SC-100 practice questions 101–110

1. Question 101 · 277 in bank

   HOTSPOT - You have a Microsoft Entra tenant that is linked to a Microsoft 365 subscription and an Azure subscription. The tenant contains service principals that are used to access applications in the Azure subscription. You need to recommend a solution to detect risky sign-ins and other risky activities performed by the service principals in the tenant. The solution must minimize costs. What should you include in the recommendation? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   References

   • Microsoft Learn

   

   Next question

2. Question 102 · 277 in bank

   You have an Azure subscription. You have an on-premises datacenter that contains Microsoft SQL Server instances. Each instance contains multiple databases. You have a Microsoft 365 subscription. You plan to implement a solution to scan the databases for vulnerabilities that compromise data security. You need to recommend what to configure before the databases can be scanned. What should you recommend?

   • AMicrosoft Purview data loss prevention (DLP)
   • BMicrosoft Purview data governance
   • CMicrosoft Defender for Cloud
   • DMicrosoft Defender Vulnerability Management

   Show answer

   Answer: C

   Next question

3. Question 103 · 277 in bank

   HOTSPOT - Your network contains an Active Directory Domain Services (AD DS) domain named Domain1. You have a Microsoft Entra tenant. Domain1 syncs with the tenant by using Microsoft Entra Connect. You need to evaluate Microsoft Entra smart lockout by testing the following account lockout considerations: • The number of failed sign-in attempts that trigger a lockout • The duration of the lockout What should you use to test each consideration? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

4. Question 104 · 277 in bank

   You have a Microsoft 365 E5 subscription and an Azure subscription. You need to recommend a solution to enforce the Zero Trust principle of explicit verification for the subscriptions. The solution must be based on Zero Trust guidance in the Microsoft Cybersecurity Reference Architectures (MCRA). What should you include in the recommendation?

   • AConditional Access
   • BMicrosoft Defender for Identity
   • CMicrosoft Defender for Cloud
   • DMicrosoft Entra ID Identity Governance

   Show answer

   Answer: A

   Next question

5. Question 105 · 277 in bank

   You have an Azure subscription. You have an on-premises datacenter. The datacenter contains 20 servers that run Windows Server. Each server is onboarded to Azure Arc and is protected by using Microsoft Defender for Servers Plan 1. You have a Microsoft 365 subscription. You need to recommend a solution to identify which servers have outdated hardware drivers or firmware. What should you include in the recommendation?

   • AChange all the servers to Microsoft Defender for Servers Plan 2.
   • BAdd the Microsoft Intune Suite add-on.
   • COnboard all the servers to Azure Update Manager.
   • DAdd Microsoft Defender Vulnerability Management add-ons.

   Show answer

   Answer: D

   Next question

6. Question 106 · 277 in bank

   You have a Microsoft 365 subscription that contains 1,000 Microsoft Exchange Online mailboxes. Incoming email from the internet is scanned for security threats by using a third-party cloud service. You are evaluating whether to replace the third-party service with Microsoft Defender for Office 365. What should you modify to ensure that all the incoming email is scanned by Defender for Office 365 only?

   • Athe accepted domains in Exchange Online
   • Bthe DNS records
   • Cthe Exchange Online transport rule
   • Dthe Exchange Online connectors

   Show answer

   Answer: B

   Explanation

   Should be: B- DNS Records? To ensure that all incoming email is scanned exclusively by Microsoft Defender for Office 365, you need to modify your MX (Mail Exchange) records.

   Source: Adapted from community discussion — Softeng

   Next question

7. Question 107 · 277 in bank

   Your network contains an Active Directory Domain Services (AD DS) domain. You need to ensure that the built-in administrator account for the domain can be used only for interactive sign-ins to domain controllers. What should you configure?

   • Athe Protected Users group
   • Bauthentication policies
   • Cthe User Rights Assignment security policy settings
   • Dan authentication policy silo

   Show answer

   Answer: C

   Next question

8. Question 108 · 277 in bank

   You have a Microsoft 365 tenant that contains two groups named Group1 and Group2. You use Microsoft Defender XDR to manage the tenants of your company’s customers. You need to ensure that the users in Group1 can perform security tasks in the tenant of each customer. The solution must meet the following requirements: • The Group1 users must only be assigned the Security Operator role for the customer tenants. • The users in Group2 must be able to assign the Security Operators role to the Group1 users for the customer tenants. • The use of quest accounts must be minimized. • Administrative effort must be minimized. What should you include in the solution?

   • Amulti-user authorization (MUA)
   • BAzure Lighthouse
   • CPrivileged Identity Management (PIM)
   • DMicrosoft Entra B2B collaboration

   Show answer

   Answer: B

   Next question

9. Question 109 · 277 in bank

   You have an Azure subscription. Your company has a governance requirement that resources must be created in the West Europe or North Europe Azure regions. What should you recommend using to enforce the governance requirement?

   • AAzure management groups
   • Bcustom Azure roles
   • CAzure Policy assignments
   • Dregulatory compliance standards in Microsoft Defender for Cloud

   Show answer

   Answer: C

   Explanation

   C is the answer. https://learn.microsoft.com/en-us/azure/governance/policy/overview Azure Policy helps to enforce organizational standards and to assess compliance at-scale. Through its compliance dashboard, it provides an aggregated view to evaluate the overall state of the environment, with the ability to drill down to the per-resource, per-policy granularity. It also helps to bring your resources to compliance through bulk remediation for existing resources and automatic remediation for new resources.

   Source: Adapted from community discussion — zellck

   References

   • Microsoft Learn

   Next question

10. Question 110 · 277 in bank

    You have a Microsoft 365 subscription that contains 500 users. Each user is assigned a Microsoft 365 E5 license and uses a Windows device. Microsoft Purview data loss prevention (DLP) policies are applied to Microsoft Exchange Online email and SharePoint Online sites. You plan to monitor the usage of third-party generative AI apps by using Microsoft Purview Data Security Posture Management for AI (DSPM for AI). What should you do first?

    • AEnable Microsoft Purview insider risk management for all the users.
    • BOnboard all endpoint devices to Microsoft Purview.
    • CConfigure Microsoft Purview data connectors for the generative AI apps.
    • DLicense all the users for Microsoft 365 Copilot.

    Show answer

    Answer: B

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SC-100 practice, question 101. 277 questions available.