Microsoft Microsoft Certifications SC-100 Questions & Answers

• Question 91:

  Your company is preparing for cloud adoption.

  You are designing security for Azure landing zones.

  Which two solutions should you include in the design to ensure that preventative controls are implemented to increase the secure score? Each correct answer presents a complete solution.

  NOTE: Each correct selection is worth one point.

  A. Azure Web Application Firewall (WAF)

  B. Azure AD Privileged Identity Management (PIM)

  C. Microsoft Sentinel

  D. Azure Firewall

  E. Microsoft Defender for Cloud alerts

  Correct Answer: BC

  B: Azure identity and access for landing zones, Privileged Identity Management (PIM)

  Use Azure AD Privileged Identity Management (PIM) to establish zero-trust and least privilege access. Map your organization's roles to the minimum access levels needed. Azure AD PIM can use Azure native tools, extend current tools and

  processes, or use both current and native tools as needed.

  Azure identity and access for landing zones, Design recommendations include:

  *

  (B) Use Azure AD managed identities for Azure resources to avoid credential-based authentication. Many security breaches of public cloud resources originate with credential theft embedded in code or other text. Enforcing managed identities for programmatic access greatly reduces the risk of credential theft.

  *

  Etc.

  C: Improve landing zone security, onboard Microsoft Sentinel You can enable Microsoft Sentinel, and then set up data connectors to monitor and protect your environment. After you connect your data sources using data connectors, you choose from a gallery of expertly created workbooks that surface insights based on your data. These workbooks can be easily customized to your needs.

  Note: Landing zone security best practices

  The following list of reference architectures and best practices provides examples of ways to improve landing zone security:

  Microsoft Defender for Cloud: Onboard a subscription to Defender for Cloud.

  Microsoft Sentinel: Onboard to Microsoft Sentinel to provide a security information event management (SIEM) and security orchestration automated response (SOAR) solution.

  Secure network architecture: Reference architecture for implementing a perimeter network and secure network architecture.

  Identity management and access control: Series of best practices for implementing identity and access to secure a landing zone in Azure.

  Network security practices: Provides additional best practices for securing the network.

  Operational security provides best practices for increasing operational security in Azure.

  The Security Baseline discipline: Example of developing a governance-driven security baseline to enforce security requirements.

  Incorrect:

  Not E: Implementing alerts is not a preventive measure.

  Reference: https://docs.microsoft.com/en-us/azure/cloud-adoption-framework/ready/landing-zone/design-area/identity-access-landing-zones

  https://docs.microsoft.com/en-us/azure/sentinel/quickstart-onboard

• Question 92:

  Your company is moving a big data solution to Azure.

  The company plans to use the following storage workloads:

  1.

  Azure Storage blob containers

  2.

  Azure Data Lake Storage Gen2

  3.

  Azure Storage file shares

  4.

  Azure Disk Storage

  Which two storage workloads support authentication by using Azure AD? Each correct answer presents a complete solution.

  NOTE: Each correct selection is worth one point.

  A. Azure Storage file shares

  B. Azure Disk Storage

  C. Azure Storage blob containers

  D. Azure Data Lake Storage Gen2

  Correct Answer: CD

  C: Azure Storage supports using Azure Active Directory (Azure AD) to authorize requests to blob data. With Azure AD, you can use Azure role-based access control (Azure RBAC) to grant permissions to a security principal, which may be a user, group, or application service principal. The security principal is authenticated by Azure AD to return an OAuth 2.0 token. The token can then be used to authorize a request against the Blob service.

  You can scope access to Azure blob resources at the following levels, beginning with the narrowest scope:

  *

  An individual container. At this scope, a role assignment applies to all of the blobs in the container, as well as container properties and metadata.

  *

  The storage account.

  *

  The resource group.

  *

  The subscription.

  *

  A management group.

  D: You can securely access data in an Azure Data Lake Storage Gen2 (ADLS Gen2) account using OAuth 2.0 with an Azure Active Directory (Azure AD) application service principal for authentication. Using a service principal for authentication provides two options for accessing data in your storage account:

  A mount point to a specific file or path

  Direct access to data

  Incorrect:

  Not A: To enable AD DS authentication over SMB for Azure file shares, you need to register your storage account with AD DS and then set the required domain properties on the storage account. To register your storage account with AD DS,

  create an account representing it in your AD DS.

  Reference: https://docs.microsoft.com/en-us/azure/storage/blobs/authorize-access-azure-active-directory https://docs.microsoft.com/en-us/azure/databricks/data/data-sources/azure/adls-gen2/azure-datalake-gen2-sp-access

• Question 93:

  You have an Azure subscription that has Microsoft Defender for Cloud enabled.

  You have an Amazon Web Services (AWS) implementation.

  You plan to extend the Azure security strategy to the AWS implementation. The solution will NOT use Azure Arc.

  Which three services can you use to provide security for the AWS resources? Each correct answer presents a complete solution.

  NOTE: Each correct selection is worth one point.

  A. Microsoft Defender for Containers

  B. Microsoft Defender for servers

  C. Azure Active Directory (Azure AD) Conditional Access

  D. Azure Active Directory (Azure AD) Privileged Identity Management (PIM)

  E. Azure Policy

  Correct Answer: ACE

  Environment settings page (in preview) (recommended) - This preview page provides a greatly improved, simpler, onboarding experience (including auto provisioning). This mechanism also extends Defender for Cloud's enhanced security features to your AWS resources:

  *(A) Microsoft Defender for Containers brings threat detection and advanced defenses to your Amazon EKS clusters. This plan includes Kubernetes threat protection, behavioral analytics, Kubernetes best practices, admission control recommendations and more.

  * Microsoft Defender for Servers, though it requires Arc.

  C: AWS installations can benefit from Conditional Access. Defender for Cloud Apps integrates with Azure AD Conditional Access to enforce additional restrictions, and monitors and protects sessions after sign-in. Defender for Cloud Apps

  uses user behavior analytics (UBA) and other AWS APIs to monitor sessions and users and to support information protection.

  E: Kubernetes data plane hardening.

  For a bundle of recommendations to protect the workloads of your Kubernetes containers, install the Azure Policy for Kubernetes. You can also auto deploy this component as explained in enable auto provisioning of agents and extensions.

  With the add-on on your AKS cluster, every request to the Kubernetes API server will be monitored against the predefined set of best practices before being persisted to the cluster. You can then configure to enforce the best practices and

  mandate them for future workloads.

  Incorrect:

  Not B: To enable the Defender for Servers plan you need Azure Arc for servers installed on your EC2 instances.

  Reference: https://docs.microsoft.com/en-us/azure/defender-for-cloud/quickstart-onboard-aws?pivots=env-settings

  https://docs.microsoft.com/en-us/azure/defender-for-cloud/defender-for-containers-introduction

  https://docs.microsoft.com/en-us/azure/architecture/reference-architectures/aws/aws-azure-security-solutions

• Question 94:

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  Your on-premises network contains an e-commerce web app that was developed in Angular and Node,js. The web app uses a MongoDB database. You plan to migrate the web app to Azure. The solution architecture team proposes the following architecture as an Azure landing zone.

  

  You need to provide recommendations to secure the connection between the web app and the database. The solution must follow the Zero Trust model.

  Solution: You recommend implementing Azure Application Gateway with Azure Web Application Firewall (WAF).

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  Instead use solution: You recommend creating private endpoints for the web app and the database layer.

  Note:

  How to Use Azure Private Endpoints to Restrict Public Access to WebApps.

  As an Azure administrator or architect, you are sometimes asked the question: “How can we safely deploy internal business applications to Azure App Services?”

  These applications characteristically are:

  Not accessible from the public internet.

  Accessible from within the on-premises corporate network

  Accessible via an authorized VPN client from outside the corporate network.

  For such scenarios, we can use Azure Private Links, which enables private and secure access to Azure PaaS services over Azure Private Endpoints, along with the Site-to-Site VPN, Point-to-Site VPN, or the Express Route. Azure Private

  Endpoint is a read-only network interface service associated with the Azure PAAS Services. It allows you to bring deployed sites into your virtual network, limiting access to them at the network level.

  It uses one of the private IP addresses from your Azure VNet and associates it with the Azure App Services. These services are called Private Link resources. They can be Azure Storage, Azure Cosmos DB, SQL, App Services Web App,

  your own / partner owned services, Azure Backups, Event Grids, Azure Service Bus, or Azure Automations.

  Reference: https://www.varonis.com/blog/securing-access-azure-webapps

• Question 95:

  You are designing the security standards for a new Azure environment.

  You need to design a privileged identity strategy based on the Zero Trust model.

  Which framework should you follow to create the design?

  A. Enhanced Security Admin Environment (ESAE)

  B. Microsoft Security Development Lifecycle (SDL)

  C. Rapid Modernization Plan (RaMP)

  D. Microsoft Operational Security Assurance (OSA)

  Correct Answer: C

  RaMP initiatives for Zero Trust.

  To rapidly adopt Zero Trust in your organization, RaMP offers technical deployment guidance organized in these initiatives.

  In particular, meet these deployment objectives to protect your privileged identities with Zero Trust.

  1.

  Deploy secured privileged access to protect administrative user accounts.

  2.

  Deploy Azure AD Privileged Identity Management (PIM) for a time-bound, just-in-time approval process for the use of privileged user accounts.

  Note 1: RaMP guidance takes a project management and checklist approach:

  * User access and productivity

  1. Explicitly validate trust for all access requests Identities Endpoints (devices) Apps Network

  * Data, compliance, and governance

  2.

  Ransomware recovery readiness

  3.

  Data

  * Modernize security operations

  4.

  Streamline response

  5.

  Unify visibility

  6.

  Reduce manual effort

  Note 2: As an alternative to deployment guidance that provides detailed configuration steps for each of the technology pillars being protected by Zero Trust principles, Rapid Modernization Plan (RaMP) guidance is based on initiatives and

  gives you a set of deployment paths to more quickly implement key layers of protection.

  By providing a suggested mapping of key stakeholders, implementers, and their accountabilities, you can more quickly organize an internal project and define the tasks and owners to drive them to conclusion.

  By providing a checklist of deployment objectives and implementation steps, you can see the bigger picture of infrastructure requirements and track your progress.

  Incorrect:

  Not B: Enhanced Security Admin Environment (ESAE)

  The Enhanced Security Admin Environment (ESAE) architecture (often referred to as red forest, admin forest, or hardened forest) is an approach to provide a secure environment for Windows Server Active Directory (AD) administrators.

  Microsoft's recommendation to use this architectural pattern has been replaced by the modern privileged access strategy and rapid modernization plan (RAMP) guidance as the default recommended approach for securing privileged users.

  The ESAE hardened administrative forest pattern (on-prem or cloud-based) is now considered a custom configuration suitable only for exception cases listed below.

  What are the valid ESAE use cases?

  While not a mainstream recommendation, this architectural pattern is valid in a limited set of scenarios.

  In these exception cases, the organization must accept the increased technical complexity and operational costs of the solution. The organization must have a sophisticated security program to measure risk, monitor risk, and apply consistent

  operational rigor to the usage and maintenance of the ESAE implementation.

  Example scenarios include:

  Isolated on-premises environments - where cloud services are unavailable such as offline research laboratories, critical infrastructure or utilities, disconnected operational technology (OT) environments such as Supervisory control and data

  acquisition (SCADA) / Industrial Control Systems (ICS), and public sector customers that are fully reliant on on-premises technology.

  Highly regulated environments – industry or government regulation may specifically require an administrative forest configuration.

  High level security assurance is mandated - organizations with low risk tolerance that are willing to accept the increased complexity and operational cost of the solution.

  Reference: https://docs.microsoft.com/en-us/security/zero-trust/zero-trust-ramp-overview

  https://docs.microsoft.com/en-us/security/zero-trust/user-access-productivity-validate-trust#identities

  https://docs.microsoft.com/en-us/security/compass/esae-retirement

• Question 96:

  Your company plans to deploy several Azure App Service web apps. The web apps will be deployed to the West Europe Azure region. The web apps will be accessed only by customers in Europe and the United States.

  You need to recommend a solution to prevent malicious bots from scanning the web apps for vulnerabilities. The solution must minimize the attach surface.

  What should you include in the recommendation?

  A. Azure Firewall Premium

  B. Azure Traffic Manager and application security groups

  C. Azure Application Gateway Web Application Firewall (WAF)

  D. network security groups (NSGs)

  Correct Answer: B

  *

  Application security groups enable you to configure network security as a natural extension of an application's structure, allowing you to group virtual machines and define network security policies based on those groups. You can reuse your security policy at scale without manual maintenance of explicit IP addresses. The platform handles the complexity of explicit IP addresses and multiple rule sets, allowing you to focus on your business logic.

  *

  Azure Traffic Manager is a DNS-based traffic load balancer. This service allows you to distribute traffic to your public facing applications across the global Azure regions. Traffic Manager also provides your public endpoints with high availability and quick responsiveness.

  Traffic Manager uses DNS to direct the client requests to the appropriate service endpoint based on a traffic-routing method. Traffic manager also provides health monitoring for every endpoint.

  Incorrect:

  Not C: Azure Application Gateway Web Application Firewall is too small a scale solution in this scenario.

  Note: Attacks against a web application can be monitored by using a real-time Application Gateway that has Web Application Firewall, enabled with integrated logging from Azure Monitor to track Web Application Firewall alerts and easily

  monitor trends.

  Reference: https://docs.microsoft.com/en-us/azure/virtual-network/application-security-groups https://docs.microsoft.com/en-us/azure/traffic-manager/traffic-manager-overview https://docs.microsoft.com/en-us/security/benchmark/azure/baselines/app-service-security-baseline

• Question 97:

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Azure subscription that has Microsoft Defender for Cloud enabled.

  You are evaluating the Azure Security Benchmark V3 report.

  In the Secure management ports controls, you discover that you have 0 out of a potential 8 points.

  You need to recommend configurations to increase the score of the Secure management ports controls.

  Solution: You recommend onboarding all virtual machines to Microsoft Defender for Endpoint.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  Note: Secure management ports - Brute force attacks often target management ports. Use these recommendations to reduce your exposure with tools like just-in-time VM access and network security groups. Recommendations:

  -Internet-facing virtual machines should be protected with network security groups

  -

  Management ports of virtual machines should be protected with just-in-time network access control

  -

  Management ports should be closed on your virtual machines Reference: https://docs.microsoft.com/en-us/azure/defender-for-cloud/secure-score-security-controls

• Question 98:

  Your company has a third-party security information and event management (SIEM) solution that uses Splunk and Microsoft Sentinel.

  You plan to integrate Microsoft Sentinel with Splunk.

  You need to recommend a solution to send security events from Microsoft Sentinel to Splunk.

  What should you include in the recommendation?

  A. a Microsoft Sentinel data connector

  B. Azure Event Hubs

  C. a Microsoft Sentinel workbook

  D. Azure Data Factory

  Correct Answer: A

  Microsoft Sentinel Add-On for Splunk allows Azure Log Analytics and Microsoft Sentinel users to ingest security logs from Splunk platform using the Azure HTTP Data Collector API. Reference: https://splunkbase.splunk.com/app/5312/

• Question 99:

  You have a Microsoft 365 subscription and an Azure subscription. Microsoft 365 Defender and Microsoft Defender for Cloud are enabled.

  The Azure subscription contains 50 virtual machines. Each virtual machine runs different applications on Windows Server 2019.

  You need to recommend a solution to ensure that only authorized applications can run on the virtual machines. If an unauthorized application attempts to run or be installed, the application must be blocked automatically until an administrator

  authorizes the application.

  Which security control should you recommend?

  A. app registrations in Azure Active Directory (Azure AD)

  B. OAuth app policies in Microsoft Defender for Cloud Apps

  C. Azure Security Benchmark compliance controls in Defender for Cloud

  D. application control policies in Microsoft Defender for Endpoint

  Correct Answer: D

  This question has been updated on 8/3/22. Potential answers I'd expect to see are:

  A. Azure Active Directory (Azure AD) Conditional Access App Control policies

  B. OAuth app policies in Microsoft Defender for Cloud Apps

  C. app protection policies in Microsoft Endpoint Manager

  D. application control policies in Microsoft Defender for Endpoint Notice that only the wrong answers were changed. I'd vote D based on what I know about application control policies. https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create#windows-defender-application-control-policy-rules

• Question 100:

  Your company has on-premises Microsoft SQL Server databases.

  The company plans to move the databases to Azure.

  You need to recommend a secure architecture for the databases that will minimize operational requirements for patching and protect sensitive data by using dynamic data masking. The solution must minimize costs.

  What should you include in the recommendation?

  A. Azure SQL Managed Instance

  B. Azure Synapse Analytics dedicated SQL pools

  C. Azure SQL Database

  D. SQL Server on Azure Virtual Machines

  Correct Answer: C

  Azure SQL Database is a general-purpose relational database, provided as a managed service. Categorized as a platform as a service (PaaS), Azure SQL Databases are built on standardized hardware and software that is owned, hosted, and maintained by Microsoft. When using Azure SQL Database, you pay-as-you-go, with the option to scale up or out with no service interruption.

  Within Azure SQL Database, you have the option to deploy a managed instance. Azure SQL Database Managed Instance is a collection of system and user databases with a shared set of resources. In addition to all the PaaS benefits of Azure SQL Database, this option provides a native virtual network (VNet) and near 100 percent compatibility with on-premises SQL Server. Azure SQL Database Managed Instance provides you with full SQL Server access and feature compatibility for migrating SQL Servers to Azure.

  Recommendation: Choose Azure SQL Database for your modern cloud applications, or when you have time constraints in development and marketing.