Microsoft Fundamentals SC-900 Questions & Answers

• Question 11:

  HOTSPOT

  Select the answer that correctly completes the sentence.

  Hot Area:

  

  Correct Answer:

  

  Azure Key Vault can store application secrets.

  Azure Key Vault is a cloud service that provides a secure store for secrets. You can securely store keys, passwords, certificates, and other secrets.

  Reference:

  https://docs.microsoft.com/en-us/azure/key-vault/secrets/quick-create-portal

• Question 12:

  HOTSPOT

  Select the answer that correctly completes the sentence.

  Hot Area:

  

  Correct Answer:

  

  Azure Defender for Cloud Microsoft Defender for Cloud is a solution for cloud security posture management (CSPM) and cloud workload protection (CWP) that finds weak spots across your cloud configuration, helps strengthen the overall security posture of your environment, and can protect workloads across multicloud and hybrid environments from evolving threats.

  Microsoft Defender for Servers is one of the plans provided by Microsoft Defender for Cloud's enhanced security features. Defender for Servers protects your Windows and Linux machines in Azure, AWS, GCP, and on-premises.

  Reference: https://docs.microsoft.com/en-us/azure/defender-for-cloud/defender-for-cloud-introduction https://docs.microsoft.com/en-us/azure/defender-for-cloud/defender-for-servers-introduction

• Question 13:

  HOTSPOT

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: No

  Software tokens is a time-based one-time passcodes (TOTP) solution.

  Microsoft Authenticator, which is a passwordless solution, uses software tokens though.

  Note: Authentication methods in Azure Active Directory - OATH tokens

  OATH TOTP (Time-based One Time Password) is an open standard that specifies how one-time password (OTP) codes are generated. OATH TOTP can be implemented using either software or hardware to generate the codes. Azure AD

  doesn't support OATH HOTP, a different code generation standard.

  OATH software tokens

  Software OATH tokens are typically applications such as the Microsoft Authenticator app and other authenticator apps. Azure AD generates the secret key, or seed, that's input into the app and used to generate each OTP.

  Box 2: Yes

  Each organization has different needs when it comes to authentication. Microsoft global Azure and Azure Government offer the following three passwordless authentication options that integrate with Azure Active Directory (Azure AD):

  Windows Hello for Business

  Microsoft Authenticator

  FIDO2 security keys

  Box 3: Yes

  Reference:

  https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-authentication-passwordless

  https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-authentication-oath-tokens

• Question 14:

  HOTSPOT

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: Yes

  Azure Active Directory B2C provides business-to-customer identity as a service. Your customers use their preferred social, enterprise, or local account identities to get single sign-on access to your applications and APIs.

  Box 2: No

  Azure AD B2C is a separate service from Azure Active Directory (Azure AD). It is built on the same technology as Azure AD but for a different purpose. It allows businesses to build customer facing applications, and then allow anyone to sign

  up into those applications with no restrictions on user account.

  Box 3: Yes

  Custom-branded identity solution

  Azure AD B2C is a white-label authentication solution. You can customize the entire user experience with your brand so that it blends seamlessly with your web and mobile applications.

  Customize every page displayed by Azure AD B2C when your users sign up, sign in, and modify their profile information. Customize the HTML, CSS, and JavaScript in your user journeys so that the Azure AD B2C experience looks and feels

  like it's a native part of your application.

  Reference:

  https://learn.microsoft.com/en-us/azure/active-directory-b2c/overview

• Question 15:

  HOTSPOT

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: Yes

  Microsoft's identity solutions span on-premises and cloud-based capabilities. These solutions create a common user identity for authentication and authorization to all resources, regardless of location. We call this hybrid identity.

  With hybrid identity to Azure AD and hybrid identity management these scenarios become possible.

  To achieve hybrid identity with Azure AD, one of three authentication methods can be used, depending on your scenarios. The three methods are:

  Password hash synchronization (PHS)

  Pass-through authentication (PTA)

  Federation (AD FS)

  Note: Password hash synchronization is one of the sign-in methods used to accomplish hybrid identity. Azure AD Connect synchronizes a hash of a user's password from an on-premises Active Directory instance to a cloud-based Azure AD

  instance.

  Box 2: No

  Need to configure password synchronization.

  The user accounts created on-premises would then be synchronized to the cloud.

  Box 3: Yes

  Federated authentication

  Federated authentication is primarily for large enterprise organizations with more complex authentication requirements. AD DS identities are synchronized with Microsoft 365 and users accounts are managed on-premises. With federated

  authentication, users have the same password on-premises and in the cloud and they do not have to sign in again to use Microsoft 365.

  For third-party authentication and identity providers, on-premises directory objects may be synchronized to Microsoft 365 and cloud resource access that are primarily managed by a third-party identity provider (IdP). If your organization uses a

  third-party federation solution, you can configure sign-on with that solution for Microsoft 365 provided that the third-party federation solution is compatible with Azure AD.

  Reference:

  https://learn.microsoft.com/en-us/azure/active-directory/hybrid/whatis-hybrid-identity

  https://learn.microsoft.com/en-us/azure/active-directory/hybrid/whatis-phs

  https://learn.microsoft.com/en-us/microsoft-365/enterprise/deploy-identity-solution-identity-model?

• Question 16:

  HOTSPOT

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: No

  Box 2: Yes

  Identity Protection detects risks of many types, including:

  Anonymous IP address use

  Atypical travel

  Malware linked IP address

  Unfamiliar sign-in properties

  Leaked credentials

  Password spray

  and more...

  Box 3:Yes

  The risk signals can trigger remediation efforts such as requiring: perform multifactor authentication, reset their password using self-service password reset, or block access until an administrator takes action.

  Reference:

  https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/overview-identity-protection

• Question 17:

  HOTSPOT

  Select the answer that correctly completes the sentence.

  Hot Area:

  

  Correct Answer:

  

  Managed identities provide an identity for applications to use when connecting to resources that support Azure Active Directory (Azure AD) authentication.

  Here are some of the benefits of using managed identities:

  You don't need to manage credentials. Credentials aren't even accessible to you.

  You can use managed identities to authenticate to any resource that supports Azure AD authentication, including your own applications.

  Reference: https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview

• Question 18:

  HOTSPOT

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: No

  The Microsoft Authenticator app helps you sign in to your accounts when you're using two-factor verification. Two-factor verification helps you to use your accounts more securely because passwords can be forgotten, stolen, or compromised.

  Two-factor verification uses a second factor like your phone to make it harder for other people to break in to your account.

  Box 2: Yes

  In Windows 10, Windows Hello for Business replaces passwords with strong two-factor authentication on devices. This authentication consists of a new type of user credential that is tied to a device and uses a biometric or PIN.

  Box 3: No

  Windows Hello credentials are based on certificate or asymmetrical key pair. Windows Hello credentials can be bound to the device, and the token that is obtained using the credential is also bound to the device.

  Reference: https://docs.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-overview

• Question 19:

  HOTSPOT

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: Yes

  Authorization is the security process that determines a user or service's level of access.

  Box 2: Yes

  Authentication (AuthN) is a process that verifies that someone or something is who they say they are.

  Box 3: No

  Reference:

  https://www.onelogin.com/learn/authentication-vs-authorization

• Question 20:

  HOTSPOT

  Select the answer that correctly completes the sentence.

  Hot Area:

  

  Correct Answer: