Microsoft Microsoft Certifications SC-100 Questions & Answers

• Question 51:

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You are designing the encryption standards for data at rest for an Azure resource.

  You need to provide recommendations to ensure that the data at rest is encrypted by using AES-256 keys. The solution must support rotating the encryption keys monthly.

  Solution: For blob containers in Azure Storage, you recommend encryption that uses Microsoft-managed keys within an encryption scope.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  Need to use customer-managed keys instead.

  Note: Automated key rotation in Key Vault allows users to configure Key Vault to automatically generate a new key version at a specified frequency. You can use rotation policy to configure rotation for each individual key. Our recommendation is to rotate encryption keys at least every two years to meet cryptographic best practices. This feature enables end-to-end zero-touch rotation for encryption at rest for Azure services with customer-managed key (CMK) stored in Azure Key Vault. Please refer to specific Azure service documentation to see if the service covers end

  to-end rotation.

  Reference: https://docs.microsoft.com/en-us/azure/key-vault/keys/how-to-configure-key-rotation

• Question 52:

  Your company has an Azure subscription that has enhanced security enabled for Microsoft Defender for Cloud.

  The company signs a contract with the United States government.

  You need to review the current subscription for NIST 800-53 compliance.

  What should you do first?

  A. From Azure Policy, assign a built-in initiative that has a scope of the subscription.

  B. From Azure Policy, assign a built-in policy definition that has a scope of the subscription.

  C. From Defender for Cloud, review the Azure security baseline for audit report.

  D. From Microsoft Defender for Cloud Apps, create an access policy for cloud applications.

  Correct Answer: A

  How are regulatory compliance standards represented in Defender for Cloud?

  Industry standards, regulatory standards, and benchmarks are represented in Defender for Cloud's regulatory compliance dashboard. Each standard is an initiative defined in Azure Policy.

  Reference:

  https://learn.microsoft.com/en-us/azure/defender-for-cloud/update-regulatory-compliance-packages

• Question 53:

  You have an Azure subscription that has Microsoft Defender for Cloud enabled.

  You need to enforce ISO 27001:2013 standards for the subscription. The solution must ensure that noncompliant resources are remediated automatically.

  What should you use?

  A. Azure Policy

  B. Azure Blueprints

  C. the regulatory compliance dashboard in Defender for Cloud

  D. Azure role-based access control (Azure RBAC)

  Correct Answer: A

  Control mapping of the ISO 27001 Shared Services blueprint sample

  The following mappings are to the ISO 27001:2013 controls. Use the navigation on the right to jump directly to a specific control mapping. Many of the mapped controls are implemented with an Azure Policy initiative.

  Open Policy in the Azure portal and select the Definitions page. Then, find and select the [Preview] Audit ISO 27001:2013 controls and deploy specific VM Extensions to support audit requirements built-in policy initiative.

  Note: Security Center can now auto provision the Azure Policy's Guest Configuration extension (in preview)

  Azure Policy can audit settings inside a machine, both for machines running in Azure and Arc connected machines. The validation is performed by the Guest Configuration extension and client.

  With this update, you can now set Security Center to automatically provision this extension to all supported machines.

  Enforcing a secure configuration, based on a specific recommendation, is offered in two modes:

  Using the Deny effect of Azure Policy, you can stop unhealthy resources from being created

  Using the Enforce option, you can take advantage of Azure Policy's DeployIfNotExist effect and automatically remediate non-compliant resources upon creation Reference: https://docs.microsoft.com/en-us/azure/governance/blueprints/samples/iso27001-shared/control-mapping https://docs.microsoft.com/en-us/azure/defender-for-cloud/release-notes-archive https://docs.microsoft.com/en-us/azure/defender-for-cloud/prevent-misconfigurations

• Question 54:

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Azure subscription that has Microsoft Defender for Cloud enabled. You are evaluating the Azure Security Benchmark V3 report.

  In the Secure management ports controls, you discover that you have 0 out of a potential 8 points.

  You need to recommend configurations to increase the score of the Secure management ports controls.

  Solution: You recommend enabling the VMAccess extension on all virtual machines.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  Instead: You recommend enabling just-in-time (JIT) VM access on all virtual machines.

  Note:

  Secure management ports - Brute force attacks often target management ports. Use these recommendations to reduce your exposure with tools like just-in-time VM access and network security groups.

  Recommendations:

  -Internet-facing virtual machines should be protected with network security groups

  -

  Management ports of virtual machines should be protected with just-in-time network access control

  -

  Management ports should be closed on your virtual machines Reference: https://docs.microsoft.com/en-us/azure/defender-for-cloud/secure-score-security-controls

• Question 55:

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  Your on-premises network contains an e-commerce web app that was developed in Angular and Node,js. The web app uses a MongoDB database. You plan to migrate the web app to Azure. The solution architecture team proposes the following architecture as an Azure landing zone.

  

  You need to provide recommendations to secure the connection between the web app and the database. The solution must follow the Zero Trust model.

  Solution: You recommend implementing Azure Key Vault to store credentials.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  Instead use solution: You recommend creating private endpoints for the web app and the database layer.

  Note:

  How to Use Azure Private Endpoints to Restrict Public Access to WebApps.

  As an Azure administrator or architect, you are sometimes asked the question: “How can we safely deploy internal business applications to Azure App Services?”

  These applications characteristically are:

  Not accessible from the public internet.

  Accessible from within the on-premises corporate network

  Accessible via an authorized VPN client from outside the corporate network.

  For such scenarios, we can use Azure Private Links, which enables private and secure access to Azure PaaS services over Azure Private Endpoints, along with the Site-to-Site VPN, Point-to-Site VPN, or the Express Route. Azure Private

  Endpoint is a read-only network interface service associated with the Azure PAAS Services. It allows you to bring deployed sites into your virtual network, limiting access to them at the network level.

  It uses one of the private IP addresses from your Azure VNet and associates it with the Azure App Services. These services are called Private Link resources. They can be Azure Storage, Azure Cosmos DB, SQL, App Services Web App,

  your own / partner owned services, Azure Backups, Event Grids, Azure Service Bus, or Azure Automations.

  Reference: https://www.varonis.com/blog/securing-access-azure-webapps

• Question 56:

  You have a Microsoft 365 subscription and an Azure subscription. Microsoft 365 Defender and Microsoft Defender for Cloud are enabled.

  The Azure subscription contains 50 virtual machines. Each virtual machine runs different applications on Windows Server 2019.

  You need to recommend a solution to ensure that only authorized applications can run on the virtual machines. If an unauthorized application attempts to run or be installed, the application must be blocked automatically until an administrator

  authorizes the application.

  Which security control should you recommend?

  A. adaptive application controls in Defender for Cloud

  B. app protection policies in Microsoft Endpoint Manager

  C. app discovery anomaly detection policies in Microsoft Defender for Cloud Apps

  D. Azure Security Benchmark compliance controls in Defender for Cloud

  Correct Answer: A

  Adaptive application controls are an intelligent and automated solution for defining allowlists of known-safe applications for your machines.

  Often, organizations have collections of machines that routinely run the same processes. Microsoft Defender for Cloud uses machine learning to analyze the applications running on your machines and create a list of the known-safe software.

  Allowlists are based on your specific Azure workloads, and you can further customize the recommendations using the instructions below.

  When you've enabled and configured adaptive application controls, you'll get security alerts if any application runs other than the ones you've defined as safe.

  Incorrect:

  Not B: App protection policies (APP) are rules that ensure an organization's data remains safe or contained in a managed app. A policy can be a rule that is enforced when the user attempts to access or move "corporate" data, or a set of

  actions that are prohibited or monitored when the user is inside the app. A managed app is an app that has app protection policies applied to it, and can be managed by Intune.

  Not C: Cloud Discovery anomaly detection policy reference. A Cloud Discovery anomaly detection policy enables you to set up and configure continuous monitoring of unusual increases in cloud application usage. Increases in downloaded

  data, uploaded data, transactions, and users are considered for each cloud application.

  Not D: The Azure Security Benchmark (ASB) provides prescriptive best practices and recommendations to help improve the security of workloads, data, and services on Azure. This benchmark is part of a set of holistic security guidance.

  Reference: https://docs.microsoft.com/en-us/azure/defender-for-cloud/adaptive-application-controls

  https://docs.microsoft.com/en-us/mem/intune/apps/app-protection-policy

  https://docs.microsoft.com/en-us/defender-cloud-apps/cloud-discovery-anomaly-detection-policy

  https://docs.microsoft.com/en-us/security/benchmark/azure/overview

• Question 57:

  Your company has an Azure subscription that has enhanced security enabled for Microsoft Defender for Cloud.

  The company signs a contract with the United States government.

  You need to review the current subscription for NIST 800-53 compliance.

  What should you do first?

  A. From Azure Policy, assign a built-in initiative that has a scope of the subscription.

  B. From Microsoft Sentinel, configure the Microsoft Defender for Cloud data connector.

  C. From Defender for Cloud, review the Azure security baseline for audit report.

  D. From Microsoft Defender for Cloud Apps, create an access policy for cloud applications.

  Correct Answer: A

  The Azure Policy Regulatory Compliance built-in initiative definition maps to compliance domains and controls in NIST SP 800-53 Rev. 5.

  The following mappings are to the NIST SP 800-53 Rev. 5 controls. Use the navigation on the right to jump directly to a specific compliance domain. Many of the controls are implemented with an Azure Policy initiative definition. To review the complete initiative definition, open Policy in the Azure portal and select the Definitions page. Then, find and select the NIST SP 800-53 Rev. 5 Regulatory Compliance built-in initiative definition. Reference: https://docs.microsoft.com/en-us/azure/governance/policy/samples/gov-nist-sp-800-53-r5

• Question 58:

  For an Azure deployment, you are designing a security architecture based on the Microsoft Cloud Security Benchmark.

  You need to recommend a best practice for implementing service accounts for Azure API management.

  What should you include in the recommendation?

  A. application registrations in Azure AD

  B. managed identities in Azure

  C. Azure service principals with usernames and passwords

  D. device registrations in Azure AD

  E. Azure service principals with certificate credentials

  Correct Answer: B

  IM-3: Manage application identities securely and automatically Features Managed Identities Description: Data plane actions support authentication using managed identities.

  Configuration Guidance: Use a Managed Service Identity generated by Azure Active Directory (Azure AD) to allow your API Management instance to easily and securely access other Azure AD-protected resources, such as Azure Key Vault instead of using service principals. Managed identity credentials are fully managed, rotated, and protected by the platform, avoiding hard-coded credentials in source code or configuration files.

  Reference: https://learn.microsoft.com/en-us/security/benchmark/azure/baselines/api-management-security-baseline

• Question 59:

  You have an Azure AD tenant that syncs with an Active Directory Domain Services (AD DS) domain. Client computers run Windows and are hybrid-joined to Azure AD.

  You are designing a strategy to protect endpoints against ransomware. The strategy follows Microsoft Security Best Practices.

  You plan to remove all the domain accounts from the Administrators groups on the Windows computers.

  You need to recommend a solution that will provide users with administrative access to the Windows computers only when access is required. The solution must minimize the lateral movement of ransomware attacks if an administrator

  account on a computer is compromised.

  What should you include in the recommendation?

  A. Local Administrator Password Solution (LAPS)

  B. Azure AD Identity Protection

  C. Azure AD Privileged Identity Management (PIM)

  D. Privileged Access Workstations (PAWs)

  Correct Answer: A

  Microsoft's "Local Administrator Password Solution" (LAPS) provides management of local administrator account passwords for domain-joined computers. Passwords are randomized and stored in Active Directory (AD), protected by ACLs, so only eligible users can read it or request its reset.

  Microsoft LAPS is short for Microsoft Local Administrator Password Solution. When installed and enabled on domain-joined computers it takes over the management of passwords of local accounts. Passwords are automatically changed to random characters that meet the domain's password policy requirements at a frequency that you define through Group Policy.

  The passwords are stored in a protected “confidential” attribute on the Computer object in AD. Unlike most other attributes which can be read by all domain users by default, the confidential attributes require extra privileges to be granted in order to read them, thus securing the managed passwords.

  Incorrect: Not B: Integrate on-premises Active Directory domains with Azure Active Directory Validate security configuration and policy, Actively monitor Azure AD for signs of suspicious activity

  Consider using Azure AD Premium P2 edition, which includes Azure AD Identity Protection. Identity Protection uses adaptive machine learning algorithms and heuristics to detect anomalies and risk events that may indicate that an identity has been compromised. For example, it can detect potentially unusual activity such as irregular sign-in activities, sign-ins from unknown sources or from IP addresses with suspicious activity, or sign-ins from devices that may be infected. Identity Protection uses this data to generate reports and alerts that enable you to investigate these risk events and take appropriate action.

  Not C: Azure AD PIM is a service in Azure AD that enables you to manage, control, and monitor access to resources in Azure AD, Azure, and other Microsoft Online Services such as Microsoft 365 or Microsoft Intune.

  Not D: Privileged Access Workstations (PAWs) provide a dedicated operating system for sensitive tasks that is protected from Internet attacks and threat vectors. Separating these sensitive tasks and accounts from the daily use workstations and devices provides very strong protection from phishing attacks, application and OS vulnerabilities, various impersonation attacks, and credential theft attacks such as keystroke logging, Pass-the-Hash, and Pass-The-Ticket.

  Reference: https://craighays.com/microsoft-laps/ https://learn.microsoft.com/en-us/azure/architecture/reference-architectures/identity/azure-ad

• Question 60:

  Your company has a Microsoft 365 E5 subscription.

  Users use Microsoft Teams, Exchange Online, SharePoint Online, and OneDrive for sharing and collaborating.

  The company identifies protected health information (PHI) within stored documents and communications.

  What should you recommend using to prevent the PHI from being shared outside the company?

  A. sensitivity label policies

  B. data loss prevention (DLP) policies

  C. insider risk management policies

  D. retention policies

  Correct Answer: B

  DLP policies in Microsoft 365 allow you to identify, monitor, and protect sensitive information, such as PHI, within your organization. You can create DLP policies that identify PHI within stored documents and communications and then set rules to prevent the PHI from being shared outside the company. For example, you can create a DLP policy that blocks emails containing PHI from being sent to external recipients, or that prevents documents containing PHI from being shared outside the organization.

  Sensitivity label policies allow you to classify and protect sensitive information, but they do not specifically prevent the information from being shared outside the organization. Insider risk management policies are designed to detect and mitigate risks posed by insider threats, but they are not directly related to preventing the sharing of sensitive information. Retention policies allow you to specify how long certain types of information should be retained, but they do not prevent the sharing of sensitive information.