Microsoft SC-100 Online Practice Questions and Exam Preparation

Microsoft SC-100 Online Questions & Answers

• Question 331:

  You have Windows 11 devices and Microsoft 365 E5 licenses.

  You need to recommend a solution to prevent users from accessing websites that contain adult content such as gambling sites.

  What should you include in the recommendation?

  A. Microsoft Intune
  B. Microsoft Purview Compliance Manager
  C. Microsoft Defender for Cloud Apps
  D. Microsoft Defender for Endpoint
  D. Microsoft Defender for Endpoint

  ---

  Explanation

  Web content filtering is part of the Web protection capabilities in Microsoft Defender for Endpoint. It enables your organization to track and regulate access to websites based on their content categories. Many of these websites, while not malicious, might be problematic because of compliance regulations, bandwidth usage, or other concerns.

  Note: Turn on web content filtering From the left-hand navigation in Microsoft 365 Defender portal, select Settings > Endpoints > General > Advanced Features. Scroll down until you see the entry for Web content filtering. Switch the toggle to On and Save preferences.

  Configure web content filtering policies

  Web content filtering policies specify which site categories are blocked on which device groups. To manage the policies, go to Settings > Endpoints > Web content filtering (under Rules).

  References:

  https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/web-content-filtering

• Question 332:

  HOTSPOT

  You have an Azure subscription containing 100 virtual machines, which are accessed using Azure Bastion.

  You need to recommend a solution to ensure that only specific users in specific locations can access the virtual machines. The solution must meet the following requirements:

  1. Restrict access to the virtual machines based on the originating IP address or a connection request using just-in-time (JIT) VM access network-based controls.

  2. Restrict access to the virtual machines based on role-based access control (RBAC) role assignments using JIT VM access authorization controls.

  Which Microsoft cloud services should you include in the recommendation?

  To answer, select the appropriate options in the answer area.

  

  

  ---

  Box 1: Microsoft Defender for Cloud Restrict access to the virtual machines based on an originating IP address or a connection request by using just-in-time (JIT) VM access network-based controls.

  Microsoft Defender for Cloud offers JIT. With JIT, you can lock down the inbound traffic to your VMs, reducing exposure to attacks while providing easy access to connect to VMs when needed.

  Box 2: Microsoft Entra Privileged Identity Management (PIM) Restrict access to the virtual machines based on role-based access control (RBAC) role assignments by using JIT VM access authorization controls.

  Multilayered protection for Azure virtual machine access.

  This solution offers a multilayered strategy for protecting virtual machines (VMs) in Azure. Users need to connect to VMs for management and administrative purposes. It's crucial to maintain accessibility while minimizing the attack surface.

  This solution uses many Azure services and features including:

  *-> Microsoft Entra Privileged Identity Management (PIM). *-> The just-in-time (JIT) VM access feature of Microsoft Defender for Cloud.

  *-> Azure Bastion.

  *-> Azure role-based access control (Azure RBAC) custom roles.

  Microsoft Entra Conditional Access, optionally.

  Azure Key Vault, optionally.

  References:

  https://learn.microsoft.com/en-us/azure/defender-for-cloud/just-in-time-access-overview

  https://learn.microsoft.com/en-us/azure/architecture/solution-ideas/articles/multilayered-protection-azure-vm

• Question 333:

  You have a customer that has a Microsoft 365 subscription and uses the Free edition of Azure Active Directory (Azure AD)

  The customer plans to obtain an Azure subscription and provision several Azure resources.

  You need to evaluate the customer's security environment.

  What will necessitate an upgrade from the Azure AD Free edition to the Premium edition?

  A. Azure AD Privileged Identity Management (PIM)
  B. role-based authorization
  C. resource-based authorization
  D. Azure AD Multi-Factor Authentication
  A. Azure AD Privileged Identity Management (PIM)

• Question 334:

  HOTSPOT

  You have an Azure subscription.

  You plan to deploy a storage account named storage1 that will store confidential data. You will assign tags to the confidential data.

  You need to ensure that access to storage1 can be defined by using the assigned tags.

  Which authorization mechanism should you enable, and which type of resource should you use to store the data? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 335:

  You have a Microsoft 365 E5 subscription. The subscription contains 500 devices that run Windows 11 Pro and are enrolled in Microsoft Intune.

  You need to evaluate the use of Microsoft Defender Vulnerability Management to provide recommended configuration changes for the devices.

  Which Endpoint security settings should you use to review the recommended changes?

  A. Security tasks
  B. Attack surface reduction
  C. End point detection and response
  D. Device compliance
  A. Security tasks

• Question 336:

  Your company has a third-party security information and event management (SIEM) solution that uses Splunk and Microsoft Sentinel.

  You plan to integrate Microsoft Sentinel with Splunk.

  You need to recommend a solution to send security events from Microsoft Sentinel to Splunk.

  What should you include in the recommendation?

  A. a Microsoft Sentinel data connector
  B. Azure Event Hubs
  C. a Microsoft Sentinel workbook
  D. Azure Data Factory
  B. Azure Event Hubs

• Question 337:

  HOTSPOT

  You have a Microsoft 365 E5 subscription.

  You need to recommend a security solution that meets the following requirements:

  1. Automatically identifies and stops external, brute force attacks against accounts in the subscription

  2. Automatically identifies and stops external attacks that use an internal account to exfiltrate data from Microsoft SharePoint Online sites in the subscription.

  What should you include in the recommendation for each requirement? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 338:

  Your network contains an on-premises Active Directory Domain Services (AD DS) domain named Domain1. Domain1 contains 10 domain controllers.

  You have an Azure subscription named Sub1 that contains a Microsoft Sentinel workspace named WS1.

  You have a Microsoft 365 subscription that contains 5,000 users. Each user is assigned a Microsoft 365 E3 license.

  You need to recommend a solution to ingest security logs from all the domain controllers into WS1. The solution must meet the following requirements:

  1. The cost of ingesting data into WS1 must be minimized.

  2. WS1 must ingest all the Windows Security event logs generated by the domain controllers.

  3. The solution must support the generation of approximately 350 MB of logs per day from each domain controller.

  What should you recommend?

  A. Upgrade the user licenses to Microsoft 365 E5.
  B. Onboard each domain controller to Microsoft Defender for Servers Plan 2.
  C. Configure Auxiliary logs in WS1.
  D. Configure a volume cap for WS1.
  E. Only ingest data from one domain controller into WS1.
  A. Upgrade the user licenses to Microsoft 365 E5.

• Question 339:

  A customer has a Microsoft 365 E5 subscription and an Azure subscription.

  The customer wants to centrally manage security incidents, analyze log, audit activity, and hunt for potential threats across all deployed services.

  You need to recommend a solution for the customer. The solution must minimize costs.

  What should you include in the recommendation?

  A. Microsoft Defender XDR
  B. Microsoft Defender for Cloud
  C. Microsoft Defender for Cloud Apps
  D. Microsoft Sentinel
  D. Microsoft Sentinel

  ---

  Explanation

  Microsoft Sentinel is a scalable, cloud-native solution that provides:

  Security information and event management (SIEM)

  Security orchestration, automation, and response (SOAR)

  Microsoft Sentinel delivers intelligent security analytics and threat intelligence across the enterprise. With Microsoft Sentinel, you get a single solution for attack detection, threat visibility, proactive hunting, and threat response.

  Microsoft Sentinel is your bird's-eye view across the enterprise alleviating the stress of increasingly sophisticated attacks, increasing volumes of alerts, and long resolution time frames.

  Collect data at cloud scale across all users, devices, applications, and infrastructure, both on-premises and in multiple clouds.

  Detect previously undetected threats, and minimize false positives using Microsoft's analytics and unparalleled threat intelligence.

  Investigate threats with artificial intelligence, and hunt for suspicious activities at scale, tapping into years of cyber security work at Microsoft.

  Respond to incidents rapidly with built-in orchestration and automation of common tasks.

  Microsoft Sentinel natively incorporates proven Azure services, like Log Analytics and Logic Apps. Microsoft Sentinel enriches your investigation and detection with AI. It provides Microsoft's threat intelligence stream and enables you to bring your own threat intelligence.

  References:

  https://docs.microsoft.com/en-us/azure/sentinel/overview

• Question 340:

  HOTSPOT

  You need to recommend a solution to meet the AWS requirements.

  What should you include in the recommendation? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: Defender for Cloud

  Box 2: Microsoft Sentinel

  Scenario: AWS Requirements

  Fabrikam identifies the following security requirements for the data hosted in ContosoAWS1: Ensure that the security administrators can query AWS service logs directly from the Azure environment.

  Use the Amazon Web Services (AWS) connectors to pull AWS service logs into Microsoft Sentinel.

  Note: These connectors work by granting Microsoft Sentinel access to your AWS resource logs. Setting up the connector establishes a trust relationship between Amazon Web Services and Microsoft Sentinel. This is accomplished on AWS by creating a role that gives permission to Microsoft Sentinel to access your AWS logs.

  References:

  https://docs.microsoft.com/en-us/azure/defender-for-cloud/defender-for-servers-introduction

  https://docs.microsoft.com/en-us/azure/defender-for-cloud/recommendations-reference-aws

  https://docs.microsoft.com/en-us/azure/sentinel/connect-aws