Microsoft SC-100 Online Practice Questions and Exam Preparation

Microsoft SC-100 Online Questions & Answers

• Question 81:

  You have a Microsoft 365 E5 subscription and an Azure subscription.

  You need to recommend a solution to enforce the Zero Trust principle of explicit verification for the subscriptions. The solution must be based on Zero Trust guidance in the Microsoft Cybersecurity Reference Architectures (MCRA).

  What should you include in the recommendation?

  A. Conditional Access
  B. Microsoft Defender for Identity
  C. Microsoft Defender for Cloud
  D. Microsoft Entra ID Identity Governance
  A. Conditional Access

• Question 82:

  HOTSPOT

  You have an Azure subscription that contains two virtual machines named VM1 and VM2, and an Azure App Service Standard app named App1. VM1 is used to upload data to App1, and App1 stores data on VM2.

  You need to secure connectivity between the virtual machines and App1. The solution must minimize the risk of data exfiltration.

  What should you use to manage connectivity for App1?

  To answer, select the options in the answer area..Each correct answer is worth one point.

  

  

  ---

  Box 1: Private endpoints

  Inbound connectivity

  Virtual network integration gives your app access to resources in your virtual network, but it doesn't grant inbound private access to your app from the virtual network. Private site access refers to making an app accessible only from a private network, such as from within an Azure virtual network. Virtual network integration is used only to make outbound calls from your app into your virtual network. Refer to private endpoint for inbound private access.

  Box 2: Virtual network integration Outbound connectivity

  How virtual network integration works

  Apps in App Service are hosted on worker roles. Virtual network integration works by mounting virtual interfaces to the worker roles with addresses in the delegated subnet. The virtual interfaces used aren't resources customers have direct access to. Because the from address is in your virtual network, it can access most things in or through your virtual network like a VM in your virtual network would.

  

  When virtual network integration is enabled, your app makes outbound calls through your virtual network. The outbound addresses that are listed in the app properties portal are the addresses still used by your app. However, if your outbound call is to a virtual machine or private endpoint in the integration virtual network or peered virtual network, the outbound address is an address from the integration subnet. The private IP assigned to an instance is exposed via the environment variable, WEBSITE_PRIVATE_IP.

  References:

  https://learn.microsoft.com/en-us/azure/app-service/overview-vnet-integration

• Question 83:

  Your company has a hybrid cloud infrastructure.

  Data and applications are moved regularly between cloud environments.

  The company's on-premises network is managed as shown in the following exhibit.

  

  You are designing security operations to support the hybrid cloud infrastructure. The solution must meet the following requirements:

  1. Govern virtual machines and servers across multiple environments.

  2. Enforce standards for all the resources across all the environments by using Azure Policy.

  Which two components should you recommend for the on-premises network? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. on-premises data gateway
  B. Azure VPN Gateway
  C. guest configuration in Azure Policy
  D. Azure Arc
  E. Azure Bastion
  C. guest configuration in Azure Policy
  D. Azure Arc

  ---

  Explanation

  C: Azure Policy's guest configuration feature provides native capability to audit or configure operating system settings as code, both for machines running in Azure and hybrid Arc-enabled machines. The feature can be used directly per-machine, or at-scale orchestrated by Azure Policy.

  Configuration resources in Azure are designed as an extension resource. You can imagine each configuration as an additional set of properties for the machine. Configurations can include settings such as:

  Operating system settings

  Application configuration or presence Environment settings Configurations are distinct from policy definitions. Guest configuration utilizes Azure Policy to dynamically assign configurations to machines.

  D: Azure Arc is a bridge that extends the Azure platform to help you build applications and services with the flexibility to run across datacenters, at the edge, and in multicloud environments.

  Microsoft recently [2019/2020] released Azure Arc, which unlocks new hybrid scenarios for organizations by bringing new Azure services and management features to any infrastructure.

  By the time of writing this post, the public preview supports the following operating systems: Windows Server 2012 R2 and newer Ubuntu 16.04 and 18.04

  Register the required Resource Providers in Azure First, we need to register the required resource providers in Azure. Therefore, take the following steps:

  Open a browser and navigate to the Azure portal at:

  https://portal.azure.com/

  Login with your administrator credentials.OpenCloudShellinthetoprightmenu,andaddthefollowinglinesofcodetoregistertheMicrosoft.HybridComputeandtheMicrosoft.GuestConfigurationresourceproviders:

  Register-AzResourceProvider -ProviderNamespace Microsoft.HybridCompute Register-AzResourceProvider -ProviderNamespace Microsoft.GuestConfiguration

  This will result in the following output:

  

  Note that the resource providers are only registered in specific locations.

  (Networking During installation and runtime, the agent requires connectivity to Azure Arc service endpoints. If outbound connectivity is blocked by the firewall, make sure that the following URLs are not blocked:

  Required Azure service endpoints include:

  Guest Configuration)

  Incorrect:

  Not A, Not B: Connect the on-premises machine to Azure Arc

  To connect the on-premises machine to Azure Arc, we first need install the agent on the on-premises machine (not any Gateways).

  Not E: Azure Bastion now supports connectivity to Azure virtual machines or on-premises resources via specified IP address.

  Azure Bastion is a fully managed service that provides more secure and seamless Remote Desktop Protocol (RDP) and Secure Shell Protocol (SSH) access to virtual machines (VMs) without any exposure through public IP addresses.

  References:

  https://techcommunity.microsoft.com/t5/azure-developer-community-blog/azure-arc-for-servers-getting-started/ba-p/1262062

  https://docs.microsoft.com/en-us/azure/cloud-adoption-framework/manage/hybrid/server/best-practices/arc-policies-mma

  https://docs.microsoft.com/en-us/azure/governance/policy/concepts/guest-configuration

• Question 84:

  You have an Azure subscription and a Microsoft 365 subscription. All users are assigned Microsoft 365 E5 licenses. All computers run Windows 11 and are Microsoft Entra joined.

  You need to recommend a solution to prevent computers that run early builds of Windows 11 from connecting to Microsoft 365 services.

  Which two types of policies should you include in the recommendation? Each correct answer presents part of the solution.

  A. Microsoft Defender for Cloud regulatory compliance policy
  B. Microsoft Defender for Endpoint endpoint security policy
  C. Microsoft Entra ID Protection sign-in risk policy
  D. Microsoft Entra Conditional Access policy
  E. Microsoft Intune compliance policy
  D. Microsoft Entra Conditional Access policy
  E. Microsoft Intune compliance policy

• Question 85:

  HOTSPOT

  You have an Azure subscription that contains multiple Azure Storage blobs and Azure Files shares.

  You need to recommend a security solution for authorizing access to the blobs and shares. The solution must meet the following requirements:

  1. Support access to the shares using the SMB protocol.

  2. Limit access to the blobs to specific periods of time.

  3. Include authentication support when possible.

  What should you recommend for each resource?

  To answer, select the options in the answer area. Each correct selection is worth one point.

  

  

  ---

  Box 1: Account shared access signature (SAS) Azure Storage blobs Limit access to the blobs to specific periods of time

  Account SAS

  An account SAS is secured with the storage account key. An account SAS delegates access to resources in one or more of the storage services. All of the operations available via a service or user delegation SAS are also available via an account SAS.

  Box 2: Service shared access signature (SAS)

  Azure Files shares

  Support access to the shares by using the SMB protocol.

  A shared access signature can take one of the following two forms:

  * Ad hoc SAS. When you create an ad hoc SAS, the start time, expiry time, and permissions are specified in the SAS URI. Any type of SAS can be an ad hoc SAS.

  *-> Service SAS with stored access policy. A stored access policy is defined on a resource container, which can be a blob container, table, queue, or file share. The stored access policy can be used to manage constraints for one or more service shared access signatures. When you associate a service SAS with a stored access policy, the SAS inherits the constraints--the start time, expiry time, and permissions --defined for the stored access policy.

  References:

  https://learn.microsoft.com/en-us/azure/storage/common/storage-sas-overview

• Question 86:

  You have a Microsoft 365 tenant that contains 5,000 users and 5,000 Windows 11 devices. All users are assigned Microsoft 365 licenses and the Microsoft Defender Vulnerability Management add-on. The Windows 11 devices are managed using Microsoft Intune and Microsoft Defender for Endpoint. The devices are configured during deployment to comply with the Center for Internet Security (CIS) benchmarks for Windows 11.

  You need to recommend a compliance solution for the Windows 11 devices. The solution must identify devices that were modified and no longer comply with the CIS benchmarks.

  What should you include in the recommendation?

  A. Authenticated scan for Windows in Microsoft Defender Vulnerability Management
  B. Microsoft Secure Score for Devices in Defender for Endpoint
  C. attack surface reduction (ASR) rules in Defender for Endpoint
  D. security baselines assessments in Microsoft Defender Vulnerability Management
  D. security baselines assessments in Microsoft Defender Vulnerability Management

• Question 87:

  HOTSPOT

  You have three on-premises servers that run Windows Server and contain shared folders. The folders contain 10,000 files.

  You have a Microsoft 365 tenant that uses Microsoft Purview and includes custom sensitive information types (SITs).

  You have an Azure subscription that contains five Azure Blob Storage accounts and multiple web apps. The Blob Storage accounts contain data for the web apps.

  You need to recommend a Microsoft Purview solution to scan the storage blobs and the shared folders. The solution must use the custom SITs to identify files that contain specific data.

  What should you use for each type of storage? To answer, select the appropriate options in the answer

  NOTE: Each correct selection is worth one point.

  

  

• Question 88:

  You have an Azure subscription.

  You have an on-premises datacenter that contains Microsoft SQL Server instances. Each instance contains multiple databases.

  You have a Microsoft 365 subscription.

  You plan to implement a solution to scan the databases for vulnerabilities that compromise data security.

  You need to recommend what to configure before the databases can be scanned.

  What should you recommend?

  A. Microsoft Purview data loss prevention (DLP)
  B. Microsoft Purview data governance
  C. Microsoft Defender for Cloud
  D. Microsoft Defender Vulnerability Management
  C. Microsoft Defender for Cloud

• Question 89:

  You have an Azure subscription.

  You plan to deploy Azure Kubernetes Service (AKS) clusters to host web services.

  You need to recommend an ingress controller solution that will ensure the security of the hosted web services.

  What should be included in your recommendation?

  A. Azure Load Balancer
  B. Azure Application Gateway
  C. Azure Front Door
  D. Azure Firewall
  B. Azure Application Gateway

  ---

  Explanation

  Use Application Gateway Ingress Controller (AGIC) with a multitenant Azure Kubernetes Service.

  In this solution, Azure Web Application Firewall (WAF) provides centralized protection for web applications deployed on a multi-tenant Azure Kubernetes Service (AKS) cluster from common exploits and vulnerabilities. Web applications running on Azure Kubernetes Service (AKS) cluster and exposed via the Application Gateway Ingress Controller (AGIC) can be protected from malicious attacks, such as SQL injection and cross-site scripting, by using a WAF Policy on Azure Application Gateway. WAF policy on Azure Application Gateway comes pre-configured with Open Worldwide Application Security Project (OWASP) core rule sets and can be changed to other supported OWASP Core Rule Set (CRS) versions.

  References:

  https://learn.microsoft.com/en-us/azure/architecture/example-scenario/aks-agic/aks-agic

• Question 90:

  HOTSPOT

  Your network contains an Active Directory Domain Services (AD DS) domain named Domain1.

  You have a Microsoft Entra tenant.

  Domain1 syncs with the tenant using Microsoft Entra Connect.

  You need to evaluate Microsoft Entra smart lockout by testing the following account lockout considerations:

  1. The number of failed sign-in attempts that trigger a lockout

  2. The duration of the lockout

  What should you use to test each consideration?

  To answer, select the appropriate options in the answer area.

  Each correct selection is worth one point.

  

  

  ---

  Box 1: AD DS and Microsoft Entra ID

  The number of failed sign-in attempts that trigger a lockout.

  Smart lockout can be integrated with hybrid deployments that use password hash sync or pass-through authentication to protect on-premises Active Directory Domain Services (AD DS) accounts from being locked out by attackers. By setting smart lockout policies in Microsoft Entra ID appropriately, attacks can be filtered out before they reach on-premises AD DS.

  When using pass-through authentication, the following considerations apply:

  * The Microsoft Entra lockout threshold must be less than the AD DS account lockout threshold. Set the values so that the AD DS account lockout threshold is at least two or three times greater than the Microsoft Entra lockout threshold.

  * The Microsoft Entra lockout duration must be longer than the AD DS account lockout duration. The Microsoft Entra duration is set in seconds, while the AD DS duration is set in minutes.

  Tip

  This configuration ensures Microsoft Entra smart lockout stops your on-premises AD DS accounts from being locked out by brute force attacks, like password spray attacks on your Microsoft Entra accounts.

  Box 2: AD DS and Microsoft Entra ID

  The duration of the lockout.

  References:

  https://learn.microsoft.com/en-us/entra/identity/authentication/howto-password-smart-lockout