Microsoft Microsoft Certifications SC-100 Questions & Answers

• Question 121:

  Your company is moving all on-premises workloads to Azure and Microsoft 365.

  You need to design a security orchestration, automation, and response (SOAR) strategy in Microsoft Sentinel that meets the following requirements:

  1.

  Minimizes manual intervention by security operation analysts

  2.

  Supports triaging alerts within Microsoft Teams channels What should you include in the strategy?

  A. KQL

  B. playbooks

  C. data connectors

  D. KQLworkbooks

  Correct Answer: B

  Playbooks in Microsoft Sentinel are based on workflows built in Azure Logic Apps, a cloud service that helps you schedule, automate, and orchestrate tasks and workflows across systems throughout the enterprise.

  A playbook is a collection of these remediation actions that can be run from Microsoft Sentinel as a routine. A playbook can help automate and orchestrate your threat response; it can be run manually or set to run automatically in response to

  specific alerts or incidents, when triggered by an analytics rule or an automation rule, respectively.

  Incorrect:

  Not A: Kusto Query Language is a powerful tool to explore your data and discover patterns, identify anomalies and outliers, create statistical modeling, and more. The query uses schema entities that are organized in a hierarchy similar to

  SQL's: databases, tables, and columns.

  Not D: Workbooks provide a flexible canvas for data analysis and the creation of rich visual reports within the Azure portal. They allow you to tap into multiple data sources from across Azure, and combine them into unified interactive

  experiences.

  Workbooks allow users to visualize the active alerts related to their resources.

  Reference: https://docs.microsoft.com/en-us/azure/sentinel/automate-responses-with-playbooks

  https://docs.microsoft.com/en-us/azure/azure-monitor/visualize/workbooks-overview

• Question 122:

  You are planning the security requirements for Azure Cosmos DB Core (SQL) API accounts.

  You need to recommend a solution to audit all users that access the data in the Azure Cosmos DB accounts.

  Which two configurations should you include in the recommendation? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. Send the Azure Active Directory (Azure AD) sign-in logs to a Log Analytics workspace.

  B. Enable Microsoft Defender for Identity.

  C. Send the Azure Cosmos DB logs to a Log Analytics workspace.

  D. Disable local authentication for Azure Cosmos DB.

  E. Enable Microsoft Defender for Cosmos DB.

  Correct Answer: AD

  A: LT-2: Enable threat detection for Azure identity and access management

  Guidance: Azure Active Directory (Azure AD) provides the following user logs, which can be viewed in Azure AD reporting or integrated with Azure Monitor, Microsoft Sentinel, or other SIEM/monitoring tools for more sophisticated monitoring

  and analytics use cases:

  Sign-ins - The sign-ins report provides information about the usage of managed applications and user sign-in activities.

  Audit logs - Provides traceability through logs for all changes done by various features within Azure AD. Examples of audit logs include changes made to any resources within Azure AD, like adding or removing users, apps, groups, roles, and

  policies.

  D: Disable local authentication methods so that your Cosmos DB database accounts exclusively require Azure Active Directory identities for authentication.

  Enforcing RBAC as the only authentication method

  In situations where you want to force clients to connect to Azure Cosmos DB through RBAC exclusively, you have the option to disable the account's primary/secondary keys. When doing so, any incoming request using either a primary/

  secondary key or a resource token will be actively rejected.

  Incorrect:

  Not C: We use the Azure Active Directory (Azure AD) sign-in logs, not the Azure Cosmos db logs.

  Not E: Microsoft Defender for Cosmos DB, though useful from a security perspective, does not help with auditing the users.

  Note: Logging and Threat Detection, LT-1: Enable threat detection for Azure resources

  Guidance: Use the Microsoft Defender for Cloud built-in threat detection capability and enable Microsoft Defender for your Cosmos DB resources. Microsoft Defender for Cosmos DB provides an additional layer of security intelligence that

  detects unusual and potentially harmful attempts to access or exploit your Cosmos DB resources.

  Reference: https://docs.microsoft.com/en-us/security/benchmark/azure/baselines/cosmos-db-security-baseline https://docs.microsoft.com/en-us/azure/cosmos-db/policy-reference https://docs.microsoft.com/en-us/azure/cosmos-db/how-to-setup-rbac#disable-local-auth

• Question 123:

  Your company has the virtual machine infrastructure shown in the following table.

  

  The company plans to use Microsoft Azure Backup Server (MABS) to back up the virtual machines to Azure.

  You need to provide recommendations to increase the resiliency of the backup strategy to mitigate attacks such as ransomware.

  What should you include in the recommendation?

  A. Use geo-redundant storage (GRS).

  B. Maintain multiple copies of the virtual machines.

  C. Encrypt the backups by using customer-managed keys (CMKS).

  D. Require PINs to disable backups.

  Correct Answer: D

  Azure Backup

  Checks have been added to make sure only valid users can perform various operations. These include adding an extra layer of authentication. As part of adding an extra layer of authentication for critical operations, you're prompted to enter a

  security PIN before modifying online backups.

  Authentication to perform critical operations

  As part of adding an extra layer of authentication for critical operations, you're prompted to enter a security PIN when you perform Stop Protection with Delete data and Change Passphrase operations.

  Reference: https://docs.microsoft.com/en-us/azure/security/fundamentals/backup-plan-to-protect-against-ransomware

  https://docs.microsoft.com/en-us/azure/backup/backup-azure-security-feature#prevent-attacks

• Question 124:

  Your company has an office in Seattle.

  The company has two Azure virtual machine scales sets hosted on different virtual networks.

  The company plans to contract developers in India.

  You need to recommend a solution to provide the developers with the ability to connect to the virtual machines over SSL from the Azure portal. The solution must meet the following requirements:

  1.

  Prevent exposing the public IP addresses of the virtual machines.

  2.

  Provide the ability to connect without using a VPN.

  3.

  Minimize costs.

  Which two actions should you perform? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. Create a hub and spoke network by using virtual network peering.

  B. Deploy Azure Bastion to each virtual network.

  C. Enable just-in-time VM access on the virtual machines.

  D. Create NAT rules and network rules in Azure Firewall.

  E. Deploy Azure Bastion to one virtual network.

  Correct Answer: AE

  Azure Bastion is a fully managed service that provides more secure and seamless Remote Desktop Protocol (RDP) and Secure Shell Protocol (SSH) access to virtual machines (VMs) without any exposure through public IP addresses.

  Provision the service directly in your local or peered virtual network to get support for all the VMs within it.

  Connect to your virtual machines in your local and peered virtual networks over SSL, port 443, directly in the Azure portal.

  Azure Bastion and VNet peering can be used together. When VNet peering is configured, you don't have to deploy Azure Bastion in each peered VNet. This means if you have an Azure Bastion host configured in one virtual network (VNet), it

  can be used to connect to VMs deployed in a peered VNet without deploying an additional bastion host.

  Architecture

  When VNet peering is configured, Azure Bastion can be deployed in hub-and-spoke or full-mesh topologies.

  Reference:

  https://learn.microsoft.com/en-us/azure/bastion/vnet-peering

  https://azure.microsoft.com/en-us/products/azure-bastion/#features

• Question 125:

  Your company finalizes the adoption of Azure and is implementing Microsoft Defender for Cloud. You receive the following recommendations in Defender for Cloud

  1.

  Access to storage accounts with firewall and virtual network configurations should be restricted.

  2.

  Storage accounts should restrict network access using virtual network rules.

  3.

  Storage account should use a private link connection.

  4.

  Storage account public access should be disallowed.

  You need to recommend a service to mitigate identified risks that relate to the recommendations.

  What should you recommend?

  A. Azure Policy

  B. Azure Network Watcher

  C. Azure Storage Analytics

  D. Microsoft Sentinel

  Correct Answer: A

  An Azure Policy definition, created in Azure Policy, is a rule about specific security conditions that you want controlled. Built in definitions include things like controlling what type of resources can be deployed or enforcing the use of tags on all resources. You can also create your own custom policy definitions.

  Note: Azure security baseline for Azure Storage This security baseline applies guidance from the Azure Security Benchmark version 1.0 to Azure Storage. The Azure Security Benchmark provides recommendations on how you can secure your cloud solutions on Azure. The content is grouped by the security controls defined by the Azure Security Benchmark and the related guidance applicable to Azure Storage.

  You can monitor this security baseline and its recommendations using Microsoft Defender for Cloud. Azure Policy definitions will be listed in the Regulatory Compliance section of the Microsoft Defender for Cloud dashboard.

  For example:

  *

  1.1: Protect Azure resources within virtual networks Guidance: Configure your storage account's firewall by restricting access to clients from specific public IP address ranges, select virtual networks, or specific Azure resources. You can also configure Private Endpoints so traffic to the storage service from your enterprise travels exclusively over private networks.

  *

  1.8: Minimize complexity and administrative overhead of network security rules Guidance: For resource in Virtual Networks that need access to your Storage account, use Virtual Network Service tags for the configured Virtual Network to define network access controls on network security groups or Azure Firewall. You can use service tags in place of specific IP addresses when creating security rules.

  Reference: https://docs.microsoft.com/en-us/azure/defender-for-cloud/security-policy-concept https://docs.microsoft.com/en-us/security/benchmark/azure/baselines/storage-security-baseline

• Question 126:

  A customer has a hybrid cloud infrastructure that contains a Microsoft 365 E5 subscription and an Azure subscription.

  All on-premises servers in the perimeter network are prevented from connecting directly to the internet.

  The customer recently recovered from a ransomware attack.

  The customer plans to deploy Microsoft Sentinel.

  You need to recommend solutions to meet the following requirements:

  1.

  Ensure that the security operations team can access the security logs and the operation logs.

  2.

  Ensure that the IT operations team can access only the operations logs, including the event logs of the servers in the perimeter network. Which two solutions should you include in the recommendation? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.

  A. a custom collector that uses the Log Analytics agent

  B. the Azure Monitor agent

  C. resource-based role-based access control (RBAC)

  D. Azure Active Directory (Azure AD) Conditional Access policies

  Correct Answer: BC

  A: You can collect data in custom log formats to Microsoft Sentinel with the Log Analytics agent.

  Note: You can use the Log Analytics agent to collect data in text files of nonstandard formats from both Windows and Linux computers. Once collected, you can either parse the data into individual fields in your queries or extract the data

  during collection to individual fields.

  You can connect your data sources to Microsoft Sentinel using custom log formats.

  C: Microsoft Sentinel uses Azure role-based access control (Azure RBAC) to provide built-in roles that can be assigned to users, groups, and services in Azure.

  Use Azure RBAC to create and assign roles within your security operations team to grant appropriate access to Microsoft Sentinel. The different roles give you fine-grained control over what Microsoft Sentinel users can see and do. Azure

  roles can be assigned in the Microsoft Sentinel workspace directly (see note below), or in a subscription or resource group that the workspace belongs to, which Microsoft Sentinel inherits.

  Incorrect:

  A: You can collect data in custom log formats to Microsoft Sentinel with the Log Analytics agent.

  Note: You can use the Log Analytics agent to collect data in text files of nonstandard formats from both Windows and Linux computers. Once collected, you can either parse the data into individual fields in your queries or extract the data during collection to individual fields.

  You can connect your data sources to Microsoft Sentinel using custom log formats.

  Reference: https://docs.microsoft.com/en-us/azure/azure-monitor/agents/agents-overview https://docs.microsoft.com/en-us/azure/sentinel/connect-custom-logs?tabs=DCG https://docs.microsoft.com/en-us/azure/sentinel/roles

• Question 127:

  You are designing security for an Azure landing zone.

  Your company identifies the following compliance and privacy requirements:

  1.

  Encrypt cardholder data by using encryption keys managed by the company.

  2.

  Encrypt insurance claim files by using encryption keys hosted on-premises.

  Which two configurations meet the compliance and privacy requirements? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

  A. Store the cardholder data in an Azure SQL database that is encrypted by using Microsoft-managed keys.

  B. Store the insurance claim data in Azure Blob storage encrypted by using customer-provided keys.

  C. Store the cardholder data in an Azure SQL database that is encrypted by using keys stored in Azure Key Vault Managed HSM.

  D. Store the insurance claim data in Azure Files encrypted by using Azure Key Vault Managed HSM.

  Correct Answer: BC

  -C: Encrypt cardholder - "managed by company" but can be store in Azure Key Vault Managed HSM, (BYOK)

  -B :Encrypt insurance - "key hosted on prem" - only customer-provided key is store in customer store in on-prem, (HYOK). Take a look at table under link and read article.

  https://learn.microsoft.com/en-us/azure/storage/common/storage-service-encryption#about-encryption-key-management

  https://azure.microsoft.com/en-us/blog/customer-provided-keys-with-azure-storage-service-encryption/

• Question 128:

  You have a Microsoft 365 E5 subscription and an Azure subscription.

  You are designing a Microsoft deployment.

  You need to recommend a solution for the security operations team. The solution must include custom views and a dashboard for analyzing security events.

  What should you recommend using in Microsoft Sentinel?

  A. playbooks

  B. workbooks

  C. notebooks

  D. threat intelligence

  Correct Answer: B

  After you connected your data sources to Microsoft Sentinel, you get instant visualization and analysis of data so that you can know what's happening across all your connected data sources. Microsoft Sentinel gives you workbooks that provide you with the full power of tools already available in Azure as well as tables and charts that are built in to provide you with analytics for your logs and queries. You can either use built-in workbooks or create a new workbook easily, from scratch or based on an existing workbook.

  Reference: https://docs.microsoft.com/en-us/azure/sentinel/get-visibility

• Question 129:

  HOTSPOT

  Your company has a Microsoft 365 E5 subscription, an Azure subscription, on-premises applications, and Active Directory Domain Services (AD DS).

  You need to recommend an identity security strategy that meets the following requirements:

  1.

  Ensures that customers can use their Facebook credentials to authenticate to an Azure App Service website

  2.

  Ensures that partner companies can access Microsoft SharePoint Online sites for the project to which they are assigned

  The solution must minimize the need to deploy additional infrastructure components.

  What should you include in the recommendation? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: Azure AD B2C authentication

  Ensures that customers can use their Facebook credentials to authenticate to an Azure App Service website.

  You can set up sign-up and sign-in with a Facebook account using Azure Active Directory B2C.

  Box 2: Azure AD B2B authentication with access package assignments

  Govern access for external users in Azure AD entitlement management

  Azure AD entitlement management uses Azure AD business-to-business (B2B) to share access so you can collaborate with people outside your organization. With Azure AD B2B, external users authenticate to their home directory, but have a

  representation in your directory. The representation in your directory enables the user to be assigned access to your resources.

  Incorrect:

  Not: Password hash synchronization in Azure AD connect

  The partners are not integrated with AD DS.

  Reference: https://docs.microsoft.com/en-us/azure/active-directory-b2c/identity-provider-facebook?pivots=b2c-user-flow

  https://docs.microsoft.com/en-us/azure/active-directory/governance/entitlement-management-external-users

  https://docs.microsoft.com/en-us/microsoft-365/enterprise/microsoft-365-integration

• Question 130:

  HOTSPOT

  Your company uses Microsoft Defender for Cloud and Microsoft Sentinel.

  The company is designing an application that will have the architecture shown in the following exhibit.

  

  You are designing a logging and auditing solution for the proposed architecture. The solution must meet the following requirements:

  1.

  Integrate Azure Web Application Firewall (WAF) logs with Microsoft Sentinel.

  2.

  Use Defender for Cloud to review alerts from the virtual machines.

  What should you include in the solution? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: Data connectors

  Microsoft Sentinel connector streams security alerts from Microsoft Defender for Cloud into Microsoft Sentinel.

  Launch a WAF workbook (see step 7 below)

  The WAF workbook works for all Azure Front Door, Application Gateway, and CDN WAFs. Before connecting the data from these resources, log analytics must be enabled on your resource.

  To enable log analytics for each resource, go to your individual Azure Front Door, Application Gateway, or CDN resource:

  1.

  Select Diagnostic settings.

  2.

  Select + Add diagnostic setting.

  3.

  In the Diagnostic setting page (details skipped)

  4.

  On the Azure home page, type Microsoft Sentinel in the search bar and select the Microsoft Sentinel resource.

  5.

  Select an already active workspace or create a new workspace.

  6.

  On the left side panel under Configuration select Data Connectors.

  7.

  Search for Azure web application firewall and select Azure web application firewall (WAF). Select Open connector page on the bottom right.

  8.

  Follow the instructions under Configuration for each WAF resource that you want to have log analytic data for if you haven't done so previously.

  9.

  Once finished configuring individual WAF resources, select the Next steps tab. Select one of the recommended workbooks. This workbook will use all log analytic data that was enabled previously. A working WAF workbook should now exist for your WAF resources.

  Box 2: The Log Analytics agent

  Use the Log Analytics agent to integrate with Microsoft Defender for cloud.

  

  The Log Analytics agent is required for solutions, VM insights, and other services such as Microsoft Defender for Cloud.

  Note: The Log Analytics agent in Azure Monitor can also be used to collect monitoring data from the guest operating system of virtual machines. You may choose to use either or both depending on your requirements.

  Azure Log Analytics agent

  Use Defender for Cloud to review alerts from the virtual machines.

  The Azure Log Analytics agent collects telemetry from Windows and Linux virtual machines in any cloud, on-premises machines, and those monitored by System Center Operations Manager and sends collected data to your Log Analytics

  workspace in Azure Monitor.

  Incorrect:

  The Azure Diagnostics extension does not integrate with Microsoft Defender for Cloud.

  Reference: https://docs.microsoft.com/en-us/azure/web-application-firewall/waf-sentinel

  https://docs.microsoft.com/en-us/azure/defender-for-cloud/enable-data-collection

  https://docs.microsoft.com/en-us/azure/azure-monitor/agents/agents-overview