SC-100 practice questions 151–160

1. Question 151 · 277 in bank

   Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You are designing the encryption standards for data at rest for an Azure resource. You need to provide recommendations to ensure that the data at rest is encrypted by using AES-256 keys. The solution must support rotating the encryption keys monthly. Solution: For Azure SQL databases, you recommend Transparent Data Encryption (TDE) that uses Microsoft-managed keys. Does this meet the goal?

   • AYes
   • BNo

   Show answer

   Answer: B

   Explanation

   To provide Azure SQL customers with two layers of encryption of data at rest, infrastructure encryption (using AES-256 encryption algorithm) with platform managed keys is being rolled out. This provides an addition layer of encryption at rest along with TDE with customer-managed keys, which is already available. ---- Derived from the link below: https://docs.microsoft.com/en-us/azure/azure-sql/database/transparent-data-encryption-byok-overview?view=azuresql&viewFallbackFrom=sql-server-ver16

   Source: Adapted from community discussion — zts

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

2. Question 152 · 277 in bank

   Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You are designing the encryption standards for data at rest for an Azure resource. You need to provide recommendations to ensure that the data at rest is encrypted by using AES-256 keys. The solution must support rotating the encryption keys monthly. Solution: For blob containers in Azure Storage, you recommend encryption that uses customer-managed keys (CMKs). Does this meet the goal?

   • AYes
   • BNo

   Show answer

   Answer: A

   Explanation

   The Microsoft-managed key is rotated appropriately per compliance requirements. Note that the frequency may change without notice. Azure does not expose the logs to indicate rotation to customers. If you have specific key rotation requirements, then we recommend that you move to customer-managed keys. That way, you can manage and audit the rotation yourself.

   Source: Adapted from community discussion — Rocky83

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

3. Question 153 · 277 in bank

   Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You are designing a security strategy for providing access to Azure App Service web apps through an Azure Front Door instance. You need to recommend a solution to ensure that the web apps only allow access through the Front Door instance. Solution: You recommend access restrictions to allow traffic from the backend IP address of the Front Door instance. Does this meet the goal?

   • AYes
   • BNo

   Show answer

   Answer: B

   Explanation

   These questions repeat in this exam dump. They are found again in a later section. The answer is SERVICE TAGS. The explanations are confused. They say the correct answer in some places and incorrect in others. Focus on the screenshot provided. It shows you the answer. A picture is worth a thousand words.

   Source: Adapted from community discussion — PlumpyTumbler

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

4. Question 154 · 277 in bank

   Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You are designing a security strategy for providing access to Azure App Service web apps through an Azure Front Door instance. You need to recommend a solution to ensure that the web apps only allow access through the Front Door instance. Solution: You recommend access restrictions that allow traffic from the Front Door service tags. Does this meet the goal?

   • AYes
   • BNo

   Show answer

   Answer: B

   Explanation

   Answer correct. You need to recommend a solution to ensure that the web apps only allow access through the Front Door (INSTANCE) this is important! Restrict access to a specific Azure Front Door instance with X-Azure-FDID header restriction

   Source: Adapted from community discussion — mikenyga

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

5. Question 155 · 277 in bank

   Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You are designing a security strategy for providing access to Azure App Service web apps through an Azure Front Door instance. You need to recommend a solution to ensure that the web apps only allow access through the Front Door instance. Solution: You recommend access restrictions based on HTTP headers that have the Front Door ID. Does this meet the goal?

   • AYes
   • BNo

   Show answer

   Answer: A

   Explanation

   When you read the doc you will see that the header filter is critical: "IP address filtering alone isn't sufficient to secure traffic to your origin, because other Azure customers use the same IP addresses. You should also configure your origin to ensure that traffic has originated from your Front Door profile. Azure generates a unique identifier for each Front Door profile. You can find the identifier in the Azure portal, by looking for the Front Door ID value in the Overview page of your profile. When Front Door makes a request to your origin, it adds the X-Azure-FDID request header. Your origin should inspect the header on incoming requests, and reject requests where the value doesn't match your Front Door profile's identifier." https://learn.microsoft.com/en-us/azure/frontdoor/origin-security?pivots=front-door-standard-premium&tabs=app-service-functions#front-door-identifier

   Source: Adapted from community discussion — EM1234

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

6. Question 156 · 277 in bank

   Your company is designing an application architecture for Azure App Service Environment (ASE) web apps as shown in the exhibit. (Click the Exhibit tab.)

   

   Communication between the on-premises network and Azure uses an ExpressRoute connection. You need to recommend a solution to ensure that the web apps can communicate with the on-premises application server. The solution must minimize the number of public IP addresses that are allowed to access the on-premises network. What should you include in the recommendation?

   • AAzure Traffic Manager with priority traffic-routing methods
   • BAzure Firewall with policy rule sets
   • CAzure Front Door with Azure Web Application Firewall (WAF)
   • DAzure Application Gateway v2 with user-defined routes (UDRs)

   Show answer

   Answer: B

   Explanation

   Why Not D. UDR User Defined Routes (UDR). Route tables can contain UDRs used by Azure networking to control the flow of packets within a VNet. These route tables can be applied to subnets. One of the newest features in Azure is the ability to apply a route table to the GatewaySubnet, providing the ability to forward all traffic coming into the Azure VNet from a hybrid connection to a virtual appliance.

   Source: Adapted from community discussion — JaySapkota

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

7. Question 157 · 277 in bank

   Select 2

   You are planning the security requirements for Azure Cosmos DB Core (SQL) API accounts. You need to recommend a solution to audit all users that access the data in the Azure Cosmos DB accounts. Which two configurations should you include in the recommendation? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

   • ASend the Azure Active Directory (Azure AD) sign-in logs to a Log Analytics workspace.
   • BEnable Microsoft Defender for Identity.
   • CSend the Azure Cosmos DB logs to a Log Analytics workspace.
   • DDisable local authentication for Azure Cosmos DB.
   • EEnable Microsoft Defender for Cosmos DB.

   Show answer

   Answer: AC

   Explanation

   ChatGTP: To audit all users accessing data in Azure Cosmos DB Core (SQL) API accounts, the following two configurations should be included in the recommendation: A. Send the Azure Active Directory (Azure AD) sign-in logs to a Log Analytics workspace: This will enable logging of all sign-in activities, including successful and failed attempts, by all users accessing the Cosmos DB account. This will provide insight into who is accessing the data and when. C. Send the Azure Cosmos DB logs to a Log Analytics workspace: This will enable logging of all activities within the Cosmos DB account, including queries, modifications, and deletions. This will provide insight into what data is being accessed and how it is being used.

   Source: Adapted from community discussion — Fal991l

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

8. Question 158 · 277 in bank

   You have an Azure subscription that contains several storage accounts. The storage accounts are accessed by legacy applications that are authenticated by using access keys. You need to recommend a solution to prevent new applications from obtaining the access keys of the storage accounts. The solution must minimize the impact on the legacy applications. What should you include in the recommendation?

   • ASet the AllowSharedKeyAccess property to false.
   • BApply read-only locks on the storage accounts.
   • CSet the AllowBlobPublicAccess property to false.
   • DConfigure automated key rotation.

   Show answer

   Answer: B

   Explanation

   B is the answer. https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/lock-resources?tabs=json#considerations-before-applying-your-locks A read-only lock on a storage account prevents users from listing the account keys. A POST request handles the Azure Storage List Keys operation to protect access to the account keys. The account keys provide complete access to data in the storage account. When a read-only lock is configured for a storage account, users who don't have the account keys need to use Azure AD credentials to access blob or queue data. A read-only lock also prevents the assignment of Azure RBAC roles that are scoped to the storage account or to a data container (blob container or queue).

   Source: Adapted from community discussion — zellck

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

9. Question 159 · 277 in bank

   Select 2

   You are designing the security standards for containerized applications onboarded to Azure. You are evaluating the use of Microsoft Defender for Containers. In which two environments can you use Defender for Containers to scan for known vulnerabilities? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.

   • ALinux containers deployed to Azure Container Instances
   • BWindows containers deployed to Azure Kubernetes Service (AKS)
   • CWindows containers deployed to Azure Container Registry
   • DLinux containers deployed to Azure Container Registry
   • ELinux containers deployed to Azure Kubernetes Service (AKS)

   Show answer

   Answer: DE

   Explanation

   This question outdated. Support for Windows containers added in Aug 2022 release of Defender for Containers. Reference What's new in Microsoft Defender for Cloud? https://learn.microsoft.com/en-us/azure/defender-for-cloud/release-notes August 2022 Updates in August include: • Vulnerabilities for running images are now visible with Defender for Containers on your Windows containers • Azure Monitor Agent integration now in preview • Deprecated VM alerts regarding suspicious activity related to a Kubernetes cluster Vulnerabilities for running images are now visible with Defender for Containers on your Windows containers Defender for Containers now shows vulnerabilities for running Windows containers. When vulnerabilities are detected, Defender for Cloud generates the following security recommendation listing the detected issues: Running container images should have vulnerability findings resolved

   Source: Adapted from community discussion — OrangeSG

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

10. Question 160 · 277 in bank

    Your company has a hybrid cloud infrastructure that contains an on-premises Active Directory Domain Services (AD DS) forest, a Microsoft 365 subscription, and an Azure subscription. The company's on-premises network contains internal web apps that use Kerberos authentication. Currently, the web apps are accessible only from the network. You have remote users who have personal devices that run Windows 11. You need to recommend a solution to provide the remote users with the ability to access the web apps. The solution must meet the following requirements: ✑ Prevent the remote users from accessing any other resources on the network. ✑ Support Azure Active Directory (Azure AD) Conditional Access. ✑ Simplify the end-user experience. What should you include in the recommendation?

    • AAzure AD Application Proxy
    • Bweb content filtering in Microsoft Defender for Endpoint
    • CMicrosoft Tunnel
    • DAzure Virtual WAN

    Show answer

    Answer: A

    Explanation

    Azure AD Application Proxy is a feature of Azure AD that allows you to publish on-premises web applications securely to the internet. It acts as a reverse proxy, routing the user's request to the internal web app and returning the response back to the user. By using Azure AD Application Proxy, you can provide the remote users with access to the internal web apps while preventing them from accessing any other resources on the network. Azure AD Application Proxy also supports Azure AD Conditional Access, which allows you to set policies that determine when and how users can access your applications. This can help you ensure that only authorized users are able to access the web apps, and that their access is secure. Additionally, Azure AD Application Proxy simplifies the end-user experience by providing a single sign-on (SSO) experience for the users, which can reduce the need for them to remember multiple usernames and passwords. Other options, such as web content filtering in Microsoft Defender for Endpoint, Microsoft Tunnel, or Azure Virtual WAN, may not be as suitable for this scenario because they do not provide the same level of control over access to the internal web apps or the same level of simplicity for the end-user experience.

    Source: Adapted from community discussion — CertShooter

    References

    • Microsoft Learn
    • Microsoft Learn

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SC-100 practice, question 151. 277 questions available.