Microsoft Fundamentals SC-900 Questions & Answers

• Question 41:

  HOTSPOT For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point

  Hot Area:

  

  Correct Answer:

  

  Box 1: No

  Microsoft Sentinel data connectors are available for non-Microsoft services like Amazon Web Services.

  Box 2: Yes

  Once you have connected your data sources to Microsoft Sentinel, you can visualize and monitor the data using the Microsoft Sentinel adoption of Azure Monitor Workbooks, which provides versatility in creating custom dashboards. While the

  Workbooks are displayed differently in Microsoft Sentinel, it may be useful for you to see how to create interactive reports with Azure Monitor Workbooks. Microsoft Sentinel allows you to create custom workbooks across your data, and also

  comes with built-in workbook templates to allow you to quickly gain insights across your data as soon as you connect a data source.

  Box 3: Yes

  To help security analysts look proactively for new anomalies that weren't detected by your security apps or even by your scheduled analytics rules, Microsoft Sentinel's built-in hunting queries guide you into asking the right questions to find

  issues in the data you already have on your network.

  Reference: https://docs.microsoft.com/en-us/azure/sentinel/data-connectors-reference

  https://docs.microsoft.com/en-us/azure/sentinel/monitor-your-data

  https://docs.microsoft.com/en-us/azure/sentinel/hunting

• Question 42:

  HOTSPOT

  You create a sensitivity label as shown in the Sensitivity Label exhibit.

  

  You create an auto-labeling policy as shown in the Auto Labeling Policy exhibit.

  

  A user sends the following email:

  From: [email protected]

  To: [email protected]

  Subject: Address List

  Message Body:

  Here are the lists that you requested.

  Attachments: <> <>

  Both attachments contain lists of IP addresses.

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Reference: https://docs.microsoft.com/en-us/microsoft-365/compliance/apply-sensitivity-label-automatically?view=o365-worldwide

• Question 43:

  HOTSPOT

  Which service should you use to view your Azure secure score? To answer, select the appropriate service in the answer area.

  Hot Area:

  

  Correct Answer:

  

  Reference: https://docs.microsoft.com/en-us/azure/security-center/secure-score-access-and-track

• Question 44:

  HOTSPOT You are implementing Microsoft Office 365 Message Encryption (OME) for a Microsoft 365 tenant named contoso.com. You need to meet the following requirements:

  1.

  All email to a domain named fabrikam.com must be encrypted automatically.

  2.

  Encrypted emails must expire seven days after they are sent.

  What should you configure for each requirement? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

• Question 45:

  What can be created in Active Directory Domain Services (AD DS)?

  A. line-of-business (LOB) applications that require modern authentication

  B. computer accounts

  C. software as a service (SaaS) applications that require modern authentication

  D. mobile devices

  Correct Answer: B

  What is computer account in Active Directory?

  A computer account represents your desktop or laptop computer to the Active Directory.

  Reference:

  https://commons.lbl.gov/display/itfaq/Active+Directory

• Question 46:

  You have an Azure subscription that contains a Log Analytics workspace.

  You need to onboard Microsoft Sentinel.

  What should you do first?

  A. Create a hunting query.

  B. Correlate alerts into incidents.

  C. Connect to your security sources.

  D. Create a custom detection rule.

  Correct Answer: C

  Pre-deployment activities

  Before deploying Microsoft Sentinel, we recommend taking the following steps to help focus your deployment on providing maximum value, as soon as possible.

  *

  Determine which data sources you need and the data size requirements to help you accurately project your deployment's budget and timeline.

  You might determine this information during your business use case review, or by evaluating a current SIEM that you already have in place. If you already have a SIEM in place, analyze your data to understand which data sources provide the most value and should be ingested into Microsoft Sentinel.

  *

  Etc.

  Reference: https://learn.microsoft.com/en-us/azure/sentinel/prerequisites

• Question 47:

  You need to ensure repeatability when creating new resources in an Azure subscription. What should you use?

  A. Microsoft Sentinel

  B. Azure Policy

  C. Azure Batch

  D. Azure Blueprints

  Correct Answer: D

  Using Azure Blueprints for repeatable deploy and update operations.

  Sometimes, using policies is just not enough. Reasons may vary—the number of projects is too big to govern via policies, they become obstacles because you cannot enforce a particular rule, or you find complex designs with them to be just too complicated. For all of those scenarios, Microsoft has prepared an additional tool for Azure administrators called Azure Blueprints. They are like sketches for buildings—you can set collect all required artifacts in one place and use it for multiple deployments. With this feature, you can orchestrate multiple deployments and shorten the time needed to achieve a coherent architecture. If you are familiar with ARM templates, you may find Azure Blueprints much easier to understand as they offer similar functionalities to Resource Manager. On the other hand, it is a great tool for preserving a connection between a blueprint and a deployment or manage multiple subscriptions at once.

  Reference: https://subscription.packtpub.com/book/cloud-and-networking/9781838551452/2/ch02lvl1sec13/using-azure-blueprints-for-repeatable-deploy-and-update-operations

• Question 48:

  Which three forms of verification can be used with Azure AD Multi-Factor Authentication (MFA)? Each correct answer presents a complete solution.

  NOTE: Each correct answer is worth one point.

  A. security questions

  B. the Microsoft Authenticator app

  C. SMS messages

  D. a smart card

  E. Windows Hello for Business

  Correct Answer: BCE

  Available verification methods

  When users sign in to an application or service and receive an MFA prompt, they can choose from one of their registered forms of additional verification. Users can access My Profile to edit or add verification methods.

  The following additional forms of verification can be used with Azure AD Multi-Factor Authentication:

  *

  Microsoft Authenticator Authenticator Lite (in Outlook)

  *

  Windows Hello for Business FIDO2 security key OATH hardware token (preview) OATH software token

  *

  SMS Voice call

  Reference: https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-howitworks

• Question 49:

  What is a function of Conditional Access session controls?

  A. prompting multi-factor authentication (MFA)

  B. enable limited experiences, such as blocking download of sensitive information

  C. enforcing device compliance

  D. enforcing client app compliance

  Correct Answer: B

  Conditional Access session controls enable user app access and sessions to be monitored and controlled in real time based on access and session policies. Based on this definition, the best answer for your question is B. enable limited experiences, such as blocking download of sensitive information. https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/conceptconditional-access-session

• Question 50:

  Which three authentication methods can Azure AD users use to reset their password? Each correct answer presents a complete solution.

  NOTE: Each correct selection is worth one point.

  A. mobile app notification

  B. text message to a phone

  C. security questions

  D. certificate

  E. picture password

  Correct Answer: ABC

  Azure Active Directory (Azure AD) self-service password reset (SSPR) gives users the ability to change or reset their password, with no administrator or help desk involvement. If a user's account is locked or they forget their password, they can follow prompts to unblock themselves and get back to work. This ability reduces help desk calls and loss of productivity when a user can't sign in to their device or an application.

  Authentication methods When a user is enabled for SSPR, they must register at least one authentication method. We highly recommend that you choose two or more authentication methods so that your users have more flexibility in case they're unable to access one method when they need it. For more information, see What are authentication methods?.

  The following authentication methods are available for SSPR:

  Mobile app notification Mobile app code Email Mobile phone Office phone (available only for tenants with paid subscriptions) Security questions Users can only reset their password if they have registered an authentication method that the administrator has enabled.

  Note: Select authentication methods and registration options When users need to unlock their account or reset their password, they're prompted for another confirmation method. This extra authentication factor makes sure that Azure AD finished only approved SSPR events. You can choose which authentication methods to allow, based on the registration information the user provides.

  1.

  From the menu on the left side of the Authentication methods page, set the Number of methods required to reset to 2.

  To improve security, you can increase the number of authentication methods required for SSPR.

  2.

  Choose the Methods available to users that your organization wants to allow. For this tutorial, check the boxes to enable the following methods:

  Mobile app notification Mobile app code Email Mobile phone You can enable other authentication methods, like Office phone or Security questions, as needed to fit your business requirements.

  3.

  To apply the authentication methods, select Save.

  Reference: https://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-sspr-howitworks https://learn.microsoft.com/en-us/azure/active-directory/authentication/tutorial-enable-sspr