Microsoft SC-900 Online Practice Questions and Exam Preparation

Microsoft SC-900 Online Questions & Answers

• Question 51:

  HOTSPOT

  Select the answer that correctly completes the sentence.

  

  

  ---

  Authentication

  What is the difference between authentication and authorization in Azure?

  In simple terms, authentication is the process of verifying who a user is, while authorization is the process of verifying what they have access to.

  References:

  https://auth0.com/docs/get-started/identity-fundamentals/authentication-and-authorization

• Question 52:

  HOTSPOT

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: No

  Who should use Conditional Access?

  If you're an organization currently using Conditional Access policies, security defaults are probably not right for you.

  If you're an organization with Azure Active Directory Premium licenses, security defaults are probably not right for you.

  Box 2: No

  Enabling security defaults

  If your tenant was created on or after October 22, 2019, security defaults may be enabled in your tenant. To protect all of our users, security defaults are being rolled out to all new tenants at creation.

  To enable security defaults in your directory:

  Sign in to theAzure portalas a security administrator, Conditional Access administrator, or global administrator.

  Browse toAzure Active Directory>Properties.

  Select Manage security defaults.

  Set Security defaults to **Enabled **.

  Select Save.

  Box 3: Yes

  Enforced security policies

  Require all users to register for Azure AD Multifactor Authentication

  All users in your tenant must register for multifactor authentication (MFA) in the form of the Azure AD Multifactor Authentication. Users have 14 days to register for Azure AD Multifactor Authentication by using the Microsoft Authenticator app or any app supporting OATH TOTP. After the 14 days have passed, the user can't sign in until registration is completed. A user's 14-day period begins after their first successful interactive sign-in after enabling security defaults.

  Require administrators to do multifactor authentication Administrators have increased access to your environment. Because of the power these highly privileged accounts have, you should treat them with special care. One common method to improve the protection of privileged accounts is to require a stronger form of account verification for sign-in. In Azure AD, you can get a stronger account verification by requiring multifactor authentication.

  Tip

  Recommendations for your admins:

  Ensure all your admins sign in after enabling security defaults so that they can register for authentication methods.

  Have separate accounts for administration and standard productivity tasks to significantly reduce the number of times your admins are prompted for MFA.

  References:

  https://learn.microsoft.com/en-us/azure/active-directory/fundamentals/concept-fundamentals-security-defaults

• Question 53:

  HOTSPOT

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: Yes

  Azure Defender provides security alerts and advanced threat protection for virtual machines, SQL databases, containers, web applications, your network, your storage, and more

  Box 2: Yes

  Cloud security posture management (CSPM) is available for free to all Azure users.

  Box 3: Yes

  Azure Security Center is a unified infrastructure security management system that strengthens the security posture of your data centers, and provides advanced threat protection across your hybrid workloads in the cloud - whether they're in Azure or not - as well as on premises.

  References:

  https://docs.microsoft.com/en-us/azure/security-center/azure-defenderhttps://docs.microsoft.com/en-us/azure/security-center/defender-for-storage-introductionhttps://docs.microsoft.com/en-us/azure/security-center/security-center-introduction

• Question 54:

  Which two actions can you perform by using Azure Key Vault? Each correct answer presents a complete solution.

  NOTE: Each correct selection is worth one point.

  A. Store secrets.
  B. Store Azure Resource Manager (ARM) templates.
  C. Implement network security groups (NSGs).
  D. Implement Azure DDoS Protection.
  E. Store keys.
  A. Store secrets.
  E. Store keys.

  ---

  Explanation

  Azure Key Vault enables Microsoft Azure applications and users to store and use several types of secret/ key data: keys, secrets, and certificates. Keys, secrets, and certificates are collectively referred to as "objects".

  References:

  https://learn.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates

• Question 55:

  HOTSPOT

  Select the answer that correctly completes the sentence.

  

  

  ---

  Compliance Manager

  Microsoft also offers a set of integrated solutions that leverage AI to help improve data protection capabilities and overall compliance posture. Compliance Manager enables you to manage your compliance activities in a single dashboard and provides three key capabilities:

  * Risk assessment: The tool helps you track, assign, and verify your organization's regulatory compliance activities related to Microsoft Cloud services. With a single dashboard, you can see multiple assessments and measure the compliance performance for a cloud service against a regulation or a standard (Ex-ISO 27001, ISO 27018, FedRAMP, NIST, GDPR)

  * Etc.

  Box: Assessments

  References:

  https://azure.microsoft.com/en-us/blog/azure-resources-to-assess-risk-and-compliance/

• Question 56:

  HOTSPOT

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: No

  Software as a service is a method for delivering software applications over the internet, on demand, and typically on a subscription basis. With SaaS, cloud providers host and manage the software application and underlying infrastructure. These providers also handle any maintenance, like software upgrades and security patching. Users connect to the application over the internet, usually with a web browser on their phone, tablet, or PC.

  Box 2: Yes

  IaaS lets you bypass the cost and complexity of buying and managing physical servers and datacenter infrastructure. Each resource is offered as a separate service component, and you only pay for a particular resource for as long as you need it. A cloud computing service provider like Azure manages the infrastructure, while you purchase, install, configure, and manage your own software-including operating systems, middleware, and applications.

  Box 3: No

  With the appropriate service agreement, a cloud service provider can offer better security for your applications and data than the security you would attain in house.

  References:

  https://azure.microsoft.com/en-ca/resources/cloud-computing-dictionary/what-is-iaas/

• Question 57:

  HOTSPOT

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  https://learn.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview

• Question 58:

  Which two Azure resources can a network security group (NSG) be associated with? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.

  A. a network interface
  B. an Azure App Service web app
  C. a virtual network
  D. a virtual network subnet
  E. a resource group
  A. a network interface
  D. a virtual network subnet

  ---

  Explanation

  Association of network security groups

  You can associate a network security group with virtual machines, NICs, and subnets, depending on the deployment model you use.

  References:

  https://aviatrix.com/learn-center/cloud-security/create-network-security-groups-in-azure/

• Question 59:

  When security defaults are enabled for an Azure Active Directory (Azure AD) tenant, which two requirements are enforced? Each correct answer presents a complete solution.

  NOTE: Each correct selection is worth one point.

  A. All users must authenticate from a registered device.
  B. Administrators must always use Azure Multi-Factor Authentication (MFA).
  C. Azure Multi-Factor Authentication (MFA) registration is required for all users.
  D. All users must authenticate by using passwordless sign-in.
  E. All users must authenticate by using Windows Hello.
  B. Administrators must always use Azure Multi-Factor Authentication (MFA).
  C. Azure Multi-Factor Authentication (MFA) registration is required for all users.

  ---

  Explanation

  Security defaults make it easy to protect your organization with the following preconfigured security settings:

  1. Requiring all users to register for Azure AD Multi-Factor Authentication.

  2. Requiring administrators to do multi-factor authentication.

  3. Blocking legacy authentication protocols.

  4. Requiring users to do multi-factor authentication when necessary.

  5. Protecting privileged activities like access to the Azure portal.

• Question 60:

  HOTSPOT

  Select the answer that correctly completes the sentence.

  

  

  ---

  Box 1: Azure monitor workbook templates

  Create interactive reports by using workbooks After you onboard to Microsoft Sentinel, monitor your data by using the integration with Azure Monitor workbooks.

  Workbooks display differently in Microsoft Sentinel than in Azure Monitor. But it may be useful for you to see how to create a workbook in Azure Monitor. Microsoft Sentinel allows you to create custom workbooks across your data. Microsoft Sentinel also comes with built-in workbook templates to allow you to quickly gain insights across your data as soon as you connect a data source.

  References:

  https://learn.microsoft.com/en-us/azure/sentinel/overview