Microsoft Microsoft Certifications SC-100 Questions & Answers

• Question 141:

  HOTSPOT

  You are planning the security levels for a security access strategy.

  You need to identify which job roles to configure at which security levels. The solution must meet security best practices of the Microsoft Cybersecurity Reference Architectures (MCRA).

  Which security level should you configure for each job role? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: Specialized security

  

  Securing devices as part of the privileged access story Box 2: Enterprise security

  Box 3: Privileged security

  Reference: https://learn.microsoft.com/en-us/security/compass/privileged-access-devices

• Question 142:

  HOTSPOT

  For a Microsoft cloud environment, you are designing a security architecture based on the Microsoft Cybersecurity Reference Architectures (MCRA).

  You need to protect against the following external threats of an attack chain:

  1.

  An attacker attempts to exfiltrate data to external websites.

  2.

  An attacker attempts lateral movement across domain-joined computers.

  What should you include in the recommendation for each threat? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: Microsoft Defender for Identity

  An attacker attempts to exfiltrate data to external websites.

  Exfiltration alerts

  Typically, cyberattacks are launched against any accessible entity, such as a low-privileged user, and then quickly move laterally until the attacker gains access to valuable assets. Valuable assets can be sensitive accounts, domain

  administrators, or highly sensitive data. Microsoft Defender for Identity identifies these advanced threats at the source throughout the entire attack kill chain and classifies them into the following phases:

  Reconnaissance

  Compromised credentials

  Lateral Movements

  Domain dominance

  Exfiltration

  Box 2: Microsoft Defender for Identity

  An attacker attempts lateral movement across domain-joined computers.

  Microsoft Defender for Identity Lateral Movement Paths (LMPs)

  Lateral movement is when an attacker uses non-sensitive accounts to gain access to sensitive accounts throughout your network. Lateral movement is used by attackers to identify and gain access to the sensitive accounts and machines in

  your network that share stored sign-in credentials in accounts, groups and machines. Once an attacker makes successful lateral moves towards your key targets, the attacker can also take advantage and gain access to your domain

  controllers. Lateral movement attacks are carried out using many of the methods described in Microsoft Defender for Identity Security Alerts.

  A key component of Microsoft Defender for Identity's security insights are Lateral Movement Paths or LMPs. Defender for Identity LMPs are visual guides that help you quickly understand and identify exactly how attackers can move laterally

  inside your network.

  Reference: https://learn.microsoft.com/en-us/defender-for-identity/exfiltration-alerts

• Question 143:

  HOTSPOT

  You use Azure Policy with Azure Repos to implement continuous integration and continuous deployment (CI/CD) workflows.

  You need to recommend best practices to secure the stages of the CI/CD workflows based on the Microsoft Cloud Adoption Framework for Azure.

  What should you include in the recommendation for each stage? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: Protected branches

  Git workflow

  The pull request workflow is designed to introduce healthy friction, which is why it should only be applied to secure specific Git branches. Especially the branches that will trigger automated workflows that can deploy, configure, or in any other

  way affect your cloud resources. These branches are called protected branches.

  Restrict access to protected branches

  The pull request workflow is used together with restricted access controls. The pull request workflow can't be enforced however, unless the server is configured to reject direct changes to protected branches.

  A developer can't push directly to the production branch, but instead must create a pull request that targets the protected branch. Each SCM vendor has a different flavor for achieving restricted access to protected branches. For example, with

  GitHub this feature is only available for organizations using GitHub team or GitHub Enterprise cloud.

  Box 2: Azure Key Vault

  Secure your deployment credentials

  Pipelines and code repositories should not include hard-coded credentials and secrets. Credentials and secrets should be stored elsewhere and use CI vendor features for security. Because pipelines run as headless agents, they should

  never use an individual's password.

  Azure Key Vault

  If your CI platform supports it, consider storing credentials in a dedicated secret store, for example Azure Key Vault. Credentials are fetched at runtime by the build agent and your attack surface is reduced.

  Reference:

  https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/secure/best-practices/secure-devops

• Question 144:

  HOTSPOT

  Your company wants to optimize using Azure to protect its resources from ransomware.

  You need to recommend which capabilities of Azure Backup and Azure Storage provide the strongest protection against ransomware attacks. The solution must follow Microsoft Security Best Practices.

  What should you recommend? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: A security PIN

  Azure Backup

  The best way to prevent falling victim to ransomware is to implement preventive measures and have tools that protect your organization from every step that attackers take to infiltrate your systems.

  You can reduce your on-premises exposure by moving your organization to a cloud service.

  Checks have been added to make sure only valid users can perform various operations. These include adding an extra layer of authentication. As part of adding an extra layer of authentication for critical operations, you're prompted to enter a

  security PIN before modifying online backups.

  Box 2: Encryption by using platform-managed keys

  Ensure backup data is encrypted.

  By default, backup data at rest is encrypted using platform-managed keys (PMK). For vaulted backups, you can choose to use customer-managed keys (CMK) to own and manage the encryption keys yourself. Additionally, you can configure

  encryption on the storage infrastructure using infrastructure-level encryption, which along with CMK encryption provides double encryption of data at rest.

  Reference:

  https://learn.microsoft.com/en-us/azure/security/fundamentals/backup-plan-to-protect-against-ransomware

  https://learn.microsoft.com/en-us/azure/backup/protect-backups-from-ransomware-faq

• Question 145:

  HOTSPOT

  You need to recommend a security methodology for a DevOps development process based on the Microsoft Cloud Adoption Framework for Azure.

  During which stage of a continuous integration and continuous deployment (CI/CD) DevOps process should each security-related task be performed? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  

  Plan and develop

  Box 1: Plan and develop

  Typically, modern development follows an agile development methodology. Scrum is one implementation of agile methodology that has every sprint start with a planning activity. Introducing security into this part of the development process should focus on:

  *

  Threat modeling to view the application through the lens of a potential attacker

  *

  IDE security plug-ins and pre-commit hooks for lightweight static analysis checking within an integrated development environment (IDE).

  *

  Peer reviews and secure coding standards to identify effective security coding standards, peer review processes, and pre-commit hooks. It's not mandatory to add all these steps. But each step helps reveal security issues early, when they're much cheaper and easier to fix.

  Box 2: Operate

  Go to production and operate

  When the solution goes to production, it's vital to continue overseeing and managing the security state. At this stage in the process, it's time to focus on the cloud infrastructure and overall application.

  Configuration and infrastructure scanning

  Penetration testing

  Actionable intelligence

  The tools and techniques in this guidance offer a holistic security model for organizations who want to move at pace and experiment with new technologies that aim to drive innovation. A key element of DevSecOps is data-driven, event-driven

  processes. These processes help teams identify, evaluate, and respond to potential risks. Many organizations choose to integrate alerts and usage data into their IT service management (ITSM) platform. The team can then bring the same

  structured workflow to security events that they use for other incidents and requests.

  Box 3: Build and test

  Build and test

  Many organizations use build and release pipelines to automate and standardize the processes for building and deploying code. Release pipelines let development teams make iterative changes to sections of code quickly and at scale. The

  teams won't need to spend large amounts of time redeploying or upgrading existing environments.

  Using release pipelines also lets teams promote code from development environments, through testing environments, and ultimately into production. As part of automation, development teams should include security tools that run scripted,

  automated tests when deploying code into testing environments. The tests should include unit testing on application features to check for vulnerabilities or public endpoints. Testing ensures intentional access.

  Dynamic application security testing (DAST)

  In a classical waterfall development model, security was typically introduced at the last step, right before going to production. One of the most popular security approaches is penetration testing or pen testing. Penetration testing lets a team

  look at the application from a black-box security perspective, as in, closest to an attacker mindset.

  Reference:

  https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/secure/devsecops-controls

  https://learn.microsoft.com/en-us/security/benchmark/azure/mcsb-devops-security

• Question 146:

  HOTSPOT

  You have an Azure subscription and an on-premises datacenter. The datacenter contains 100 servers that run Windows Server. All the servers are backed up to a Recovery Services vault by using Azure Backup and the Microsoft Azure Recovery Services (MARS) agent.

  You need to design a recovery solution for ransomware attacks that encrypt the on-premises servers. The solution must follow Microsoft Security Best Practices and protect against the following risks:

  1.

  A compromised administrator account used to delete the backups from Azure Backup before encrypting the servers

  2.

  A compromised administrator account used to disable the backups on the MARS agent before encrypting the servers

  What should you use for each risk? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: Soft delete of backups

  How to block intentional or unintentional deletion of backup data?

  Enable Soft delete is enabled to protect backups from accidental or malicious deletes.

  Soft delete is a useful feature that helps you deal with data loss. Soft delete retains backup data for 14 days, allowing the recovery of that backup item before it's permanently lost.

  Box 2: Multi-user authorization by using Resource Guard

  Ensure Multi-user authorization (MUA) is enabled for an additional layer of protection.

  MUA for Azure Backup uses a new resource called Resource Guard to ensure critical operations, such as disabling soft delete, stopping and deleting backups, or reducing retention of backup policies, are performed only with applicable

  authorization.

  Reference: https://learn.microsoft.com/en-us/azure/backup/protect-backups-from-ransomware-faq

• Question 147:

  DRAG DROP

  You have a Microsoft 365 subscription.

  You need to recommend a security solution to monitor the following activities:

  1.

  User accounts that were potentially compromised

  2.

  Users performing bulk file downloads from Microsoft SharePoint Online

  What should you include in the recommendation for each activity? To answer, drag the appropriate components to the correct activities. Each component may be used once, more than once, or not at all. You may need to drag the split bar

  between panes or scroll to view content.

  NOTE: Each correct selection is worth one point.

  Select and Place:

  

  Correct Answer:

  

  Box 1: Azure Active Directory (Azure AD) Identity Protection

  Risk detections in Azure AD Identity Protection include any identified suspicious actions related to user accounts in the directory. Risk detections (both user and sign-in linked) contribute to the overall user risk score that is found in the Risky

  Users report.

  Identity Protection provides organizations access to powerful resources to see and respond quickly to these suspicious actions.

  Note:

  Premium sign-in risk detections include:

  *

  Token Issuer Anomaly - This risk detection indicates the SAML token issuer for the associated SAML token is potentially compromised. The claims included in the token are unusual or match known attacker patterns.

  *

  Suspicious inbox manipulation rules - This detection is discovered by Microsoft Defender for Cloud Apps. This detection profiles your environment and triggers alerts when suspicious rules that delete or move messages or folders are set on a user's inbox. This detection may indicate that the user's account is compromised, that messages are being intentionally hidden, and that the mailbox is being used to distribute spam or malware in your organization.

  *

  Etc.

  Incorrect:

  Not: Microsoft 365 Defender for Cloud

  Part of your incident investigation can include user accounts. You can see the details of user accounts identified in the alerts of an incident in the Microsoft 365 Defender portal from Incidents and alerts > incident > Users.

  Box 2: Microsoft 365 Defender for App

  Defender for Cloud apps detect mass download (data exfiltration) policy

  Detect when a certain user accesses or downloads a massive number of files in a short period of time.

  Reference: https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/concept-identity-protection-risks https://docs.microsoft.com/en-us/defender-cloud-apps/policies-threat-protection#detect-mass-download-data-exfiltration https://docs.microsoft.com/en-us/microsoft-365/security/defender/investigate-users

• Question 148:

  DRAG DROP

  Your company has Microsoft 365 E5 licenses and Azure subscriptions.

  The company plans to automatically label sensitive data stored in the following locations:

  1.

  Microsoft SharePoint Online

  2.

  Microsoft Exchange Online

  3.

  Microsoft Teams You need to recommend a strategy to identify and protect sensitive data. Which scope should you recommend for the sensitivity label policies? To answer, drag the appropriate scopes to the correct locations. Each scope may only be used once, more than once, or not at all. You may need to drag the split bar

  between panes or scroll to view content. NOTE: Each correct selection is worth one point. Select and Place:

  

  Correct Answer:

  

  Box 1: Groups and sites SharePoint online handles sites.

  Azure Active Directory (Azure AD) supports applying sensitivity labels published by the Microsoft Purview compliance portal to Microsoft 365 groups. Sensitivity labels apply to group across services like Outlook, Microsoft Teams, and SharePoint.

  Box 2: Schematized data assets Label travels with the data: The sensitivity labels created in Microsoft Purview Information Protection can also be extended to the Microsoft Purview Data Map, SharePoint, Teams, Power BI, and SQL. When you apply a label on an office document and then scan it into the Microsoft Purview Data Map, the label will be applied to the data asset.

  After you enable and configure sensitivity labels for containers, users can additionally see and apply sensitivity labels to Microsoft team sites, Microsoft 365 groups, and SharePoint sites.

  Box 3: Files and emails

  Exchange Online handles files and emails.

  Reference: https://docs.microsoft.com/en-us/azure/purview/create-sensitivity-label

  https://docs.microsoft.com/en-us/azure/active-directory/enterprise-users/groups-assign-sensitivity-labels

• Question 149:

  DRAG DROP

  Your company wants to optimize ransomware incident investigations.

  You need to recommend a plan to investigate ransomware incidents based on the Microsoft Detection and Response Team (DART) approach.

  Which three actions should you recommend performing in sequence in the plan? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  Correct Answer:

  

  Step 1: Assess the current situation and identify the scope.

  The DART approach to conducting ransomware incident investigations

  You should make every effort to determine how the adversary gained access to your assets so that vulnerabilities can be remediated. Otherwise, it is highly likely that the same type of attack will take place again in the future. In some cases,

  the threat actor takes steps to cover their tracks and destroy evidence, so it is possible that the entire chain of events may not be evident.

  The following are three key steps in DART ransomware investigations:

  1. Assess the current situation Understand the scope

  What initially made you aware of a ransomware attack?

  What time/date did you first learn of the incident?

  What logs are available and is there any indication that the actor is currently accessing systems?

  Step 2: Identify which line-of-business (LOB) apps are unavailable due to a ransomware incident.

  2. Identify the affected line-of-business (LOB) apps Get systems back online

  Does the application require an identity?

  Are backups of the application, configuration, and data available?

  Are the content and integrity of backups regularly verified using a restore exercise?

  Step 3: Identify the compromise recovery process.

  3. Determine the compromise recovery (CR) process Remove attacker control from the environment

  Reference: https://learn.microsoft.com/en-us/security/compass/incident-response-playbook-dart-ransomware-approach

• Question 150:

  HOTSPOT

  You need to recommend an identity security solution for the Azure AD tenant of Litware. The solution must meet the identity requirements and the regulatory compliance requirements.

  What should you recommend? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: Azure AD administrative units

  Implement delegated management of users and groups in the Azure AD tenant of Litware, including support for:

  * The delegation of user management based on business units

  Without Azure AD administrative units, assigning a user to the User Administrator role in Azure AD gives them rights to manage all Azure AD users. With administrative units, the user is delegated the same role, User Administrator, but that role only applies to the specified administrative unit. The administrative unit contains the users and groups that are under the scope of management. Box 2: Enable password hash synchronization in the Azure AD Connect deployment Existing environment: Azure AD Connect is used to implement pass-through authentication. Password hash synchronization

  Risk detections like leaked credentials require the presence of password hashes for detection to occur.

  Reference: https://4sysops.com/archives/an-introduction-to-azure-ad-administrative-units/

  https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/concept-identity-protection-risks#password-hash-synchronization