Microsoft SC-100 Online Practice Questions and Exam Preparation

Microsoft SC-100 Online Questions & Answers

• Question 71:

  HOTSPOT

  You have an Active Directory Domain Services (AD DS) domain that contains a virtual desktop infrastructure (VDI). The VDI uses non-persistent images and cloned virtual machine templates. VDI devices are members of the domain.

  You have an Azure subscription that contains an Azure Virtual Desktop environment. The environment contains host pools that use a custom golden image. All the Azure Virtual Desktop deployments are members of a single Azure Active Directory Domain Services (Azure AD DS) domain.

  You need to recommend a solution to deploy Microsoft Defender for Endpoint to the hosts. The solution must meet the following requirements:

  1. Ensure that the hosts are onboarded to Defender for Endpoint during the first startup sequence.

  2. Ensure that the Microsoft Defender 365 portal contains a single entry for each deployed VDI host.

  3. Minimize administrative effort.

  What should you recommend? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

  

  

• Question 72:

  Your company has an Azure subscription that has enhanced security enabled for Microsoft Defender for Cloud.

  The company signs a contract with the United States government.

  You need to review the current subscription for NIST 800-53 compliance.

  What should you do first?

  A. From Defender for Cloud, review the secure score recommendations.
  B. From Microsoft Sentinel, configure the Microsoft Defender for Cloud data connector.
  C. From Defender for Cloud, review the Azure security baseline for audit report.
  D. From Defender for Cloud, add a regulatory compliance standard.
  D. From Defender for Cloud, add a regulatory compliance standard.

  ---

  Explanation

  Add a regulatory standard to your dashboard

  The following steps explain how to add a package to monitor your compliance with one of the supported regulatory standards.

  Add a standard to your Azure resources 1. From Defender for Cloud's menu, select Regulatory compliance to open the regulatory compliance dashboard. Here you can see the compliance standards currently assigned to the currently selected subscriptions.

  2. From the top of the page, select Manage compliance policies. The Policy Management page appears.

  3. Select the subscription or management group for which you want to manage the regulatory compliance posture.

  4. To add the standards relevant to your organization, expand the Industry & regulatory standards section and select Add more standards.

  5. From the Add regulatory compliance standards page, you can search for any of the available standards:

  

  6. Select Add and enter all the necessary details for the specific initiative such as scope, parameters, and remediation.

  7. From Defender for Cloud's menu, select Regulatory compliance again to go back to the regulatory compliance dashboard.

  Your new standard appears in your list of Industry & regulatory standards.

  Note: Customize the set of standards in your regulatory compliance dashboard.

  Microsoft Defender for Cloud continually compares the configuration of your resources with requirements in industry standards, regulations, and benchmarks. The regulatory compliance dashboard provides insights into your compliance posture based on how you're meeting specific compliance requirements.

  References:

  https://docs.microsoft.com/en-us/azure/defender-for-cloud/update-regulatory-compliance-packages

• Question 73:

  You have a Microsoft 365 E5 subscription.

  You need to recommend a solution to add a watermark to email attachments that contain sensitive data.

  What should you include in the recommendation?

  A. Microsoft Defender for Cloud Apps
  B. insider risk management
  C. Microsoft Information Protection
  D. Azure Purview
  C. Microsoft Information Protection

  ---

  Explanation

  https://docs.microsoft.com/en-us/microsoft-365/compliance/sensitivity-labels?view=o365-worldwide

  like for example You can use sensitivity labels to:

  Provide protection settings that include encryption and content markings. For example, apply a "Confidential" label to a document or email, and that label encrypts the content and applies a "Confidential" watermark. Content markings include headers and footers as well as watermarks, and encryption can also restrict what actions authorized people can take on the content.

  Protect content in Office apps across different platforms and devices. Supported by Word, Excel, PowerPoint, and Outlook on the Office desktop apps and Office on the web. Supported on Windows, macOS, iOS, and Android.

  Protect content in third-party apps and services by using Microsoft Defender for Cloud Apps. With Defender for Cloud Apps, you can detect, classify, label, and protect content in third-party apps and services, such as SalesForce, Box, or DropBox, even if the third-party app or service does not read or support sensitivity labels.

• Question 74:

  HOTSPOT

  You have an Azure subscription that contains an Azure Synapse Analytics workspace named workspace1. workspace1 contains a built-in serverless SQL pool and a dedicated SQL pool named Pool1.

  You need to recommend a second layer of data encryption for workspace1.

  What should you include in the recommendation for each pool? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 75:

  A customer follows the Zero Trust model and explicitly verifies each attempt to access its corporate applications.

  The customer discovers that several endpoints are infected with malware.

  The customer suspends access attempts from the infected endpoints.

  The malware is removed from the end point.

  Which two conditions must be met before endpoint users can access the corporate applications again? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. The client access tokens are refreshed.
  B. Microsoft Intune reports the endpoints as compliant.
  C. A new Azure Active Directory (Azure AD) Conditional Access policy is enforced.
  D. Microsoft Defender for Endpoint reports the endpoints as compliant.
  A. The client access tokens are refreshed.
  C. A new Azure Active Directory (Azure AD) Conditional Access policy is enforced.

  ---

  Explanation

  A: When a client acquires an access token to access a protected resource, the client also receives a refresh token. The refresh token is used to obtain new access/refresh token pairs when the current access token expires. Refresh tokens are also used to acquire extra access tokens for other resources.

  Refresh token expiration

  Refresh tokens can be revoked at any time, because of timeouts and revocations.

  C: Microsoft Defender for Endpoint is an enterprise endpoint security platform designed to help enterprise networks prevent, detect, investigate, and respond to advanced threats. It uses a combination of endpoint behavioral sensors, cloud security analytics, and threat intelligence.

  The interviewees said that "by implementing Zero Trust architecture, their organizations improved employee experience (EX) and increased productivity." They also noted, "increased device performance and stability by managing all of their endpoints with Microsoft Endpoint Manager." This had a bonus effect of reducing the number of agents installed on a user's device, thereby increasing device stability and performance. "For some organizations, this can reduce boot times from 30 minutes to less than a minute," the study states. Moreover, shifting to Zero Trust moved the burden of security away from users. Implementing single sign-on (SSO), multifactor authentication (MFA), leveraging passwordless authentication, and eliminating VPN clients all further reduced friction and improved user productivity.

  Note: Azure AD at the heart of your Zero Trust strategy Azure AD provides critical functionality for your Zero Trust strategy. It enables strong authentication, a point of integration for device security, and the core of your user-centric policies to guarantee least-privileged access. Azure AD's Conditional Access capabilities are the policy decision point for access to resource

  References:

  https://www.microsoft.com/security/blog/2022/02/17/4-best-practices-to-implement-a-comprehensive-zero-trust-security-approach/

  https://docs.microsoft.com/en-us/azure/active-directory/develop/refresh-tokens

• Question 76:

  HOTSPOT

  You have a Microsoft Entra tenant named contoso.com that is linked to an Azure subscription named Sub1 and a Microsoft 365 subscription.

  Sub1 contains a publicly accessible Azure App Service web app named App1.

  You have an external partner that has a Microsoft Entra tenant named fabrikam.com.

  You need to recommend a solution that meets the following requirements:

  1. Ensures that the users in fabrikam.com can be granted permissions to specific Microsoft Teams channels in contoso.com

  2. Ensures that the users of App1 can authenticate by using social media accounts

  3. Minimizes administrative effort.

  Which authentication method should you recommend for each requirement? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 77:

  You have an Azure subscription that has Microsoft Defender for Cloud enabled.

  You are evaluating the Azure Security Benchmark V3 report as shown in the following exhibit.

  

  You need to verify whether Microsoft Defender for servers is installed on all the virtual machines that run Windows.

  Which compliance control should you evaluate?

  A. Asset Management
  B. Posture and Vulnerability Management
  C. Data Protection
  D. Endpoint Security
  E. Incident Response
  D. Endpoint Security

  ---

  Explanation

  Microsoft Defender for servers compliance control installed on Windows Defender for clout "Endpoint Security" azure security benchmark v3

  Endpoint Security covers controls in endpoint detection and response, including use of endpoint detection and response (EDR) and anti-malware service for endpoints in Azure environments.

  Security Principle: Enable Endpoint Detection and Response (EDR) capabilities for VMs and integrate with SIEM and security operations processes.

  Azure Guidance: Azure Defender for servers (with Microsoft Defender for Endpoint integrated) provides EDR capability to prevent, detect, investigate, and respond to advanced threats.

  Use Microsoft Defender for Cloud to deploy Azure Defender for servers for your endpoint and integrate the alerts to your SIEM solution such as Azure Sentinel.

  Incorrect:

  Not A: Asset Management covers controls to ensure security visibility and governance over Azure resources, including recommendations on permissions for security personnel, security access to asset inventory, and managing approvals for services and resources (inventory, track, and correct).

  Not B: Posture and Vulnerability Management focuses on controls for assessing and improving Azure security posture, including vulnerability scanning, penetration testing and remediation, as well as security configuration tracking, reporting, and correction in Azure resources.

  Not C: Data Protection covers control of data protection at rest, in transit, and via authorized access mechanisms, including discover, classify, protect, and monitor sensitive data assets using access control, encryption, key and certificate management in Azure.

  Not E: Incident Response covers controls in incident response life cycle - preparation, detection and analysis, containment, and post-incident activities, including using Azure services such as Microsoft Defender for Cloud and Sentinel to automate the incident response process.

  References:

  https://docs.microsoft.com/en-us/security/benchmark/azure/security-controls-v3-endpoint-security

• Question 78:

  You have a Microsoft 365 subscription.

  You need to design a solution to block file downloads from Microsoft SharePoint Online by authenticated users on unmanaged devices.

  Which two services should you include in the solution? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. Azure AD Conditional Access
  B. Azure Data Catalog
  C. Microsoft Purview Information Protection
  D. Azure AD Application Proxy
  E. Microsoft Defender for Cloud Apps
  A. Azure AD Conditional Access
  E. Microsoft Defender for Cloud Apps

  ---

  Explanation

  Blocking or limiting access on unmanaged devices relies on Azure AD conditional access policies.

  Create a block download policy for unmanaged devices Defender for Cloud Apps session policies allow you to restrict a session based on device state. To accomplish control of a session using its device as a condition, create both a conditional access policy AND a session policy.

  Incorrect:

  Not B: Azure Data Catalog is an enterprise-wide metadata catalog that makes data asset discovery straightforward. It's a fully-managed service that lets you -- from analyst to data scientist to data developer -- register, enrich, discover, understand, and consume data sources.

  Not C: Implement capabilities from Microsoft Purview Information Protection (formerly Microsoft Information Protection) to help you discover, classify, and protect sensitive information wherever it lives or travels.

  References:

  https://learn.microsoft.com/en-us/sharepoint/control-access-from-unmanaged-devices

  https://learn.microsoft.com/en-us/defender-cloud-apps/use-case-proxy-block-session-aad

• Question 79:

  HOTSPOT

  You plan to deploy a dynamically scaling, Linux-based Azure Virtual Machine Scale Set that will host jump servers. The jump servers will be used by support staff who connect from personal and kiosk devices via the internet. The subnet of the jump servers will be associated to a network security group (NSG).

  You need to design an access solution for the Azure Virtual Machine Scale Set. The solution must meet the following requirements:

  1. Ensure that each time the support staff connects to a jump server; they must request access to the server.

  2. Ensure that only authorized support staff can initiate SSH connections to the jump servers.

  3. Maximize protection against brute-force attacks from internal networks and the internet.

  4. Ensure that users can only connect to the jump servers from the internet.

  5. Minimize administrative effort.

  What should you include in the solution? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

• Question 80:

  Your company has on-premises datacenters in Seattle, Chicago, and New York City.

  You plan to migrate the on-premises workloads to the East US Azure region.

  You need to design a governance solution for the management group hierarchy. The solution must be based on Microsoft Cloud Adoption Framework for Azure principles and must ensure that the hierarchy aligns with the Azure landing conceptual architecture.

  What should you use to identify which archetype-aligned management groups to create beneath the landing zones management group?

  A. software development lifecycle (SDLC) environments
  B. the internal billing chargeback structure
  C. the hybrid connectivity requirements
  D. geographical locations
  A. software development lifecycle (SDLC) environments