Microsoft Microsoft Certifications SC-100 Questions & Answers

• Question 71:

  You have a Microsoft 365 E5 subscription.

  You are designing a solution to protect confidential data in Microsoft SharePoint Online sites that contain more than one million documents.

  You need to recommend a solution to prevent Personally Identifiable Information (Pll) from being shared.

  Which two components should you include in the recommendation? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. data loss prevention (DLP) policies

  B. retention label policies

  C. eDiscovery cases

  D. sensitivity label policies

  Correct Answer: AD

  A: Data loss prevention in Office 365. Data loss prevention (DLP) helps you protect sensitive information and prevent its inadvertent disclosure. Examples of sensitive information that you might want to prevent from leaking outside your

  organization include financial data or personally identifiable information (PII) such as credit card numbers, social security numbers, or health records. With a data loss prevention (DLP) policy, you can identify, monitor, and automatically

  protect sensitive information across Office 365.

  D: Sensitivity labels

  Sensitivity labels from Microsoft Purview Information Protection let you classify and protect your organization's data without hindering the productivity of users and their ability to collaborate.

  Plan for integration into a broader information protection scheme. On top of coexistence with OME, sensitivity labels can be used along-side capabilities like Microsoft Purview Data Loss Prevention (DLP) and Microsoft Defender for Cloud

  Apps.

  Incorrect:

  Not B: Retention labels help you retain what you need and delete what you don't at the item level (document or email). They are also used to declare an item as a record as part of a records management solution for your Microsoft 365 data.

  Not C: eDiscovery cases in eDiscovery (Standard) and eDiscovery (Premium) let you associate specific searches and exports with a specific investigation. You can also assign members to a case to control who can access the case and view

  the contents of the case. Place content locations on legal hold.

  Reference: https://motionwave.com.au/keeping-your-confidential-data-secure-with-microsoft-office-365/ https://docs.microsoft.com/en-us/microsoft-365/solutions/information-protection-deploy-protect-information?view=o365-worldwide#sensitivity-labels

• Question 72:

  You have a customer that has a Microsoft 365 subscription and uses the Free edition of Azure Active Directory (Azure AD)

  The customer plans to obtain an Azure subscription and provision several Azure resources.

  You need to evaluate the customer's security environment.

  What will necessitate an upgrade from the Azure AD Free edition to the Premium edition?

  A. Azure AD Privileged Identity Management (PIM)

  B. role-based authorization

  C. resource-based authorization

  D. Azure AD Multi-Factor Authentication

  Correct Answer: D

  Multifactor authentication (MFA), an important component of the Zero Trust Model, is missing in Azure AD Free edition.

  

• Question 73:

  Reference: https://www.microsoft.com/en-us/security/business/identity-access/azure-active-directory-pricing

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Azure subscription that has Microsoft Defender for Cloud enabled.

  You are evaluating the Azure Security Benchmark V3 report.

  In the Secure management ports controls, you discover that you have 0 out of a potential 8 points.

  You need to recommend configurations to increase the score of the Secure management ports controls.

  Solution: You recommend enabling adaptive network hardening.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  Instead: You recommend enabling just-in-time (JIT) VM access on all virtual machines.

  Note:

  Secure management ports - Brute force attacks often target management ports. Use these recommendations to reduce your exposure with tools like just-in-time VM access and network security groups.

  Recommendations:

  -Internet-facing virtual machines should be protected with network security groups

  -

  Management ports of virtual machines should be protected with just-in-time network access control

  -

  Management ports should be closed on your virtual machines Reference: https://docs.microsoft.com/en-us/azure/defender-for-cloud/secure-score-security-controls

• Question 74:

  Your company has devices that run either Windows 10, Windows 11, or Windows Server.

  You are in the process of improving the security posture of the devices.

  You plan to use security baselines from the Microsoft Security Compliance Toolkit.

  What should you recommend using to compare the baselines to the current device configurations?

  A. Microsoft Intune

  B. Local Group Policy Object (LGPO)

  C. Windows Autopilot

  D. Policy Analyzer

  Correct Answer: D

  Microsoft Security Compliance Toolkit 1.0, Policy Analyzer.

  The Policy Analyzer is a utility for analyzing and comparing sets of Group Policy Objects (GPOs). Its main features include:

  Highlight when a set of Group Policies has redundant settings or internal inconsistencies.

  Highlight the differences between versions or sets of Group Policies.

  Compare GPOs against current local policy and local registry settings

  Export results to a Microsoft Excel spreadsheet

  Policy Analyzer lets you treat a set of GPOs as a single unit. This treatment makes it easy to determine whether particular settings are duplicated across the GPOs or are set to conflicting values. Policy Analyzer also lets you capture a

  baseline and then compare it to a snapshot taken at a later time to identify changes anywhere across the set.

  Note: The Security Compliance Toolkit (SCT) is a set of tools that allows enterprise security administrators to download, analyze, test, edit, and store Microsoft-recommended security configuration baselines for Windows and other Microsoft

  products.

  The SCT enables administrators to effectively manage their enterprise's Group Policy Objects (GPOs). Using the toolkit, administrators can compare their current GPOs with Microsoft-recommended GPO baselines or other baselines, edit

  them, store them in GPO backup file format, and apply them broadly through Active Directory or individually through local policy.

  Security Compliance Toolkit Tools:

  Policy Analyzer

  Local Group Policy Object (LGPO)

  Set Object Security

  GPO to Policy Rules

  Incorrect:

  Not B: Local Group Policy Object (LGPO)

  What is the Local Group Policy Object (LGPO) tool?

  LGPO.exe is a command-line utility that is designed to help automate management of Local Group Policy. Using local policy gives administrators a simple way to verify the effects of Group Policy settings, and is also useful for managing non-

  domain-joined systems. LGPO.exe can import and apply settings from Registry Policy (Registry.pol) files, security templates, Advanced Auditing backup files, as well as from formatted “LGPO text” files. It can export local policy to a GPO

  backup. It can export the contents of a Registry Policy file to the “LGPO text” format that can then be edited, and can build a Registry Policy file from an LGPO text file.

  Reference: https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-security-configuration-framework/security-compliance-toolkit-10

• Question 75:

  You have an Azure subscription that has Microsoft Defender for Cloud enabled.

  You are evaluating the Azure Security Benchmark V3 report as shown in the following exhibit.

  

  You need to verify whether Microsoft Defender for servers is installed on all the virtual machines that run Windows. Which compliance control should you evaluate?

  A. Asset Management

  B. Posture and Vulnerability Management

  C. Data Protection

  D. Endpoint Security

  E. Incident Response

  Correct Answer: D

  Microsoft Defender for servers compliance control installed on Windows

  Defender for clout "Endpoint Security" azure security benchmark v3

  Endpoint Security covers controls in endpoint detection and response, including use of endpoint detection and response (EDR) and anti-malware service for endpoints in Azure environments.

  Security Principle: Enable Endpoint Detection and Response (EDR) capabilities for VMs and integrate with SIEM and security operations processes.

  Azure Guidance: Azure Defender for servers (with Microsoft Defender for Endpoint integrated) provides EDR capability to prevent, detect, investigate, and respond to advanced threats.

  Use Microsoft Defender for Cloud to deploy Azure Defender for servers for your endpoint and integrate the alerts to your SIEM solution such as Azure Sentinel.

  Incorrect:

  Not A: Asset Management covers controls to ensure security visibility and governance over Azure resources, including recommendations on permissions for security personnel, security access to asset inventory, and managing approvals for

  services and resources (inventory, track, and correct).

  Not B: Posture and Vulnerability Management focuses on controls for assessing and improving Azure security posture, including vulnerability scanning, penetration testing and remediation, as well as security configuration tracking, reporting,

  and correction in Azure resources.

  Not C: Data Protection covers control of data protection at rest, in transit, and via authorized access mechanisms, including discover, classify, protect, and monitor sensitive data assets using access control, encryption, key and certificate

  management in Azure.

  Not E: Incident Response covers controls in incident response life cycle - preparation, detection and analysis, containment, and post-incident activities, including using Azure services such as Microsoft Defender for Cloud and Sentinel to

  automate the incident response process.

  Reference: https://docs.microsoft.com/en-us/security/benchmark/azure/security-controls-v3-endpoint-security

• Question 76:

  You have an Azure subscription that is used as an Azure landing zone for an application. You need to evaluate the security posture of all the workloads in the landing zone. What should you do first?

  A. Configure Continuous Integration/Continuous Deployment (CI/CD) vulnerability scanning.

  B. Obtain Azure AD Premium Plan 2 licenses.

  C. Add Microsoft Sentinel data connectors.

  D. Enable the Defender plan for all resource types in Microsoft Defender for Cloud.

  Correct Answer: D

  You can evaluate security postures by using Microsoft Defender for Cloud.

  Defender for Cloud continually assesses your resources, subscriptions, and organization for security issues. It then aggregates all the findings into a single score so that you can tell, at a glance, your current security situation: the higher the

  score, the lower the identified risk level.

  

  Note: Security in the Azure landing zone accelerator

  Security is at the core of the Azure landing zone accelerator. As part of the implementation, many tools and controls are deployed to help organizations quickly achieve a security baseline.

  For example, the following are included:

  Tools:

  Microsoft Defender for Cloud, standard or free tier

  Microsoft Sentinel

  Azure DDoS standard protection plan (optional)

  Azure Firewall

  Web Application Firewall (WAF)

  Privileged Identity Management (PIM)

  Incorrect:

  Not C: Microsoft Sentinel uses data from Microsoft Defender for Cloud, so would need setup Defender for Cloud first.

  Reference: https://learn.microsoft.com/en-us/training/modules/evaluate-security-posture-recommend-technical-strategies-to-manage-risk/3-postures-use-microsoft-defender-for-cloud https://learn.microsoft.com/en-us/training/modules/evaluate-security-posture-recommend-technical-strategies-to-manage-risk/5-design-security-for-azure-landing-zone

• Question 77:

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You are designing a security strategy for providing access to Azure App Service web apps through an Azure Front Door instance.

  You need to recommend a solution to ensure that the web apps only allow access through the Front Door instance.

  Solution: You recommend access restrictions based on HTTP headers that have the Front Door ID.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: A

  Restrict access to a specific Azure Front Door instance.

  Traffic from Azure Front Door to your application originates from a well-known set of IP ranges defined in the AzureFrontDoor.Backend service tag. Using a service tag restriction rule, you can restrict traffic to only originate from Azure Front

  Door. To ensure traffic only originates from your specific instance, you will need to further filter the incoming requests based on the unique http header that Azure Front Door sends.

  

  Reference: https://docs.microsoft.com/en-us/azure/app-service/app-service-ip-restrictions#managing-access-restriction-rules

• Question 78:

  Your company plans to provision blob storage by using an Azure Storage account. The blob storage will be accessible from 20 application servers on the internet.

  You need to recommend a solution to ensure that only the application servers can access the storage account.

  What should you recommend using to secure the blob storage?

  A. managed rule sets in Azure Web Application Firewall (WAF) policies

  B. inbound rules in network security groups (NSGs)

  C. firewall rules for the storage account

  D. inbound rules in Azure Firewall

  E. service tags in network security groups (NSGs)

  Correct Answer: C

  Configure Azure Storage firewalls and virtual networks.

  To secure your storage account, you should first configure a rule to deny access to traffic from all networks (including internet traffic) on the public endpoint, by default. Then, you should configure rules that grant access to traffic from specific

  VNets. You can also configure rules to grant access to traffic from selected public internet IP address ranges, enabling connections from specific internet or on-premises clients. This configuration enables you to build a secure network

  boundary for your applications.

  Storage firewall rules apply to the public endpoint of a storage account. You don't need any firewall access rules to allow traffic for private endpoints of a storage account. The process of approving the creation of a private endpoint grants

  implicit access to traffic from the subnet that hosts the private endpoint.

  Incorrect:

  Not B: You can use an Azure network security group to filter network traffic to and from Azure resources in an Azure virtual network. A network security group contains security rules that allow or deny inbound network traffic to, or outbound

  network traffic from, several types of Azure resources. For each rule, you can specify source and destination, port, and protocol.

  Not E: A service tag represents a group of IP address prefixes from a given Azure service. Microsoft manages the address prefixes encompassed by the service tag and automatically updates the service tag as addresses change, minimizing

  the complexity of frequent updates to network security rules.

  Reference: https://docs.microsoft.com/en-us/azure/storage/common/storage-network-security

• Question 79:

  Your company has an Azure subscription that has enhanced security enabled for Microsoft Defender for Cloud.

  The company signs a contract with the United States government.

  You need to review the current subscription for NIST 800-53 compliance.

  What should you do first?

  A. From Defender for Cloud, review the secure score recommendations.

  B. From Microsoft Sentinel, configure the Microsoft Defender for Cloud data connector.

  C. From Defender for Cloud, review the Azure security baseline for audit report.

  D. From Defender for Cloud, add a regulatory compliance standard.

  Correct Answer: D

  Add a regulatory standard to your dashboard

  The following steps explain how to add a package to monitor your compliance with one of the supported regulatory standards.

  Add a standard to your Azure resources

  1.

  From Defender for Cloud's menu, select Regulatory compliance to open the regulatory compliance dashboard. Here you can see the compliance standards currently assigned to the currently selected subscriptions.

  2.

  From the top of the page, select Manage compliance policies. The Policy Management page appears.

  3.

  Select the subscription or management group for which you want to manage the regulatory compliance posture.

  4.

  To add the standards relevant to your organization, expand the Industry and regulatory standards section and select Add more standards.

  5.

  From the Add regulatory compliance standards page, you can search for any of the available standards:

  6.

  Select Add and enter all the necessary details for the specific initiative such as scope, parameters, and remediation.

  7.

  From Defender for Cloud's menu, select Regulatory compliance again to go back to the regulatory compliance dashboard.

  Your new standard appears in your list of Industry and regulatory standards.

  Note: Customize the set of standards in your regulatory compliance dashboard.

  

  Microsoft Defender for Cloud continually compares the configuration of your resources with requirements in industry standards, regulations, and benchmarks. The regulatory compliance dashboard provides insights into your compliance posture based on how you're meeting specific compliance requirements. Reference: https://docs.microsoft.com/en-us/azure/defender-for-cloud/update-regulatory-compliance-packages

• Question 80:

  You have a Microsoft 365 E5 subscription.

  You need to recommend a solution to add a watermark to email attachments that contain sensitive data.

  What should you include in the recommendation?

  A. Microsoft Defender for Cloud Apps

  B. insider risk management

  C. Microsoft Information Protection

  D. Azure Purview

  Correct Answer: C

  https://docs.microsoft.com/en-us/microsoft-365/compliance/sensitivity-labels?view=o365-worldwide like for example You can use sensitivity labels to:

  Provide protection settings that include encryption and content markings. For example, apply a "Confidential" label to a document or email, and that label encrypts the content and applies a "Confidential" watermark. Content markings include

  headers and footers as well as watermarks, and encryption can also restrict what actions authorized people can take on the content.

  Protect content in Office apps across different platforms and devices. Supported by Word, Excel, PowerPoint, and Outlook on the Office desktop apps and Office on the web. Supported on Windows, macOS, iOS, and Android.

  Protect content in third-party apps and services by using Microsoft Defender for Cloud Apps. With Defender for Cloud Apps, you can detect, classify, label, and protect content in third-party apps and services, such as SalesForce, Box, or

  DropBox, even if the third-party app or service does not read or support sensitivity labels.