Microsoft Microsoft Certified: Cybersecurity Architect Expert SC-100 Questions & Answers

• Question 41:

  You need to recommend a strategy for routing internet-bound traffic from the landing zones. The solution must meet the landing zone requirements.

  What should you recommend as part of the landing zone deployment?

  A. service chaining

  B. local network gateways

  C. forced tunneling

  D. a VNet-to-VNet connection

  Correct Answer: A

  Service chaining.

  Service chaining enables you to direct traffic from one virtual network to a virtual appliance or gateway in a peered network through user-defined routes.

  You can deploy hub-and-spoke networks, where the hub virtual network hosts infrastructure components such as a network virtual appliance or VPN gateway. All the spoke virtual networks can then peer with the hub virtual network. Traffic

  flows through network virtual appliances or VPN gateways in the hub virtual network.

  Virtual network peering enables the next hop in a user-defined route to be the IP address of a virtual machine in the peered virtual network, or a VPN gateway. You can't route between virtual networks with a user-defined route that specifies

  an Azure ExpressRoute gateway as the next hop type.

  Incorrect:

  Not B: Forced tunneling lets you redirect or "force" all Internet-bound traffic back to your on-premises location via a Site-to-Site VPN tunnel for inspection and auditing. This is a critical security requirement for most enterprise IT policies. If you

  don't configure forced tunneling, Internet-bound traffic from your VMs in Azure always traverses from the Azure network infrastructure directly out to the Internet, without the option to allow you to inspect or audit the traffic. Unauthorized

  Internet access can potentially lead to information disclosure or other types of security breaches.

  ExpressRoute forced tunneling is not configured via this mechanism, but instead, is enabled by advertising a default route via the ExpressRoute BGP peering sessions.

  Note:

  Requirements. Planned Changes

  Litware plans to implement the following changes:

  Design a landing zone strategy to refactor the existing Azure environment of Litware and deploy all future Azure workloads.

  Requirements. Azure Landing Zone Requirements

  Litware identifies the following landing zone requirements:

  1.

  Route all internet-bound traffic from landing zones through Azure Firewall in a dedicated Azure subscription.

  2.

  Provide a secure score scoped to the landing zone.

  3.

  Ensure that the Azure virtual machines in each landing zone communicate with Azure App Service web apps in the same zone over the Microsoft backbone network, rather than over public endpoints.

  4.

  Minimize the possibility of data exfiltration.

  5.

  Maximize network bandwidth.

  The landing zone architecture will include the dedicated subscription, which will serve as the hub for internet and hybrid connectivity. Each landing zone will have the following characteristics:

  1.

  Be created in a dedicated subscription.

  2.

  Use a DNS namespace of litware.com.

  Reference: https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-peering-overview#service-chaining https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-forced-tunneling-rm

• Question 42:

  You are designing a ransomware response plan that follows Microsoft Security Best Practices.

  You need to recommend a solution to limit the scope of damage of ransomware attacks without being locked out.

  What should you include in the recommendation?

  A. device compliance policies

  B. Privileged Access Workstations (PAWs)

  C. Customer Lockbox for Microsoft Azure

  D. emergency access accounts

  Correct Answer: B

  The use of privileged access workstations (PAWs) helps protect privileged users from internet attacks and threat vectors by providing a dedicated machine for sensitive tacks and separating these sensitive tasks and accounts from the daily

  use workstations.

  Customers with good least-privileged access policies such as using Privileged Access Workstations (PAW) devices were able to protect key resources even in the face of initial network access by the attackers.

  Incorrect:

  *

  Customer Lockbox Customer Lockbox ensures that no one at Microsoft can access customer content to perform a service operation without the customer's explicit approval. Customer Lockbox brings the customer into the approval workflow for requests to access their content. Occasionally, Microsoft engineers are involved during the support process to troubleshoot and fix customer-reported issues. In most cases, issues are fixed through extensive telemetry and debugging tools that Microsoft has in place for its services. However, there may be cases that require a Microsoft engineer to access customer content to determine the root cause and fix the issue. Customer Lockbox requires the engineer to request access from the customer as a final step in the approval workflow. This gives organizations the option to approve or deny these requests, which gives them direct control over whether a Microsoft engineer can access the organizations' end-user data.

  *

  emergency access accounts It is important that you prevent being accidentally locked out of your Azure Active Directory (Azure AD) organization because you can't sign in or activate another user's account as an administrator. You can mitigate the impact of accidental lack of administrative access by creating two or more emergency access accounts in your organization.

  Why use an emergency access account

  An organization might need to use an emergency access account in the following situations:

  The user accounts are federated, and federation is currently unavailable because of a cell-network break or an identity-provider outage. For example, if the identity provider host in your environment has gone down, users might be unable to

  sign in when Azure AD redirects to their identity provider.

  The administrators are registered through Azure AD Multi-Factor Authentication, and all their individual devices are unavailable or the service is unavailable. Users might be unable to complete Multi-Factor Authentication to activate a role. For

  example, a cell network outage is preventing them from answering phone calls or receiving text messages, the only two authentication mechanisms that they registered for their device.

  The person with the most recent Global Administrator access has left the organization. Azure AD prevents the last Global Administrator account from being deleted, but it does not prevent the account from being deleted or disabled on-

  premises. Either situation might make the organization unable to recover the account.

  Unforeseen circumstances such as a natural disaster emergency, during which a mobile phone or other networks might be unavailable.

  Reference: https://www.microsoft.com/en-us/security/blog/2021/01/19/using-zero-trust-principles-to-protect-against-sophisticated-attacks-like-solorigate/ https://www.microsoft.com/en-us/securityengineering/osa/practices https://learn.microsoft.com/en-us/azure/active-directory/roles/security-emergency-access

• Question 43:

  You have a Microsoft 365 subscription and an Azure subscription. Microsoft 365 Defender and Microsoft Defender for Cloud are enabled.

  The Azure subscription contains 50 virtual machines. Each virtual machine runs different applications on Windows Server 2019.

  You need to recommend a solution to ensure that only authorized applications can run on the virtual machines. If an unauthorized application attempts to run or be installed, the application must be blocked automatically until an administrator

  authorizes the application.

  Which security control should you recommend?

  A. app registrations in Azure Active Directory (Azure AD)

  B. OAuth app policies in Microsoft Defender for Cloud Apps

  C. Azure Security Benchmark compliance controls in Defender for Cloud

  D. application control policies in Microsoft Defender for Endpoint

  Correct Answer: B

  Microsoft Defender for Cloud Apps OAuth app policies.

  OAuth app policies enable you to investigate which permissions each app requested and which users authorized them for Office 365, Google Workspace, and Salesforce. You're also able to mark these permissions as approved or banned.

  Marking them as banned will revoke permissions for each app for each user who authorized it.

  Incorrect:

  Not D: Windows Defender Application cannot be used for virtual machines.

  Reference: https://docs.microsoft.com/en-us/defender-cloud-apps/app-permission-policy

• Question 44:

  You have a Microsoft 365 subscription that syncs with Active Directory Domain Services (AD DS).

  You need to define the recovery steps for a ransomware attack that encrypted data in the subscription. The solution must follow Microsoft Security Best Practices.

  What is the first step in the recovery plan?

  A. From Microsoft Defender for Endpoint, perform a security scan.

  B. Recover files to a cleaned computer or device.

  C. Contact law enforcement.

  D. Disable Microsoft OneDrive sync and Exchange ActiveSync.

  Correct Answer: D

  The following containment steps can be done concurrently as new threat vectors are discovered.

  Step 1: Assess the scope of the situation

  Which user accounts were compromised?

  Which devices are affected? Which applications are affected? Step 2: Preserve existing systems

  *

  Disable all privileged user accounts except for a small number of accounts used by your admins to assist in resetting the integrity of your AD DS infrastructure. If a user account is believed to be compromised, disable it immediately.

  *

  Isolate compromised systems from the network, but do not shut them off.

  *

  Etc.

  Note:

  With OneDrive, you can sync files between your computer and the cloud, so you can get to your files from anywhere - your computer, your mobile device, and even through the OneDrive website at OneDrive.com.

  ActiveSync is a client protocol that lets users synchronize their Exchange mailbox with a mobile device.

  Reference: https://learn.microsoft.com/en-us/security/compass/incident-response-playbook-dart-ransomware-approach

• Question 45:

  You have an Azure AD tenant that syncs with an Active Directory Domain Services (AD DS) domain.

  You have an on-premises datacenter that contains 100 servers. The servers run Windows Server and are backed up by using Microsoft Azure Backup Server (MABS).

  You are designing a recovery solution for ransomware attacks. The solution follows Microsoft Security Best Practices.

  You need to ensure that a compromised administrator account cannot be used to delete the backups.

  What should you do?

  A. From Azure Backup, configure multi-user authorization by using Resource Guard.

  B. From Microsoft Azure Backup Setup, register MABS with a Recovery Services vault.

  C. From a Recovery Services vault, generate a security PIN for critical operations.

  D. From Azure AD Privileged Identity Management (PIM), create a role assignment for the Backup Contributor role.

  Correct Answer: C

  Security features to help protect hybrid backups that use Azure Backup

  Prevent attacks

  Checks have been added to make sure only valid users can perform various operations. These include adding an extra layer of authentication, and maintaining a minimum retention range for recovery purposes.

  Authentication to perform critical operations

  As part of adding an extra layer of authentication for critical operations, you're prompted to enter a security PIN when you perform Stop Protection with Delete data and Change Passphrase operations.

  To receive this PIN:

  1.

  Sign in to the Azure portal.

  2.

  Browse to Recovery Services vault > Settings > Properties.

  3.

  Under Security PIN, select Generate. This opens a pane that contains the PIN to be entered in the Azure Recovery Services agent user interface. This PIN is valid for only five minutes, and it gets generated automatically after that period. Reference: https://learn.microsoft.com/en-us/azure/backup/backup-azure-security-feature

• Question 46:

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You are designing the encryption standards for data at rest for an Azure resource.

  You need to provide recommendations to ensure that the data at rest is encrypted by using AES-256 keys. The solution must support rotating the encryption keys monthly.

  Solution: For Azure SQL databases, you recommend Transparent Data Encryption (TDE) that uses customer-managed keys (CMKs).

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: A

  We need to use customer-managed keys.

  Transparent data encryption (TDE) helps protect Azure SQL Database, Azure SQL Managed Instance, and Azure Synapse Analytics against the threat of malicious offline activity by encrypting data at rest. It performs real-time encryption and

  decryption of the database, associated backups, and transaction log files at rest without requiring changes to the application.

  In Azure, the default setting for TDE is that the Database Encryption Key (DEK) is protected by a built-in server certificate. The built-in server certificate is unique for each server and the encryption algorithm used is AES 256.

  TDE protector is either a service-managed certificate (service-managed transparent data encryption) or an asymmetric key stored in Azure Key Vault (customer-managed transparent data encryption).

  Note: Automated key rotation in Key Vault allows users to configure Key Vault to automatically generate a new key version at a specified frequency. You can use rotation policy to configure rotation for each individual key. Our

  recommendation is to rotate encryption keys at least every two years to meet cryptographic best practices.

  This feature enables end-to-end zero-touch rotation for encryption at rest for Azure services with customer-managed key (CMK) stored in Azure Key Vault. Please refer to specific Azure service documentation to see if the service covers endto-end rotation.

  Reference: https://docs.microsoft.com/en-us/azure/azure-sql/database/transparent-data-encryption-tde-overview

  https://docs.microsoft.com/en-us/azure/key-vault/keys/how-to-configure-key-rotation

• Question 47:

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You are designing the encryption standards for data at rest for an Azure resource.

  You need to provide recommendations to ensure that the data at rest is encrypted by using AES-256 keys. The solution must support rotating the encryption keys monthly.

  Solution: For blob containers in Azure Storage, you recommend encryption that uses customer-managed keys (CMKs).

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: A

  We need to use customer-managed keys.

  Azure Storage encryption for data at rest.

  Azure Storage uses service-side encryption (SSE) to automatically encrypt your data when it is persisted to the cloud. Azure Storage encryption protects your data and to help you to meet your organizational security and compliance

  commitments.

  Data in Azure Storage is encrypted and decrypted transparently using 256-bit AES encryption.

  Data in a new storage account is encrypted with Microsoft-managed keys by default. You can continue to rely on Microsoft-managed keys for the encryption of your data, or you can manage encryption with your own keys. If you choose to

  manage encryption with your own keys, you have two options. You can use either type of key management, or both:

  *

  You can specify a customer-managed key to use for encrypting and decrypting data in Blob Storage and in Azure Files.

  *

  You can specify a customer-provided key on Blob Storage operations. A client making a read or write request against Blob Storage can include an encryption key on the request for granular control over how blob data is encrypted and decrypted.

  Note: Automated key rotation in Key Vault allows users to configure Key Vault to automatically generate a new key version at a specified frequency. You can use rotation policy to configure rotation for each individual key. Our recommendation is to rotate encryption keys at least every two years to meet cryptographic best practices.

  This feature enables end-to-end zero-touch rotation for encryption at rest for Azure services with customer-managed key (CMK) stored in Azure Key Vault. Please refer to specific Azure service documentation to see if the service covers endto-end rotation.

  Reference: https://docs.microsoft.com/en-us/azure/storage/common/storage-service-encryption https://docs.microsoft.com/en-us/azure/key-vault/keys/how-to-configure-key-rotation

• Question 48:

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You are designing the encryption standards for data at rest for an Azure resource.

  You need to provide recommendations to ensure that the data at rest is encrypted by using AES-256 keys. The solution must support rotating the encryption keys monthly.

  Solution: For Azure SQL databases, you recommend Transparent Data Encryption (TDE) that uses Microsoft-managed keys.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: A

  We need to use customer-managed keys.

  Transparent data encryption (TDE) helps protect Azure SQL Database, Azure SQL Managed Instance, and Azure Synapse Analytics against the threat of malicious offline activity by encrypting data at rest. It performs real-time encryption and

  decryption of the database, associated backups, and transaction log files at rest without requiring changes to the application.

  In Azure, the default setting for TDE is that the Database Encryption Key (DEK) is protected by a built-in server certificate. The built-in server certificate is unique for each server and the encryption algorithm used is AES 256.

  TDE protector is either a service-managed certificate (service-managed transparent data encryption) or an asymmetric key stored in Azure Key Vault (customer- managed transparent data encryption).

  Note: Automated key rotation in Key Vault allows users to configure Key Vault to automatically generate a new key version at a specified frequency. You can use rotation policy to configure rotation for each individual key. Our

  recommendation is to rotate encryption keys at least every two years to meet cryptographic best practices.

  This feature enables end-to-end zero-touch rotation for encryption at rest for Azure services with customer-managed key (CMK) stored in Azure Key Vault. Please refer to specific Azure service documentation to see if the service covers endto-end rotation.

  Reference:

  https://docs.microsoft.com/en-us/azure/azure-sql/database/transparent-data-encryption-tde-overview https://docs.microsoft.com/en-us/azure/key-vault/keys/how-to-configure-key-rotation

• Question 49:

  Your company has an Azure subscription that uses Microsoft Defender for Cloud.

  The company signs a contract with the United States government.

  You need to review the current subscription for NIST 800-53 compliance.

  What should you do first?

  A. From Defender for Cloud, review the Azure security baseline for audit report.

  B. From Microsoft Defender for Cloud Apps, create an access policy for cloud applications.

  C. From Defender for Cloud, enable Defender for Cloud plans.

  D. From Azure Policy, assign a built-in initiative that has a scope of the subscription.

  Correct Answer: D

  The Azure Policy Regulatory Compliance built-in initiative definition maps to compliance domains and controls in NIST SP 800-53 Rev. 5.

  The following mappings are to the NIST SP 800-53 Rev. 5 controls. Use the navigation on the right to jump directly to a specific compliance domain. Many of the controls are implemented with an Azure Policy initiative definition. To review the complete initiative definition, open Policy in the Azure portal and select the Definitions page. Then, find and select the NIST SP 800-53 Rev. 5 Regulatory Compliance built-in initiative definition. Reference: https://docs.microsoft.com/en-us/azure/governance/policy/samples/gov-nist-sp-800-53-r5

• Question 50:

  Your company has an Azure subscription that uses Microsoft Defender for Cloud.

  The company signs a contract with the United States government.

  You need to review the current subscription for NIST 800-53 compliance.

  What should you do first?

  A. From Microsoft Sentinel, configure the Microsoft Defender for Cloud data connector.

  B. From Microsoft Defender for Cloud Apps, create an access policy for cloud applications.

  C. From Defender for Cloud, enable Defender for Cloud plans.

  D. From Defender for Cloud, add a regulatory compliance standard.

  Correct Answer: D

  How are regulatory compliance standards represented in Defender for Cloud?

  Industry standards, regulatory standards, and benchmarks are represented in Defender for Cloud's regulatory compliance dashboard. Each standard is an initiative defined in Azure Policy.

  Reference: https://learn.microsoft.com/en-us/azure/defender-for-cloud/update-regulatory-compliance-packages