Microsoft Microsoft Certifications SC-100 Questions & Answers

• Question 131:

  HOTSPOT

  You are designing security for a runbook in an Azure Automation account. The runbook will copy data to Azure Data Lake Storage Gen2.

  You need to recommend a solution to secure the components of the copy process.

  What should you include in the recommendation for each component? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: Azure Web Application Firewall with network service tags A service tag represents a group of IP address prefixes from a given Azure service. Microsoft manages the address prefixes encompassed by the service tag and automatically updates the service tag as addresses change, minimizing the complexity of frequent updates to network security rules.

  You can use service tags to define network access controls on network security groups, Azure Firewall, and user-defined routes.

  Incorrect:

  * Not Azure private link with network service tags Network service tags are not used with Private links.

  Box 2: Automation Contributor built-in role

  The Automation Contributor role allows you to manage all resources in the Automation account, except modifying other user's access permissions to an Automation account.

  Reference: https://docs.microsoft.com/en-us/azure/virtual-network/service-tags-overview

  https://docs.microsoft.com/en-us/azure/automation/automation-role-based-access-control

• Question 132:

  HOTSPOT

  You open Microsoft Defender for Cloud as shown in the following exhibit.

  

  Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: Azure Web Application Firewall (WAF)

  Restrict unauthorized network access control: 1 resource out of 11 needs to be addresses.

  Restrict unauthorized network access - Azure offers a suite of tools designed to ensure accesses across your network meet the highest security standards.

  Use these recommendations to manage Defender for Cloud's adaptive network hardening settings, ensure you configured Azure Private Link for all relevant PaaS services, enable Azure Firewall on your virtual networks, and more.

  Note: Azure Web Application Firewall (WAF) is an optional addition to Azure Application Gateway.

  Azure WAF protects inbound traffic to the web workloads, and the Azure Firewall inspects inbound traffic for the other applications. The Azure Firewall will cover outbound flows from both workload types.

  Incorrect:

  Not network security groups (NSGs).

  Box 2: Microsoft Defender for servers

  Enable endpoint protection - Defender for Cloud checks your organization's endpoints for active threat detection and response solutions such as Microsoft Defender for Endpoint or any of the major solutions shown in this list.

  When an Endpoint Detection and Response (EDR) solution isn't found, you can use these recommendations to deploy Microsoft Defender for Endpoint (included as part of Microsoft Defender for servers).

  Incorrect:

  Not Microsoft Defender for Resource Manager:

  Microsoft Defender for Resource Manager does not handle endpoint protection.

  Microsoft Defender for Resource Manager automatically monitors the resource management operations in your organization, whether they're performed through the Azure portal, Azure REST APIs, Azure CLI, or other Azure programmatic clients. Defender for Cloud runs advanced security analytics to detect threats and alerts you about suspicious activity. Reference: https://docs.microsoft.com/en-us/azure/defender-for-cloud/secure-score-security-controls

• Question 133:

  HOTSPOT

  Your company has a multi-cloud environment that contains a Microsoft 365 subscription, an Azure subscription, and Amazon Web Services (AWS) implementation.

  You need to recommend a security posture management solution for the following components:

  1.

  Azure IoT Edge devices

  2.

  AWS EC2 instances

  Which services should you include in the recommendation? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: Microsoft Defender for IoT

  Microsoft Defender for IoT is a unified security solution for identifying IoT and OT devices, vulnerabilities, and threats and managing them through a central interface.

  Azure IoT Edge provides powerful capabilities to manage and perform business workflows at the edge. The key part that IoT Edge plays in IoT environments make it particularly attractive for malicious actors.

  Defender for IoT azureiotsecurity provides a comprehensive security solution for your IoT Edge devices. Defender for IoT module collects, aggregates and analyzes raw security data from your Operating System and container system into

  actionable security recommendations and alerts.

  Box 2: Microsoft Defender for Cloud and Azure Arc

  Microsoft Defender for Cloud provides the following features in the CSPM (Cloud Security Posture Management) category in the multi-cloud scenario for AWS. Take into account that some of them require Defender plan to be enabled (such

  as Regulatory Compliance):

  *

  Detection of security misconfigurations

  *

  Single view showing Security Center recommendations and AWS Security Hub findings

  *

  Incorporation of AWS resources into Security Center's secure score calculations

  *

  Regulatory compliance assessments of AWS resources

  Security Center uses Azure Arc to deploy the Log Analytics agent to AWS instances.

  Incorrect: AWS EC2 Microsoft Defender for Cloud Apps Amazon Web Services is an IaaS provider that enables your organization to host and manage their entire workloads in the cloud. Along with the benefits of leveraging infrastructure in the cloud, your organization's most critical assets may be exposed to threats. Exposed assets include storage instances with potentially sensitive information, compute resources that operate some of your most critical applications, ports, and virtual private networks that enable access to your organization.

  Connecting AWS to Defender for Cloud Apps helps you secure your assets and detect potential threats by monitoring administrative and sign-in activities, notifying on possible brute force attacks, malicious use of a privileged user account, unusual deletions of VMs, and publicly exposed storage buckets.

  Reference: https://docs.microsoft.com/en-us/azure/defender-for-iot/device-builders/security-edge-architecture https://samilamppu.com/2021/11/04/multi-cloud-security-posture-management-in-microsoft-defender-for-cloud/

• Question 134:

  You are designing an auditing solution for Azure landing zones that will contain the following components:

  1.

  SQL audit logs for Azure SQL databases

  2.

  Windows Security logs from Azure virtual machines

  3.

  Azure App Service audit logs from App Service web apps

  You need to recommend a centralized logging solution for the landing zones. The solution must meet the following requirements:

  Log all privileged access.

  Retain logs for at least 365 days.

  Minimize costs.

  What should you include in the recommendation? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

• Question 135:

  HOTSPOT

  You have a Microsoft 365 E5 subscription and an Azure subscription.

  You need to evaluate the existing environment to increase the overall security posture for the following components:

  1.

  Windows 11 devices managed by Microsoft Intune

  2.

  Azure Storage accounts

  3.

  Azure virtual machines

  What should you use to evaluate the components? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: Microsoft 365 Defender

  The Microsoft 365 Defender portal emphasizes quick access to information, simpler layouts, and bringing related information together for easier use. It includes Microsoft Defender for Endpoint.

  Microsoft Defender for Endpoint is an enterprise endpoint security platform designed to help enterprise networks prevent, detect, investigate, and respond to advanced threats.

  You can integrate Microsoft Defender for Endpoint with Microsoft Intune as a Mobile Threat Defense solution. Integration can help you prevent security breaches and limit the impact of breaches within an organization.

  Microsoft Defender for Endpoint works with devices that run:

  Android

  iOS/iPadOS

  Windows 10

  Windows 11

  Box 2: Microsoft Defender for Cloud

  Microsoft Defender for Cloud currently protects Azure Blobs, Azure Files and Azure Data Lake Storage Gen2 resources. Microsoft Defender for SQL on Azure price applies to SQL servers on Azure SQL Database, Azure SQL Managed

  Instance and Azure Virtual Machines.

  Box 3: Microsoft 365 Compliance Center

  Azure Storage Security Assessment: Microsoft 365 Compliance Center monitors and recommends encryption for Azure Storage, and within a few clicks customers can enable built-in encryption for their Azure Storage Accounts.

  Note: Microsoft 365 compliance is now called Microsoft Purview and the solutions within the compliance area have been rebranded.

  Microsoft Purview can be setup to manage policies for one or more Azure Storage accounts.

  Reference: https://docs.microsoft.com/en-us/azure/purview/tutorial-data-owner-policies-storage

  https://docs.microsoft.com/en-us/microsoft-365/security/defender/microsoft-365-defender?

  https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint

  https://azure.microsoft.com/en-gb/pricing/details/defender-for-cloud/

• Question 136:

  HOTSPOT

  You have a Microsoft 365 subscription and an Azure subscription. Microsoft 365 Defender and Microsoft Defender for Cloud are enabled.

  The Azure subscription contains a Microsoft Sentinel workspace. Microsoft Sentinel data connectors are configured for Microsoft 365, Microsoft 365 Defender, Defender for Cloud, and Azure.

  You plan to deploy Azure virtual machines that will run Windows Server.

  You need to enable extended detection and response (EDR) and security orchestration, automation, and response (SOAR) capabilities for Microsoft Sentinel.

  How should you recommend enabling each capability? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: Onboard the servers to Defender for Cloud.

  Extended detection and response (XDR) is a new approach defined by industry analysts that are designed to deliver intelligent, automated, and integrated security across domains to help defenders connect seemingly disparate alerts and get

  ahead of attackers.

  As part of this announcement, we are unifying all XDR technologies under the Microsoft Defender brand. The new Microsoft Defender is the most comprehensive XDR in the market today and prevents, detects, and responds to threats across

  identities, endpoints, applications, email, IoT, infrastructure, and cloud platforms.

  Box 2: Configure Microsoft Sentinel playbooks.

  As a SOAR platform, its primary purposes are to automate any recurring and predictable enrichment, response and remediation tasks that are the responsibility of Security Operations Centers (SOC/SecOps). Leveraging SOAR frees up time

  and resources for more in-depth investigation of and hunting for advanced threats. Automation takes a few different forms in Microsoft Sentinel, from automation rules that centrally manage the automation of incident handling and response to

  playbooks that run predetermined sequences of actions to provide robust and flexible advanced automation to your threat response tasks.

  Reference: https://www.microsoft.com/security/blog/2020/09/22/microsoft-unified-siem-xdr-modernize-security-operations/

  https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/become-a-microsoft-sentinel-automation-ninja/ba-p/3563377

• Question 137:

  HOTSPOT

  You have a hybrid cloud infrastructure.

  You plan to deploy the Azure applications shown in the following table.

  

  What should you use to meet the requirement of each app? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: Azure Application Gateway Web Application Firewall policies

  Azure Application Gateway is a web traffic load balancer that enables you to manage traffic to your web applications.

  Azure Web Application Firewall is a cloud-native service that protects web apps from common web-hacking techniques such as SQL injection and security vulnerabilities such as cross-site scripting.

  Box 2: Azure Active Directory B2C with Conditional Access

  You can set up sign-up and sign-in with a LinkedIn account using Azure Active Directory B2C.

  You can enhance the security of Azure Active Directory B2C (Azure AD B2C) with Azure AD Identity Protection and Conditional Access. Incorrect:

  * Azure VPN Gateway with network security group rules NSGs cannot protect against XSS.

  Reference: https://learn.microsoft.com/en-us/azure/application-gateway/overview https://azure.microsoft.com/en-us/products/web-application-firewall/#overview https://learn.microsoft.com/en-us/azure/active-directory-b2c/identity-provider-linkedin

• Question 138:

  HOTSPOT

  Your company has an Azure App Service plan that is used to deploy containerized web apps.

  You are designing a secure DevOps strategy for deploying the web apps to the App Service plan.

  You need to recommend a strategy to integrate code scanning tools into a secure software development lifecycle. The code must be scanned during the following two phases:

  1.

  Uploading the code to repositories

  2.

  Building containers

  Where should you integrate code scanning for each phase? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: GitHub Enterprise

  A GitHub Advanced Security license provides the following additional features:

  Code scanning - Search for potential security vulnerabilities and coding errors in your code.

  Secret scanning - Detect secrets, for example keys and tokens, that have been checked into the repository. If push protection is enabled, also detects secrets when they are pushed to your repository.

  Etc.

  Code scanning is a feature that you use to analyze the code in a GitHub repository to find security vulnerabilities and coding errors. Any problems identified by the analysis are shown in GitHub Enterprise Cloud.

  Box 2: Azure Pipelines

  Building Containers with Azure DevOps using DevTest Pattern with Azure Pipelines

  The pattern enabled as to build container for development, testing and releasing the container for further reuse (production ready).

  Azure Pipelines integrates metadata tracing into your container images, including commit hashes and issue numbers from Azure Boards, so that you can inspect your applications with confidence.

  Incorrect:

  *

  Not Azure Boards: Azure Boards provides software development teams with the interactive and customizable tools they need to manage their software projects. It provides a rich set of capabilities including native support for Agile, Scrum,

  and Kanban processes, calendar views, configurable dashboards, and integrated reporting.

  *

  Not Microsoft Defender for Cloud

  Microsoft Defender for Containers is the cloud-native solution that is used to secure your containers so you can improve, monitor, and maintain the security of your clusters, containers, and their applications.

  You cannot use Microsoft Defender for Cloud to scan code, it scans images.

  Reference:

  https://docs.github.com/en/enterprise-cloud@latest/get-started/learning-about-github/about-github-advanced-security

  https://microsoft.github.io/code-with-engineering-playbook/automated-testing/tech-specific-samples/azdo-container-dev-test-release/

• Question 139:

  HOTSPOT

  Your company is migrating data to Azure. The data contains Personally Identifiable Information (PII).

  The company plans to use Microsoft Information Protection for the PII data store in Azure.

  You need to recommend a solution to discover PII data at risk in the Azure resources.

  What should you include in the recommendation? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: Azure Purview

  Microsoft Purview is a unified data governance service that helps you manage and govern your on-premises, multi-cloud, and software-as-a-service (SaaS) data. Microsoft Purview allows you to:

  Create a holistic, up-to-date map of your data landscape with automated data discovery, sensitive data classification, and end-to-end data lineage.

  Enable data curators to manage and secure your data estate.

  Empower data consumers to find valuable, trustworthy data.

  Box 2: Microsoft Defender for Cloud

  Microsoft Purview provides rich insights into the sensitivity of your data. This makes it valuable to security teams using Microsoft Defender for Cloud to manage the organization's security posture and protect against threats to their workloads.

  Data resources remain a popular target for malicious actors, making it crucial for security teams to identify, prioritize, and secure sensitive data resources across their cloud environments. The integration with Microsoft Purview expands

  visibility into the data layer, enabling security teams to prioritize resources that contain sensitive data.

  References: https://docs.microsoft.com/en-us/azure/purview/overview

  https://docs.microsoft.com/en-us/azure/purview/how-to-integrate-with-azure-security-products

• Question 140:

  HOTSPOT

  You are creating the security recommendations for an Azure App Service web app named App1. App1 has the following specifications:

  1.

  Users will authenticate by using Azure AD user accounts.

  2.

  Users will request access to App1 through the My Apps portal. A human resources manager will approve the requests.

  You need to recommend an access security architecture for App1.

  What should you include in the recommendation? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: A managed identity in Azure AD

  Use a managed identity. You use Azure AD as the identity provider.

  Box 2: An access review in Identity Governance

  Access to groups and applications for employees and guests changes over time. To reduce the risk associated with stale access assignments, administrators can use Azure Active Directory (Azure AD) to create access reviews for group

  members or application access.

  Reference:

  https://docs.microsoft.com/en-us/azure/app-service/scenario-secure-app-authentication-app-service

  https://docs.microsoft.com/en-us/azure/active-directory/governance/create-access-review