Microsoft Microsoft Certifications SC-100 Questions & Answers

• Question 81:

  You have Microsoft Defender for Cloud assigned to Azure management groups.

  You have a Microsoft Sentinel deployment.

  During the triage of alerts, you require additional information about the security events, including suggestions for remediation.

  Which two components can you use to achieve the goal? Each correct answer presents a complete solution.

  NOTE: Each correct selection is worth one point.

  A. Microsoft Sentinel threat intelligence workbooks

  B. Microsoft Sentinel notebooks

  C. threat intelligence reports in Defender for Cloud

  D. workload protections in Defender for Cloud

  Correct Answer: AC

  A: Workbooks provide insights about your threat intelligence

  Workbooks provide powerful interactive dashboards that give you insights into all aspects of Microsoft Sentinel, and threat intelligence is no exception. You can use the built-in Threat Intelligence workbook to visualize key information about

  your threat intelligence, and you can easily customize the workbook according to your business needs. You can even create new dashboards combining many different data sources so you can visualize your data in unique ways. Since

  Microsoft Sentinel workbooks are based on Azure Monitor workbooks, there is already extensive documentation available, and many more templates.

  C: What is a threat intelligence report?

  Defender for Cloud's threat protection works by monitoring security information from your Azure resources, the network, and connected partner solutions. It analyzes this information, often correlating information from multiple sources, to

  identify threats.

  Defender for Cloud has three types of threat reports, which can vary according to the attack. The reports available are:

  Activity Group Report: provides deep dives into attackers, their objectives, and tactics.

  Campaign Report: focuses on details of specific attack campaigns.

  Threat Summary Report: covers all of the items in the previous two reports.

  This type of information is useful during the incident response process, where there's an ongoing investigation to understand the source of the attack, the attacker's motivations, and what to do to mitigate this issue in the future.

  Incorrect:

  Not B: When to use Jupyter notebooks

  While many common tasks can be carried out in the portal, Jupyter extends the scope of what you can do with this data.

  For example, use notebooks to:

  Perform analytics that aren't provided out-of-the box in Microsoft Sentinel, such as some Python machine learning features

  Create data visualizations that aren't provided out-of-the box in Microsoft Sentinel, such as custom timelines and process trees

  Integrate data sources outside of Microsoft Sentinel, such as an on-premises data set.

  Not D: Defender for Cloud offers security alerts that are powered by Microsoft Threat Intelligence. It also includes a range of advanced, intelligent, protections for your workloads. The workload protections are provided through Microsoft

  Defender plans specific to the types of resources in your subscriptions. For example, you can enable Microsoft Defender for Storage to get alerted about suspicious activities related to your Azure Storage accounts.

  Reference: https://docs.microsoft.com/en-us/azure/sentinel/understand-threat-intelligence https://docs.microsoft.com/en-us/azure/defender-for-cloud/defender-for-cloud-introduction https://docs.microsoft.com/en-us/azure/defender-for-cloud/threat-intelligence-reports https://docs.microsoft.com/en-us/azure/sentinel/notebooks

• Question 82:

  You receive a security alert in Microsoft Defender for Cloud as shown in the exhibit. (Click the Exhibit tab.)

  

  After remediating the threat which policy definition should you assign to prevent the threat from reoccurring?

  A. Storage account public access should be disallowed

  B. Azure Key Vault Managed HSM should have purge protection enabled

  C. Storage accounts should prevent shared key access

  D. Storage account keys should not be expired

  Correct Answer: A

  Anonymous public read access to containers and blobs in Azure Storage is a convenient way to share data, but may also present a security risk. It's important to manage anonymous access judiciously and to understand how to evaluate anonymous access to your data. Operational complexity, human error, or malicious attack against data that is publicly accessible can result in costly data breaches. Microsoft recommends that you enable anonymous access only when necessary for your application scenario.

  Note: Attackers have been crawling for public containers using tools such as MicroBurst.

  Exploiting Anonymous Blob Access Now, there are thousands of articles explaining how this can be abused and how to search for insecure storage in Azure. One of the easiest way is to use MicroBurst, provide the storage account name to search for, and it’ll check if the containers exists based on a wordlist saved in the Misc/permutations.txt

  Reference: https://docs.microsoft.com/en-us/azure/storage/blobs/anonymous-read-access-prevent https://hackingthe.cloud/azure/anonymous-blob-access/

• Question 83:

  You have an on-premises network that has several legacy applications. The applications perform LDAP queries against an existing directory service.

  You are migrating the on- premises infrastructure to a cloud-only infrastructure.

  You need to recommend an identity solution for the infrastructure that supports the legacy applications. The solution must minimize the administrative effort to maintain the infrastructure.

  Which identity service should you include in the recommendation?

  A. Azure AD B2C

  B. Azure Active Directory Domain Services (Azure AD DS)

  C. Azure AD

  D. Active Directory Domain Services (AD DS)

  Correct Answer: B

  Lightweight Directory Access Protocol (LDAP) is an application protocol for working with various directory services. Directory services, such as Active Directory, store user and account information, and security information like passwords. The service then allows the information to be shared with other devices on the network. Enterprise applications such as email, customer relationship managers (CRMs), and Human Resources (HR) software can use LDAP to authenticate, access, and find information.

  Azure Active Directory (Azure AD) supports this pattern via Azure AD Domain Services (AD DS). It allows organizations that are adopting a cloud-first strategy to modernize their environment by moving off their on-premises LDAP resources

  to the cloud. The immediate benefits will be:

  Integrated with Azure AD. Additions of users and groups, or attribute changes to their objects are automatically synchronized from your Azure AD tenant to AD DS. Changes to objects in on-premises Active Directory are synchronized to

  Azure AD, and then to AD DS.

  Simplify operations. Reduces the need to manually keep and patch on-premises infrastructures. Reliable. You get managed, highly available services Reference: https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/auth-ldap

• Question 84:

  You have an Azure subscription that contains several storage accounts. The storage accounts are accessed by legacy applications that are authenticated by using access keys.

  You need to recommend a solution to prevent new applications from obtaining the access keys of the storage accounts. The solution must minimize the impact on the legacy applications.

  What should you include in the recommendation?

  A. Apply read-only locks on the storage accounts.

  B. Set the AllowSharcdKeyAccess property to false.

  C. Set the AllowBlobPublicAcccss property to false.

  D. Configure automated key rotation.

  Correct Answer: A

  A read-only lock on a storage account prevents users from listing the account keys. A POST request handles the Azure Storage List Keys operation to protect access to the account keys. The account keys provide complete access to data in

  the storage account.

  Incorrect:

  Not A:

  If any clients are currently accessing data in your storage account with Shared Key, then Microsoft recommends that you migrate those clients to Azure AD before disallowing Shared Key access to the storage account.

  However, in this scenario we cannot migrate to Azure AD due to the legacy applications.

  Note: Shared Key

  A shared key is a very long string. You can simply access Azure storage by using this long string. It's almost like a password. Actually, it's worse: this is a master password. It gives you all sorts of rights on the Azure storage account. You can

  imagine why this isn't my favorite mechanism of accessing Azure storage. What happens when this key is compromised? You don't get an alert. Perhaps you can set up monitoring to see misuse of your Azure storage account. But it's still less

  than an ideal situation. Alerts will tell you of damage after it has already occurred.

  Not C: Data breaches caused by cloud misconfiguration have been seen for the past few years. One of the most common misconfigurations is granting public access to cloud storage service. Such a data is often unprotected, making them to

  be accessed without any authentication method. Microsoft recently introduced a new protection feature to help avoid public access on storage account. The feature introduces a new property named allowBlobPublicAccess.

  Not D: Key rotation would improve security.

  Automated key rotation in Key Vault allows users to configure Key Vault to automatically generate a new key version at a specified frequency.

  You can use rotation policy to configure rotation for each individual key. Our recommendation is to rotate encryption keys at least every two years to meet cryptographic best practices.

  This feature enables end-to-end zero-touch rotation for encryption at rest for Azure services with customer-managed key (CMK) stored in Azure Key Vault.

  Reference: https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/lock-resources

  https://docs.microsoft.com/en-us/azure/storage/common/shared-key-authorization-prevent

  https://docs.microsoft.com/en-us/azure/key-vault/keys/how-to-configure-key-rotation

• Question 85:

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  Your on-premises network contains an e-commerce web app that was developed in Angular and Node,js. The web app uses a MongoDB database. You plan to migrate the web app to Azure. The solution architecture team proposes the following architecture as an Azure landing zone.

  

  You need to provide recommendations to secure the connection between the web app and the database. The solution must follow the Zero Trust model.

  Solution: You recommend implementing Azure Front Door with Azure Web Application Firewall (WAF).

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  Instead use solution: You recommend creating private endpoints for the web app and the database layer.

  Note:

  How to Use Azure Private Endpoints to Restrict Public Access to WebApps.

  As an Azure administrator or architect, you are sometimes asked the question: “How can we safely deploy internal business applications to Azure App Services?”

  These applications characteristically are:

  Not accessible from the public internet.

  Accessible from within the on-premises corporate network

  Accessible via an authorized VPN client from outside the corporate network.

  For such scenarios, we can use Azure Private Links, which enables private and secure access to Azure PaaS services over Azure Private Endpoints, along with the Site-to-Site VPN, Point-to-Site VPN, or the Express Route. Azure Private

  Endpoint is a read-only network interface service associated with the Azure PAAS Services. It allows you to bring deployed sites into your virtual network, limiting access to them at the network level.

  It uses one of the private IP addresses from your Azure VNet and associates it with the Azure App Services. These services are called Private Link resources. They can be Azure Storage, Azure Cosmos DB, SQL, App Services Web App,

  your own / partner owned services, Azure Backups, Event Grids, Azure Service Bus, or Azure Automations.

  Reference: https://www.varonis.com/blog/securing-access-azure-webapps

• Question 86:

  You have an Azure subscription that has Microsoft Defender for Cloud enabled.

  Suspicious authentication activity alerts have been appearing in the Workload protections dashboard.

  You need to recommend a solution to evaluate and remediate the alerts by using a workflow automation feature of Microsoft Defender for Cloud.

  What should you include in the recommendation?

  A. Azure Monitor webhooks

  B. Azure Event Hubs

  C. Azure Functions apps

  D. Azure Logic Apps

  Correct Answer: D

  The workflow automation feature of Microsoft Defender for Cloud feature can trigger Logic Apps on security alerts, recommendations, and changes to regulatory compliance.

  Note: Azure Logic Apps is a cloud-based platform for creating and running automated workflows that integrate your apps, data, services, and systems. With this platform, you can quickly develop highly scalable integration solutions for your

  enterprise and business-to-business (B2B) scenarios.

  Incorrect:

  Not C: Using Azure Functions apps would require more effort.

  Reference: https://docs.microsoft.com/en-us/azure/defender-for-cloud/workflow-automation

• Question 87:

  You have a customer that has a Microsoft 365 subscription and an Azure subscription.

  The customer has devices that run either Windows, iOS, Android, or macOS. The Windows devices are deployed on-premises and in Azure.

  You need to design a security solution to assess whether all the devices meet the customer's compliance rules.

  What should you include in the solution?

  A. Microsoft Defender for Endpoint

  B. Microsoft Endpoint Manager

  C. Microsoft Information Protection

  D. Microsoft Sentinel

  Correct Answer: B

  Microsoft Endpoint Manager includes Microsoft Intune.

  Device compliance policies are a key feature when using Intune to protect your organization's resources. In Intune, you can create rules and settings that devices must meet to be considered compliant, such as a minimum OS version.

  Microsoft Endpoint Manager helps deliver the modern workplace and modern management to keep your data secure, in the cloud and on-premises. Endpoint Manager includes the services and tools you use to manage and monitor mobile

  devices, desktop computers, virtual machines, embedded devices, and servers.

  Endpoint Manager combines services you may know and already be using, including Microsoft Intune, Configuration Manager, Desktop Analytics, co-management, and Windows Autopilot. These services are part of the Microsoft 365 stack to

  help secure access, protect data, respond to risk, and manage risk.

  Note: Microsoft Defender for Endpoint Plan 2 protects your Windows and Linux machines whether they're hosted in Azure, hybrid clouds (on-premises), or multicloud.

  Microsoft Defender for Endpoint on iOS offers protection against phishing and unsafe network connections from websites, emails, and apps.

  Microsoft Defender for Endpoint on Android supports installation on both modes of enrolled devices - the legacy Device Administrator and Android Enterprise modes. Currently, Personally-owned devices with work profile and Corporate-

  owned fully managed user device enrollments are supported in Android Enterprise.

  Reference: https://docs.microsoft.com/en-us/mem/endpoint-manager-overview

  https://docs.microsoft.com/en-us/azure/defender-for-cloud/integration-defender-for-endpoint

• Question 88:

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You are designing a security strategy for providing access to Azure App Service web apps through an Azure Front Door instance.

  You need to recommend a solution to ensure that the web apps only allow access through the Front Door instance.

  Solution: You recommend configuring gateway-required virtual network integration.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  Instead: You recommend access restrictions based on HTTP headers that have the Front Door ID. Restrict access to a specific Azure Front Door instance

  Traffic from Azure Front Door to your application originates from a well-known set of IP ranges defined in the AzureFrontDoor.Backend service tag. Using a service tag restriction rule, you can restrict traffic to only originate from Azure Front

  Door. To ensure traffic only originates from your specific instance, you will need to further filter the incoming requests based on the unique http header that Azure Front Door sends.

  Incorrect:

  Virtual Network (VNet) integration for an Azure service enables you to lock down access to the service to only your virtual network infrastructure. The VNet infrastructure also includes peered virtual networks and on-premises networks.

  VNet integration provides Azure services the benefits of network isolation and can be accomplished by one or more of the following methods:

  Deploying dedicated instances of the service into a virtual network. The services can then be privately accessed within the virtual network and from on-premises networks.

  Using Private Endpoint that connects you privately and securely to a service powered by Azure Private Link. Private Endpoint uses a private IP address from your VNet, effectively bringing the service into your virtual network.

  Accessing the service using public endpoints by extending a virtual network to the service, through service endpoints. Service endpoints allow service resources to be secured to the virtual network.

  Using service tags to allow or deny traffic to your Azure resources to and from public IP endpoints.

  Reference: https://docs.microsoft.com/en-us/azure/app-service/app-service-ip-restrictions

  https://docs.microsoft.com/en-us/azure/virtual-network/vnet-integration-for-azure-services

• Question 89:

  You have Windows 11 devices and Microsoft 365 E5 licenses.

  You need to recommend a solution to prevent users from accessing websites that contain adult content such as gambling sites.

  What should you include in the recommendation?

  A. Microsoft Endpoint Manager

  B. Compliance Manager

  C. Microsoft Defender for Cloud Apps

  D. Microsoft Defender for Endpoint

  Correct Answer: D

  Web content filtering is part of the Web protection capabilities in Microsoft Defender for Endpoint. It enables your organization to track and regulate access to websites based on their content categories. Many of these websites, while not

  malicious, might be problematic because of compliance regulations, bandwidth usage, or other concerns.

  Note: Turn on web content filtering

  From the left-hand navigation in Microsoft 365 Defender portal, select Settings > Endpoints > General > Advanced Features. Scroll down until you see the entry for Web content filtering. Switch the toggle to On and Save preferences.

  Configure web content filtering policies

  Web content filtering policies specify which site categories are blocked on which device groups. To manage the policies, go to Settings > Endpoints > Web content filtering (under Rules).

  Reference: https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/web-content-filtering

• Question 90:

  You have an Azure subscription that contains virtual machines.

  Port 3389 and port 22 are disabled for outside access.

  You need to design a solution to provide administrators with secure remote access to the virtual machines. The solution must meet the following requirements:

  1.

  Prevent the need to enable ports 3389 and 22 from the internet.

  2.

  Only provide permission to connect the virtual machines when required.

  3.

  Ensure that administrators use the Azure portal to connect to the virtual machines.

  Which two actions should you include in the solution? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. Configure Azure VPN Gateway.

  B. Enable Just Enough Administration (JEA).

  C. Configure Azure Bastion.

  D. Enable just-in-time (JIT) VM access.

  E. Enable Azure AD Privileged Identity Management (PIM) roles as virtual machine contributors.

  Correct Answer: CD

  C: Bastion provides secure remote access.

  It uses RDP/SSH session is over TLS on port 443.

  Note: Azure Bastion is a service you deploy that lets you connect to a virtual machine using your browser and the Azure portal. The Azure Bastion service is a fully platform-managed PaaS service that you provision inside your virtual network.

  It provides secure and seamless RDP/SSH connectivity to your virtual machines directly from the Azure portal over TLS. When you connect via Azure Bastion, your virtual machines don't need a public IP address, agent, or special client

  software.

  D: Lock down inbound traffic to your Azure Virtual Machines with Microsoft Defender for Cloud's just-in-time (JIT) virtual machine (VM) access feature. This reduces exposure to attacks while providing easy access when you need to connect

  to a VM.

  Meets the requirement: Only provide permission to connect the virtual machines when required

  Incorrect:

  Not B: Does not address: Only provide permission to connect the virtual machines when required

  Just Enough Administration (JEA) is a security technology that enables delegated administration for anything managed by PowerShell. With JEA, you can:

  Reduce the number of administrators on your machines using virtual accounts or group-managed service accounts to perform privileged actions on behalf of regular users.

  Limit what users can do by specifying which cmdlets, functions, and external commands they can run.

  Better understand what your users are doing with transcripts and logs that show you exactly which commands a user executed during their session.

  Not E: Does not help with the remote access.

  Note: Classic Virtual Machine Contributor: Lets you manage classic virtual machines, but not access to them, and not the virtual network or storage account they're connected to.

  Reference: https://docs.microsoft.com/en-us/powershell/scripting/learn/remoting/jea/overview?view=powershell-7.2 https://docs.microsoft.com/en-us/azure/defender-for-cloud/just-in-time-access-usage https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles