Microsoft SC-100 Online Practice Questions and Exam Preparation

Microsoft SC-100 Online Questions & Answers

• Question 41:

  HOTSPOT

  You have an Azure subscription.

  You have a Microsoft 365 subscription.

  You need to assess regulatory compliance of the subscriptions.

  The solution must meet the following requirements:

  1. Identify whether data stored in Azure and Microsoft 365 complies with General Data Protection Regulation (GDPR) regulations.

  2. Identify whether Azure resources comply with National Institute of Standards and Technology (NIST) standards.

  3. Provide recommendations on controls to improve compliance.

  What should you use? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 42:

  You are planning the security requirements for Azure Cosmos DB Core (SQL) API accounts.

  You need to recommend a solution to audit all users that access the data in the Azure Cosmos DB accounts.

  Which two configurations should you include in the recommendation? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. Send the Azure Active Directory (Azure AD) sign-in logs to a Log Analytics workspace.
  B. Enable Microsoft Defender for Identity.
  C. Send the Azure Cosmos DB logs to a Log Analytics workspace.
  D. Disable local authentication for Azure Cosmos DB.
  E. Enable Microsoft Defender for Cosmos DB.
  A. Send the Azure Active Directory (Azure AD) sign-in logs to a Log Analytics workspace.
  D. Disable local authentication for Azure Cosmos DB.

  ---

  Explanation

  A:

  LT-2: Enable threat detection for Azure identity and access management

  Guidance: Azure Active Directory (Azure AD) provides the following user logs, which can be viewed in Azure AD reporting or integrated with Azure Monitor, Microsoft Sentinel, or other SIEM/monitoring tools for more sophisticated monitoring and analytics use cases:

  Sign-ins - The sign-ins report provides information about the usage of managed applications and user sign-in activities.

  Audit logs - Provides traceability through logs for all changes done by various features within Azure AD. Examples of audit logs include changes made to any resources within Azure AD, like adding or removing users, apps, groups, roles, and policies.

  D: Disable local authentication methods so that your Cosmos DB database accounts exclusively require Azure Active Directory identities for authentication.

  Enforcing RBAC as the only authentication method

  In situations where you want to force clients to connect to Azure Cosmos DB through RBAC exclusively, you have the option to disable the account's primary/secondary keys. When doing so, any incoming request using either a primary/ secondary key or a resource token will be actively rejected.

  Incorrect:

  Not C: We use the Azure Active Directory (Azure AD) sign-in logs, not the Azure Cosmos db logs.

  Not E: Microsoft Defender for Cosmos DB, though useful from a security perspective, does not help with auditing the users.

  Note: Logging and Threat Detection, LT-1: Enable threat detection for Azure resources

  Guidance: Use the Microsoft Defender for Cloud built-in threat detection capability and enable Microsoft Defender for your Cosmos DB resources. Microsoft Defender for Cosmos DB provides an additional layer of security intelligence that detects unusual and potentially harmful attempts to access or exploit your Cosmos DB resources.

  References:

  https://docs.microsoft.com/en-us/security/benchmark/azure/baselines/cosmos-db-security-baseline

  https://docs.microsoft.com/en-us/azure/cosmos-db/policy-reference

  https://docs.microsoft.com/en-us/azure/cosmos-db/how-to-setup-rbac#disable-local-auth

• Question 43:

  Your company has an on-premises network, an Azure subscription, and a Microsoft 365 E5 subscription.

  The company uses the following devices:

  1. Computers that run either Windows 10 or Windows 11

  2. Tablets and phones that run either Android or iOS

  You need to recommend a solution to classify and encrypt sensitive Microsoft Office 365 data regardless of where the data is stored.

  What should you include in the recommendation?

  A. eDiscovery
  B. Microsoft Information Protection
  C. Compliance Manager
  D. retention policies
  B. Microsoft Information Protection

  ---

  Explanation

  Protect your sensitive data with Microsoft Purview.

  Implement capabilities from Microsoft Purview Information Protection (formerly Microsoft Information Protection) to help you discover, classify, and protect sensitive information wherever it lives or travels.

  Note: You can use

  Microsoft Information Protection: Microsoft Purview for Auditing and Analytics in Outlook for iOS, Android, and Mac (DoD).

  Incorrect:

  Not A: Electronic discovery, or eDiscovery, is the process of identifying and delivering electronic information that can be used as evidence in legal cases. You can use eDiscovery tools in Microsoft Purview to search for content in Exchange Online, OneDrive for Business, SharePoint Online, Microsoft Teams, Microsoft 365 Groups, and Yammer teams. You can search mailboxes and sites in the same eDiscovery search, and then export the search results. You can use Microsoft Purview eDiscovery (Standard) cases to identify, hold, and export content found in mailboxes and sites. If your organization has an Office 365 E5 or Microsoft 365 E5 subscription (or related E5 add-on subscriptions), you can further manage custodians and analyze content by using the feature-rich Microsoft Purview eDiscovery (Premium) solution in Microsoft 365.

  Not C: What does compliance Manager do?

  Compliance managers ensure that a business, its employees and its projects comply with all relevant regulations and specifications. This could include health and safety, environmental, legal or quality standards, as well as any ethical policies the company may have.

  Not D: A retention policy (also called a 'schedule') is a key part of the lifecycle of a record. It describes how long a business needs to keep a piece of information (record), where it's stored and how to dispose of the record when its time.

  References:

  https://docs.microsoft.com/en-us/microsoft-365/compliance/information-protection

  https://docs.microsoft.com/en-us/microsoft-365/compliance/ediscovery?view=o365-worldwide

• Question 44:

  HOTSPOT

  You use Azure Policy with Azure Repos to implement continuous integration and continuous deployment (CI/CD) workflows.

  You need to recommend best practices to secure the stages of the CI/CD workflows based on the Microsoft Cloud Adoption Framework for Azure.

  What should you include in the recommendation for each stage? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: Protected branches

  Git workflow

  The pull request workflow is designed to introduce healthy friction, which is why it should only be applied to secure specific Git branches. Especially the branches that will trigger automated workflows that can deploy, configure, or in any other way affect your cloud resources. These branches are called protected branches.

  Restrict access to protected branches

  The pull request workflow is used together with restricted access controls. The pull request workflow can't be enforced however, unless the server is configured to reject direct changes to protected branches.

  A developer can't push directly to the production branch, but instead must create a pull request that targets the protected branch. Each SCM vendor has a different flavor for achieving restricted access to protected branches. For example, with GitHub this feature is only available for organizations using GitHub team or GitHub Enterprise cloud.

  Box 2: Azure Key Vault

  Secure your deployment credentials

  Pipelines and code repositories should not include hard-coded credentials and secrets. Credentials and secrets should be stored elsewhere and use CI vendor features for security. Because pipelines run as headless agents, they should never use an individual's password.

  Azure Key Vault

  If your CI platform supports it, consider storing credentials in a dedicated secret store, for example Azure Key Vault. Credentials are fetched at runtime by the build agent and your attack surface is reduced.

  References:

  https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/secure/best-practices/secure-devops

• Question 45:

  A customer uses Azure to develop a mobile app that will be consumed by external users as shown in the following exhibit.

  

  You need to design an identity strategy for the app. The solution must meet the following requirements:

  1. Enable the usage of external IDs such as Google, Facebook, and Microsoft accounts.

  2. Be managed separately from the identity store of the customer.

  3. Support fully customizable branding for each app.

  Which service should you recommend to complete the design?

  A. Azure Active Directory (Azure AD) B2B
  B. Azure Active Directory Domain Services (Azure AD DS)
  C. Azure Active Directory (Azure AD) B2C
  D. Azure AD Connect
  C. Azure Active Directory (Azure AD) B2C

  ---

  Explanation

  Azure Active Directory B2C (Azure AD B2C), an identity store, is an identity management service that enables custom control of how your customers sign up, sign in, and manage their profiles when using your iOS, Android, .NET, single-page (SPA), and other applications.

  You can set up sign-up and sign-in with a Facebook/Google account using Azure Active Directory B2C.

  Branding

  Branding and customizing the user interface that Azure Active Directory B2C (Azure AD B2C) displays to your customers helps provide a seamless user experience in your application. These experiences include signing up, signing in, profile editing, and password resetting. This article introduces the methods of user interface (UI) customization.

  Incorrect:

  Not D: Azure AD Connect is a tool for connecting on-premises identity infrastructure to Microsoft Azure AD.

  References:

  https://docs.microsoft.com/en-us/azure/active-directory-b2c/

  https://docs.microsoft.com/en-us/azure/active-directory-b2c/identity-provider-facebook?pivots=b2c-user-flow

  https://docs.microsoft.com/en-us/azure/active-directory-b2c/customize-ui-with-html?pivots=b2c-user-flow

• Question 46:

  Your company has on-premises Microsoft SQL Server databases.

  The company plans to move the databases to Azure.

  You need to recommend a secure architecture for the databases that will minimize operational requirements for patching and protect sensitive data by using dynamic data masking. The solution must minimize costs.

  What should you include in the recommendation?

  A. Azure SQL Managed Instance
  B. Azure Synapse Analytics dedicated SQL pools
  C. Azure SQL Database
  D. SQL Server on Azure Virtual Machines
  C. Azure SQL Database

  ---

  Explanation

  Azure SQL Database is a general-purpose relational database, provided as a managed service. Categorized as a platform as a service (PaaS), Azure SQL Databases are built on standardized hardware and software that is owned, hosted, and maintained by Microsoft. When using Azure SQL Database, you pay-as-you-go, with the option to scale up or out with no service interruption.

  Within Azure SQL Database, you have the option to deploy a managed instance. Azure SQL Database Managed Instance is a collection of system and user databases with a shared set of resources. In addition to all the PaaS benefits of Azure SQL Database, this option provides a native virtual network (VNet) and near 100 percent compatibility with on-premises SQL Server. Azure SQL Database Managed Instance provides you with full SQL Server access and feature compatibility for migrating SQL Servers to Azure.

  Recommendation: Choose Azure SQL Database for your modern cloud applications, or when you have time constraints in development and marketing.

• Question 47:

  HOTSPOT

  You have an Azure DevOps organization that is used to manage the development and deployment of internal apps to multiple Azure subscriptions.

  You are developing a DevSecOps strategy.

  You need to apply DevSecOps controls for the secure code stage and the secure operations stage.

  The solution must be based on Microsoft Cloud Adoption Framework for Azure principles.

  What should you apply for each stage? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 48:

  You are designing a new Azure environment based on the security best practices of the Microsoft Cloud Adoption Framework for Azure. The environment will contain one subscription for shared infrastructure components and three separate subscriptions for applications.

  You need to recommend a deployment solution that includes network security groups (NSGs), Azure Firewall, Azure Key Vault, and Azure Bastion. The solution must minimize deployment effort and follow security best practices of the Microsoft Cloud Adoption Framework for Azure.

  What should you include in the recommendation?

  A. the Azure landing zone accelerator
  B. the Azure Well-Architected Framework
  C. Azure Security Benchmark v3
  D. Azure Advisor
  A. the Azure landing zone accelerator

  ---

  Explanation

  About Azure Bastion host and jumpboxes

  The most simple solution is to host a jumpbox on the virtual network of the data management landing zone or data landing zone to connect to the data services through private endpoints.

  Azure Bastion provides a few other core security benefits, including:

  * The service integrates with native security appliances for an Azure virtual network, such as Azure Firewall.

  Note:

  * Platform landing zones: Subscriptions deployed to provide centralized services, often operated by a central team, or a number of central teams split by function (e.g. networking, identity), which will be used by various workloads and applications. Platform landing zones represent key services that often benefit from being consolidated for efficiency and ease of operations. Examples include networking, identity, and management services.

  * The Azure App Service landing zone accelerator is an open-source collection of architectural guidance and reference implementation to accelerate deployment of Azure App Service at scale. It can provide a specific architectural approach and reference implementation via infrastructure as code templates to prepare your landing zones. The landing zones adhere to the architecture and best practices of the Cloud Adoption Framework.

  Incorrect:

  Not B: The Azure Well-Architected Framework is a set of guiding tenets that can be used to improve the quality of a workload. The framework consists of five pillars of architectural excellence:

  Reliability

  Security

  Cost Optimization

  Operational Excellence

  Performance Efficiency

  Not C: The Azure Security Benchmark (ASB) provides prescriptive best practices and recommendations to help improve the security of workloads, data, and services on Azure. This benchmark is part of a set of holistic security guidance that also includes:

  * Cloud Adoption Framework: Guidance on security, including strategy, roles and responsibilities, Azure Top 10 Security Best Practices, and reference implementation.

  *

  Azure Well-Architected Framework: Guidance on securing your workloads on Azure.

  *

  Microsoft Security Best Practices: Recommendations with examples on Azure.

  Microsoft Cybersecurity Reference Architectures (MCRA): Visual diagrams and guidance for security components and relationships

  * The Azure Security Benchmark focuses on cloud-centric control areas. These controls are consistent with well-known security benchmarks, such as those described by the Center for Internet Security (CIS) Controls, National Institute of Standards and Technology (NIST), and Payment Card Industry Data Security Standard (PCI-DSS).

  References:

  https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/scenarios/cloud-scale-analytics/architectures/connect-to-environments-privately

  https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ready/landing-zone/

  https://learn.microsoft.com/en-us/security/benchmark/azure/overview-v3

  https://learn.microsoft.com/en-us/azure/architecture/framework/

• Question 49:

  HOTSPOT

  You have an Azure subscription that contains a virtual network named VNet1. VNet1 includes a 10-node virtual machine scale set hosting a web search app named App1. Customers access App1 from the internet, and the nodes establish outbound HTTP and HTTPS connections to the internet.

  You need to recommend a network security solution for App1 that meets the following requirements:

  1. Inbound connections to App1 that contain security threats specified in the Core Rule Set (CRS) from the Open Web Application Security Project (OWASP) must be blocked.

  2. Outbound HTTP and HTTPS connections from the virtual machine scale set that contain security threats identified by the Microsoft Defender Threat Intelligence (Defender TI) feed must be blocked.

  What should you include in the recommendation?

  To answer, select the options in the answer area. Each correct answer is worth one point.

  

  

  ---

  Box 1: Azure Web Application Firewall (WAF)

  Inbound connections to App1 that contain security threats specified in the Core Rule Set (CRS) from the Open Web Application Security Project (OWASP) must be blocked.

  The Azure Web Application Firewall (WAF) on Azure Application Gateway actively safeguards your web applications against common exploits and vulnerabilities. As web applications become more frequent targets for malicious attacks, these attacks often exploit well-known vulnerabilities such as SQL injection and cross-site scripting.

  WAF on Application Gateway is based on the Core Rule Set (CRS) from the Open Web Application Security Project (OWASP).

  Box 2: Azure Firewall

  Outbound HTTP and HTTPS connections from the virtual machine scale set that contain security threats identified by the Microsoft Defender Threat Intelligence (Defender TI) feed must be blocked.

  Azure Firewall threat intelligence-based filtering

  You can enable Threat intelligence-based filtering for your firewall to alert and deny traffic from/to known malicious IP addresses, FQDNs, and URLs. The IP addresses, domains and URLs are sourced from the Microsoft Threat Intelligence feed, which includes multiple sources including the Microsoft Cyber Security team. Intelligent Security Graph powers Microsoft threat intelligence and uses multiple services including Microsoft Defender for Cloud.

  

  References:

  https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/ag-overview

  https://learn.microsoft.com/en-us/azure/firewall/threat-intel

• Question 50:

  Your company has an Azure subscription that uses Microsoft Defender for Cloud.

  The company signs a contract with the United States government.

  You need to review the current subscription for NIST 800-53 compliance.

  What should you do first?

  A. From Microsoft Sentinel, configure the Microsoft Defender for Cloud data connector.
  B. From Microsoft Defender for Cloud Apps, create an access policy for cloud applications.
  C. From Defender for Cloud, enable Defender for Cloud plans.
  D. From Defender for Cloud, add a regulatory compliance standard.
  D. From Defender for Cloud, add a regulatory compliance standard.

  ---

  Explanation

  How are regulatory compliance standards represented in Defender for Cloud?

  Industry standards, regulatory standards, and benchmarks are represented in Defender for Cloud's regulatory compliance dashboard. Each standard is an initiative defined in Azure Policy.

  References:

  https://learn.microsoft.com/en-us/azure/defender-for-cloud/update-regulatory-compliance-packages