SC-100 practice questions 1–10

1. Question 1 · 277 in bank

   Your company has a Microsoft 365 ES subscription. The Chief Compliance Officer plans to enhance privacy management in the working environment. You need to recommend a solution to enhance the privacy management. The solution must meet the following requirements: ✑ Identify unused personal data and empower users to make smart data handling decisions. ✑ Provide users with notifications and guidance when a user sends personal data in Microsoft Teams. ✑ Provide users with recommendations to mitigate privacy risks. What should you include in the recommendation?

   • Acommunication compliance in insider risk management
   • BMicrosoft Viva Insights
   • CPrivacy Risk Management in Microsoft Priva
   • DAdvanced eDiscovery

   Show answer

   Answer: C

   Explanation

   Privacy Risk Management in Microsoft Priva gives you the capability to set up policies that identify privacy risks in your Microsoft 365 environment and enable easy remediation. Privacy Risk Management policies are meant to be internal guides and can help you: Detect overexposed personal data so that users can secure it. Spot and limit transfers of personal data across departments or regional borders. Help users identify and reduce the amount of unused personal data that you store. https://learn.microsoft.com/en-us/privacy/priva/risk-management

   Source: Adapted from community discussion — AJ2021

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

2. Question 2 · 277 in bank

   HOTSPOT - Your company uses Microsoft Defender for Cloud and Microsoft Sentinel. The company is designing an application that will have the architecture shown in the following exhibit.

   

   You are designing a logging and auditing solution for the proposed architecture. The solution must meet the following requirements: ✑ Integrate Azure Web Application Firewall (WAF) logs with Microsoft Sentinel. ✑ Use Defender for Cloud to review alerts from the virtual machines. What should you include in the solution? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: Data connectors - Microsoft Sentinel connector streams security alerts from Microsoft Defender for Cloud into Microsoft Sentinel. Launch a WAF workbook (see step 7 below) The WAF workbook works for all Azure Front Door, Application Gateway, and CDN WAFs. Before connecting the data from these resources, log analytics must be enabled on your resource. To enable log analytics for each resource, go to your individual Azure Front Door, Application Gateway, or CDN resource: 1. Select Diagnostic settings. 2. Select + Add diagnostic setting. 3. In the Diagnostic setting page (details skipped) 4. On the Azure home page, type Microsoft Sentinel in the search bar and select the Microsoft Sentinel resource. 5. Select an already active workspace or create a new workspace. 6. On the left side panel under Configuration select Data Connectors. 7. Search for Azure web application firewall and select Azure web application firewall (WAF). Select Open connector page on the bottom right. 8. Follow the instructions under Configuration for each WAF resource that you want to have log analytic data for if you haven't done so previously. 9. Once finished configuring individual WAF resources, select the Next steps tab. Select one of the recommended workbooks. This workbook will use all log analytic data that was enabled previously. A working WAF workbook should now exist for your WAF resources. Box 2: The Log Analytics agent - Use the Log Analytics agent to integrate with Microsoft Defender for cloud. The Log Analytics agent is required for solutions, VM insights, and other services such as Microsoft Defender for Cloud. Note: The Log Analytics agent in Azure Monitor can also be used to collect monitoring data from the guest operating system of virtual machines. You may choose to use either or both depending on your requirements. Azure Log Analytics agent - Use Defender for Cloud to review alerts from the virtual machines. The Azure Log Analytics agent collects telemetry from Windows and Linux virtual machines in any cloud, on-premises machines, and those monitored by System Center Operations Manager and sends collected data to your Log Analytics workspace in Azure Monitor. Incorrect: The Azure Diagnostics extension does not integrate with Microsoft Defender for Cloud. Reference: https://docs.microsoft.com/en-us/azure/web-application-firewall/waf-sentinel https://docs.microsoft.com/en-us/azure/defender-for-cloud/enable-data-collection https://docs.microsoft.com/en-us/azure/azure-monitor/agents/agents-overview

   Source: Adapted from community discussion — prabhjot

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

3. Question 3 · 277 in bank

   Your company has a third-party security information and event management (SIEM) solution that uses Splunk and Microsoft Sentinel. You plan to integrate Microsoft Sentinel with Splunk. You need to recommend a solution to send security events from Microsoft Sentinel to Splunk. What should you include in the recommendation?

   • Aa Microsoft Sentinel data connector
   • BAzure Event Hubs
   • Ca Microsoft Sentinel workbook
   • DAzure Data Factory

   Show answer

   Answer: B

   Explanation

   The recommended solution to send security events from Microsoft Sentinel to Splunk is to use a Microsoft Sentinel data connector. This is because Microsoft Sentinel data connectors are designed to send security events to external systems, such as Splunk, in real-time. By using a data connector, you can easily configure the integration and define which events to send to Splunk based on your organization's needs. Azure Event Hubs is not the best option for this scenario because it is used to stream large amounts of data to other services and may not provide the required security and filtering capabilities for security events. A Microsoft Sentinel workbook is not designed for sending data to external systems, but rather for visualizing and analyzing data within the Microsoft Sentinel environment. Azure Data Factory is a data integration service that allows you to create data pipelines and move data between different systems, but it is not designed for sending security events from Microsoft Sentinel to Splunk.

   Source: Adapted from community discussion — Jayden111

   References

   • Microsoft Learn

   Next question

4. Question 4 · 277 in bank

   Select 2

   A customer follows the Zero Trust model and explicitly verifies each attempt to access its corporate applications. The customer discovers that several endpoints are infected with malware. The customer suspends access attempts from the infected endpoints. The malware is removed from the endpoints. Which two conditions must be met before endpoint users can access the corporate applications again? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

   • AThe client access tokens are refreshed.
   • BMicrosoft Intune reports the endpoints as compliant.
   • CA new Azure Active Directory (Azure AD) Conditional Access policy is enforced.
   • DMicrosoft Defender for Endpoint reports the endpoints as compliant.

   Show answer

   Answer: AB

   Explanation

   I don't think this is correct. Zero Trust its reffering to Conditional Access, so would be Microsoft Intune reports the endpoints as compliant. https://docs.microsoft.com/en-us/mem/intune/protect/advanced-threat-protection and I assume The client access tokens are refreshed.

   Source: Adapted from community discussion — BillyB2022

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

5. Question 5 · 277 in bank

   HOTSPOT - You have a Microsoft 365 subscription and an Azure subscription. Microsoft 365 Defender and Microsoft Defender for Cloud are enabled. The Azure subscription contains a Microsoft Sentinel workspace. Microsoft Sentinel data connectors are configured for Microsoft 365, Microsoft 365 Defender, Defender for Cloud, and Azure. You plan to deploy Azure virtual machines that will run Windows Server. You need to enable extended detection and response (EDR) and security orchestration, automation, and response (SOAR) capabilities for Microsoft Sentinel. How should you recommend enabling each capability? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: Onboard the servers to Defender for Cloud. Extended detection and response (XDR) is a new approach defined by industry analysts that are designed to deliver intelligent, automated, and integrated security across domains to help defenders connect seemingly disparate alerts and get ahead of attackers. As part of this announcement, we are unifying all XDR technologies under the Microsoft Defender brand. The new Microsoft Defender is the most comprehensive XDR in the market today and prevents, detects, and responds to threats across identities, endpoints, applications, email, IoT, infrastructure, and cloud platforms. Box 2: Configure Microsoft Sentinel playbooks. As a SOAR platform, its primary purposes are to automate any recurring and predictable enrichment, response and remediation tasks that are the responsibility of Security Operations Centers (SOC/SecOps). Leveraging SOAR frees up time and resources for more in-depth investigation of and hunting for advanced threats. Automation takes a few different forms in Microsoft Sentinel, from automation rules that centrally manage the automation of incident handling and response to playbooks that run predetermined sequences of actions to provide robust and flexible advanced automation to your threat response tasks. Reference: https://www.microsoft.com/security/blog/2020/09/22/microsoft-unified-siem-xdr-modernize-security-operations/ https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/become-a-microsoft-sentinel-automation-ninja/ba-p/3563377

   Source: Adapted from community discussion — PlumpyTumbler

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

6. Question 6 · 277 in bank

   You have a customer that has a Microsoft 365 subscription and uses the Free edition of Azure Active Directory (Azure AD). The customer plans to obtain an Azure subscription and provision several Azure resources. You need to evaluate the customer's security environment. What will necessitate an upgrade from the Azure AD Free edition to the Premium edition?

   • AAzure AD Privileged Identity Management (PIM)
   • Brole-based authorization
   • Cresource-based authorization
   • DAzure AD Multi-Factor Authentication

   Show answer

   Answer: A

   Explanation

   I would go for A, reason being is that MFA is available for users not only on administrators by using security defaults in the Free Edition --- review this link (https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-licensing) which make the question on what is required to upgrade? From the link above, PIM will force you to Premium P2.

   Source: Adapted from community discussion — zts

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

7. Question 7 · 277 in bank

   You are designing the security standards for a new Azure environment. You need to design a privileged identity strategy based on the Zero Trust model. Which framework should you follow to create the design?

   • AMicrosoft Security Development Lifecycle (SDL)
   • BEnhanced Security Admin Environment (ESAE)
   • CRapid Modernization Plan (RaMP)
   • DMicrosoft Operational Security Assurance (OSA)

   Show answer

   Answer: C

   Explanation

   Rapid Modernization Plan (RaMP) checklist helps you establish a security perimeter for cloud applications and mobile devices that uses identity as the control plane and explicitly validates trust for user accounts and devices before allowing access, for both public and private networks - Source: https://learn.microsoft.com/en-us/security/zero-trust/user-access-productivity-validate-trust#identities

   Source: Adapted from community discussion — Sec_Arch_Chn

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

8. Question 8 · 277 in bank

   Select 2

   A customer has a hybrid cloud infrastructure that contains a Microsoft 365 E5 subscription and an Azure subscription. All on-premises servers in the perimeter network are prevented from connecting directly to the internet. The customer recently recovered from a ransomware attack. The customer plans to deploy Microsoft Sentinel. You need to recommend solutions to meet the following requirements: ✑ Ensure that the security operations team can access the security logs and the operation logs. ✑ Ensure that the IT operations team can access only the operations logs, including the event logs of the servers in the perimeter network. Which two solutions should you include in the recommendation? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.

   • Aa custom collector that uses the Log Analytics agent
   • Bthe Azure Monitor agent
   • Cresource-based role-based access control (RBAC)
   • DAzure Active Directory (Azure AD) Conditional Access policies

   Show answer

   Answer: BC

   Explanation

   Given the expanded answers B and C are the clear best choices. B - this use case is spelled out in exact detail. This is must be the exact wording that the question was created from https://docs.microsoft.com/en-us/azure/sentinel/best-practices-data#on-premises-windows-log-collection C - https://docs.microsoft.com/en-us/azure/sentinel/resource-context-rbac#scenarios-for-resource-context-rbac

   Source: Adapted from community discussion — PlumpyTumbler

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

9. Question 9 · 277 in bank

   Your company is developing a serverless application in Azure that will have the architecture shown in the following exhibit.

   

   You need to recommend a solution to isolate the compute components on an Azure virtual network. What should you include in the recommendation?

   • AAzure Active Directory (Azure AD) enterprise applications
   • Ban Azure App Service Environment (ASE)
   • CAzure service endpoints
   • Dan Azure Active Directory (Azure AD) application proxy

   Show answer

   Answer: B

   Explanation

   https://docs.microsoft.com/en-us/archive/msdn-magazine/2017/april/azure-the-new-azure-app-service-environment The Azure App Service Environment (ASE) is a Premium feature offering of the Azure App Service. It gives a single-tenant instance of the Azure App Service that runs right in your own Azure virtual network (VNet), providing network isolation and improved scaling capabilities.

   Source: Adapted from community discussion — TheMCT

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

10. Question 10 · 277 in bank

    HOTSPOT - You are planning the security levels for a security access strategy. You need to identify which job roles to configure at which security levels. The solution must meet security best practices of the Microsoft Cybersecurity Reference Architectures (MCRA). Which security level should you configure for each job role? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer: See figure below

    Explanation

    1. Specialised security 2. Enterprise security 3. Privileged security https://learn.microsoft.com/en-us/security/privileged-access-workstations/privileged-access-security-levels#specialized Specialized security provides increased security controls for roles with an elevated business impact (if compromised by an attacker or malicious insider). Specialized roles typically include: - Developers of business critical systems. https://learn.microsoft.com/en-us/security/privileged-access-workstations/privileged-access-security-levels#enterprise Enterprise security is suitable for all enterprise users and productivity scenarios. In the progression of the rapid modernization plan, enterprise also serves as the starting point for specialized and privileged access as they progressively build on the security controls in enterprise security.

    Source: Adapted from community discussion — zellck

    References

    • Microsoft Learn
    • Microsoft Learn

    

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SC-100 practice, question 1. 277 questions available.