Microsoft SC-100 Online Practice Questions and Exam Preparation

Microsoft SC-100 Online Questions & Answers

• Question 31:

  You have an Azure subscription and a Microsoft 365 subscription.

  Your company uses several software as a service (SaaS) applications.

  To align with Microsoft cloud security benchmark (MCSB) and Microsoft Cybersecurity Reference Architectures (MCRA), you plan to design a solution to provide visibility into user activity across the applications and detect potentially risky behavior in real time.

  Which service should you recommend?

  A. Microsoft Purview Information Protection
  B. Microsoft Defender for Cloud Apps
  C. Microsoft Defender for Endpoint
  D. Microsoft Sentinel
  B. Microsoft Defender for Cloud Apps

• Question 32:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You are designing a security strategy for providing access to Azure App Service web apps through an Azure Front Door instance.

  You need to recommend a solution to ensure that the web apps only allow access through the Front Door instance.

  Solution: You recommend access restrictions based on HTTP headers that have the Front Door ID.

  Does this meet the goal?

  A. Yes
  B. No
  A. Yes

  ---

  Explanation

  Restrict access to a specific Azure Front Door instance.

  Traffic from Azure Front Door to your application originates from a well-known set of IP ranges defined in the AzureFrontDoor.Backend service tag. Using a service tag restriction rule, you can restrict traffic to only originate from Azure Front Door. To ensure traffic only originates from your specific instance, you will need to further filter the incoming requests based on the unique http header that Azure Front Door sends.

  

  References:

  https://docs.microsoft.com/en-us/azure/app-service/app-service-ip-restrictions#managing-access-restriction-rules

• Question 33:

  HOTSPOT

  You have a Microsoft 365 subscription that contains a Microsoft SharePoint Online site named Site1. Site1 stores documents that are based on a predefined form and include confidential employee information.

  You monitor access to Site1 by using a Microsoft Defender for Cloud Apps session policy.

  You need to ensure that step-up authentication is triggered when a user downloads documents that are based on the predefined form. The solution must minimize administrative effort.

  Which Microsoft Data Classification Service inspection method should you use, and which Conditional Access option should you add to the session policy? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 34:

  You have a Microsoft 365 subscription and an Azure subscription. Microsoft 365 Defender and Microsoft Defender for Cloud are enabled.

  The Azure subscription contains 50 virtual machines. Each virtual machine runs different applications on Windows Server 2019.

  You need to recommend a solution to ensure that only authorized applications can run on the virtual machines. If an unauthorized application attempts to run or be installed, the application must be blocked automatically until an administrator authorizes the application.

  Which security control should you recommend?

  A. OAuth app policies in Microsoft Defender for Cloud Apps
  B. Azure Security Benchmark compliance controls in Defender for Cloud
  C. application control policies in Microsoft Defender for Endpoint
  D. app discovery anomaly detection policies in Microsoft Defender for Cloud Apps
  C. application control policies in Microsoft Defender for Endpoint

  ---

  Explanation

  Windows Defender Application Control is designed to protect devices against malware and other untrusted software. It prevents malicious code from running by ensuring that only approved code, that you know, can be run.

  Application Control is a software-based security layer that enforces an explicit list of software that is allowed to run on a PC.

  Incorrect:

  Not A: Microsoft Defender for Cloud Apps OAuth app policies.

  OAuth app policies enable you to investigate which permissions each app requested and which users authorized them for Office 365, Google Workspace, and Salesforce. You're also able to mark these permissions as approved or banned.

  Marking them as banned will revoke permissions for each app for each user who authorized it.

  Note: In addition to the existing investigation of OAuth apps connected to your environment, you can set permission policies so that you get automated notifications when an OAuth app meets certain criteria. For example, you can automatically be alerted when there are apps that require a high permission level and were authorized by more than 50 users.

  References:

  https://learn.microsoft.com/en-us/mem/configmgr/protect/deploy-use/use-device-guard-with-configuration-manager

  https://docs.microsoft.com/en-us/defender-cloud-apps/app-permission-policy

• Question 35:

  You have an Azure subscription. The subscription contains 100 virtual machines that run Windows Server. The virtual machines are managed by using Azure Policy and Microsoft Defender for Servers.

  You need to enhance security on the virtual machines. The solution must meet the following requirements:

  1. Ensure that only apps on an allowlist can be run.

  2. Require administrators to confirm each app added to the allowlist.

  3. Automatically add unauthorized apps to a blocklist when an attempt is made to launch the app.

  4. Require administrators to approve an app before the app can be moved from the blocklist to the allowlist.

  What should you include in the solution?

  A. a compute policy in Azure Policy
  B. admin consent settings for enterprise applications in Azure AD
  C. adaptive application controls in Defender for Servers
  D. app governance in Microsoft Defender for Cloud Apps
  C. adaptive application controls in Defender for Servers

• Question 36:

  DRAG DROP

  Your company has Microsoft 365 E5 licenses and Azure subscriptions.

  The company plans to automatically label sensitive data stored in the following locations:

  1. Microsoft SharePoint Online

  2. Microsoft Exchange Online

  3. Microsoft Teams

  You need to recommend a strategy to identify and protect sensitive data.

  Which scope should you recommend for the sensitivity label policies? To answer, drag the appropriate scopes to the correct locations. Each scope may only be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

  NOTE: Each correct selection is worth one point.

  Select and Place:

  

  

  ---

  Box 1: Groups and sites

  Box 2: Groups and sites

  Box 3: Files and emails

  https://docs.microsoft.com/en-us/microsoft-365/compliance/sensitivity-labels?view=o365-worldwide

  Go to label scopes

• Question 37:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  Your on-premises network contains an e-commerce web app that was developed in Angular and Node,js. The web app uses a MongoDB database. You plan to migrate the web app to Azure. The solution architecture team proposes the following architecture as an Azure landing zone.

  

  You need to provide recommendations to secure the connection between the web app and the database. The solution must follow the Zero Trust model.

  Solution: You recommend implementing Azure Application Gateway with Azure Web Application Firewall (WAF).

  Does this meet the goal?

  A. Yes
  B. No
  B. No

  ---

  Explanation

  Instead use solution: You recommend creating private endpoints for the web app and the database layer.

  Note:

  How to Use Azure Private Endpoints to Restrict Public Access to WebApps.

  As an Azure administrator or architect, you are sometimes asked the question: "How can we safely deploy internal business applications to Azure App Services?"

  These applications characteristically are:

  Not accessible from the public internet.

  Accessible from within the on-premises corporate network Accessible via an authorized VPN client from outside the corporate network.

  For such scenarios, we can use Azure Private Links, which enables private and secure access to Azure PaaS services over Azure Private Endpoints, along with the Site-to-Site VPN, Point-to-Site VPN, or the Express Route. Azure Private Endpoint is a read-only network interface service associated with the Azure PAAS Services. It allows you to bring deployed sites into your virtual network, limiting access to them at the network level.

  It uses one of the private IP addresses from your Azure VNet and associates it with the Azure App Services. These services are called Private Link resources. They can be Azure Storage, Azure Cosmos DB, SQL, App Services Web App, your own / partner owned services, Azure Backups, Event Grids, Azure Service Bus, or Azure Automations.

  References:

  https://www.varonis.com/blog/securing-access-azure-webapps

• Question 38:

  HOTSPOT

  Your company has a Microsoft 365 E5 subscription, an Azure subscription, on-premises applications, and Active Directory Domain Services (AD DS).

  You need to recommend an identity security strategy that meets the following requirements:

  1. Ensures that customers can use their Facebook credentials to authenticate to an Azure App Service website

  2. Ensures that partner companies can access Microsoft SharePoint Online sites for the project to which they are assigned

  The solution must minimize the need to deploy additional infrastructure components.

  What should you include in the recommendation? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: Azure AD B2C authentication

  Ensures that customers can use their Facebook credentials to authenticate to an Azure App Service website.

  You can set up sign-up and sign-in with a Facebook account using Azure Active Directory B2C.

  Box 2: Azure AD B2B authentication with access package assignments Govern access for external users in Azure AD entitlement management Azure AD entitlement management uses Azure AD business-to-business (B2B) to share access so you can collaborate with people outside your organization. With Azure AD B2B, external users authenticate to their home directory, but have a representation in your directory. The representation in your directory enables the user to be assigned access to your resources.

  Incorrect:

  Not: Password hash synchronization in Azure AD connect

  The partners are not integrated with AD DS.

  References:

  https://docs.microsoft.com/en-us/azure/active-directory-b2c/identity-provider-facebook?pivots=b2c-user-flow

  https://docs.microsoft.com/en-us/azure/active-directory/governance/entitlement-management-external-users

  https://docs.microsoft.com/en-us/microsoft-365/enterprise/microsoft-365-integration

• Question 39:

  You have a customer that has a Microsoft 365 subscription and an Azure subscription.

  The customer has devices that run either Windows, iOS, Android, or macOS. The Windows devices are deployed on-premises and in Azure.

  You need to design a security solution to assess whether all the devices meet the customer's compliance rules.

  What should you include in the solution?

  A. Microsoft Sentinel
  B. Microsoft Purview Information Protection
  C. Microsoft Intune
  D. Microsoft Defender for Endpoint
  C. Microsoft Intune

• Question 40:

  Your company has an on-premises network and an Azure subscription.

  The company does NOT have a Site-to-Site VPN or an ExpressRoute connection to Azure.

  You are designing the security standards for Azure App Service web apps. The web apps will access Microsoft SQL Server databases on the network.

  You need to recommend security standards that will allow the web apps to access the databases. The solution must minimize the number of open internet-accessible endpoints to the on-premises network.

  What should you include in the recommendation?

  A. a private endpoint
  B. hybrid connections
  C. virtual network NAT gateway integration
  D. virtual network integration
  B. hybrid connections

  ---

  Explanation

  Hybrid Connections can connect Azure App Service Web Apps to on-premises resources that use a static TCP port. Supported resources include Microsoft SQL Server, MySQL, HTTP Web APIs, Mobile Services, and most custom Web Services.

  Note: You can use an Azure App Service Hybrid Connections. To do this, you need to add and create Hybrid Connections in your app. You will download and install an agent (the Hybrid Connection Manager) in the database server or another server which is in the same network as the on-premise database.

  You configure a logical connection on your app service or web app.

  A small agent, the Hybrid Connection Manager, is downloaded and installed on a Windows Server (2012 or later) running in the remote network (on-premises or anywhere) that you need to communicate with.

  You log into your Azure subscription in the Hybrid Connection manager and select the logical connection in your app service.

  The Hybrid Connection Manager will initiate a secure tunnel out (TCP 80/443) to your app service in Azure.

  Your app service can now communicate with TCP-based services, on Windows or Linux, in the remote network via the Hybrid Connection Manager.

  You could get more details on how to Connect Azure Web Apps To On-Premises.

  Incorrect:

  Not A: NAT gateway provides outbound internet connectivity for one or more subnets of a virtual network. Once NAT gateway is associated to a subnet, NAT provides source network address translation (SNAT) for that subnet. NAT gateway specifies which static IP addresses virtual machines use when creating outbound flows.

  However, we need an inbound connection.

  Not C: You can Azure web app service VNet integration with Azure VPN gateway to securely access the resource in an Azure VNet or on-premise network.

  Note: Virtual network integration gives your app access to resources in your virtual network, but it doesn't grant inbound private access to your app from the virtual network. Private site access refers to making an app accessible only from a private network, such as from within an Azure virtual network. Virtual network integration is used only to make outbound calls from your app into your virtual network. The virtual network integration feature behaves differently when it's used with virtual networks in the same region and with virtual networks in other regions. The virtual network integration feature has two variations:

  Regional virtual network integration: When you connect to virtual networks in the same region, you must have a dedicated subnet in the virtual network you're integrating with. Gateway-required virtual network integration: When you connect directly to virtual networks in other regions or to a classic virtual network in the same region, you need an Azure Virtual Network gateway created in the target virtual network.

  References:

  https://github.com/uglide/azure-content/blob/master/articles/app-service-web/web-sites-hybrid-connection-connect-on-premises-sql-server.md

  https://docs.microsoft.com/en-us/answers/questions/701793/connecting-to-azure-app-to-onprem-datbase.html