant advantages over a fully centralized model in which all data is copied to a single workspace.

  Scenario:

  Requirements. Microsoft Sentinel Requirements

  Litware plans to leverage the security information and event management (SIEM) and security orchestration automated response (SOAR) capabilities of Microsoft Sentinel. The company wants to centralize Security Operations Center (SOC) by using Microsoft Sentinel.

  Hybrid Requirements

  Litware identifies the following hybrid cloud requirements: Provide centralized, cross-tenant subscription management without the overhead of maintaining guest accounts.

  Box 2: Azure Lighthouse subscription onboarding process

  You can use Azure Lighthouse to extend all cross-workspace activities across tenant boundaries, allowing users in your managing tenant to work on Microsoft Sentinel workspaces across all tenants.

  Azure Lighthouse enables you to see and manage Azure resources from different tenancies, in the one place, with the power of delegated administration. That tenancy may be a customer (for example, if you're a managed services provider with a support contract arrangement in place), or a separate Azure environment for legal or financial reasons (like franchisee groups or Enterprises with large brand groups).

  Incorrect:

  * not Azure AD B2B

  Azure AD B2B uses guest account, which goes against the requirements in this scenario, Note: Azure Active Directory (Azure AD) B2B collaboration is a feature within External Identities that lets you invite guest users to collaborate with your organization.

  References:

  https://docs.microsoft.com/en-us/azure/sentinel/extend-sentinel-across-workspaces-tenants

  https://docs.microsoft.com/en-us/azure/sentinel/best-practices-workspace-architecture

  https://techcommunity.microsoft.com/t5/itops-talk-blog/onboarding-to-azure-lighthouse-using-a-template/ba-p/1091786

  https://docs.microsoft.com/en-us/azure/active-directory/external-identities/what-is-b2b

• Question 330:

  You manage 10 Azure subscriptions, which collectively contain 100 role-based access control (RBAC) role assignments.

  You are planning to consolidate these role assignments.

  Your task is to recommend a solution to identify which role assignments have not been used in the last 90 days, with the goal of minimizing administrative effort.

  What solution should be included in your recommendation?

  A. Microsoft Defender for Cloud
  B. Microsoft Entra access reviews
  C. Microsoft Entra Privileged Identity Management (PIM)
  D. Microsoft Entra Permissions Management
  D. Microsoft Entra Permissions Management

  ---

  Explanation

  Microsoft Entra Permissions Management is designed to manage and monitor permissions across multiple cloud environments, including Azure. It provides insights into permissions, allowing you to identify unused role assignments over a specified period, like the last 90 days. This solution helps you track permissions, detect unused roles, and optimize role assignments across subscriptions, minimizing administrative effort by offering automated recommendations for role consolidation.