SC-100 practice questions 161–170

1. Question 161 · 277 in bank

   Select 2

   A customer is deploying Docker images to 10 Azure Kubernetes Service (AKS) resources across four Azure subscriptions. You are evaluating the security posture of the customer. You discover that the AKS resources are excluded from the secure score recommendations. You need to produce accurate recommendations and update the secure score. Which two actions should you recommend in Microsoft Defender for Cloud? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

   • AEnable Defender plans.
   • BConfigure auto provisioning.
   • CAdd a workflow automation.
   • DAssign regulatory compliance policies.
   • EReview the inventory.

   Show answer

   Answer: AB

   Explanation

   I like A and B for this one - enable the defender for containers plan - then ensure it deploys to your container resources with auto provision.

   Source: Adapted from community discussion — foxtrott

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

2. Question 162 · 277 in bank

   Select 2

   Your company has a main office and a branch office. The main office contains 20 on-premises servers that run Windows Server and host apps that are published by using Microsoft Entra application proxy. The main office contains 500 on-premises computers that run Windows 11. The branch office contains 100 on-premises computers that run Windows 11. All the main office computers are enrolled in Microsoft Intune. The branch office computers are NOT enrolled in Intune. You have a Microsoft 365 ES subscription. You have a Microsoft Entra tenant. You have a third-party software as a service (SaaS) app that is registered in the Microsoft Entra tenant. You plan to implement Global Secure Access. You are evaluating the use of compliant network check and Conditional Access. Which two scenarios are supported by compliant network check? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point

   • Aconnections to the third-party SaaS app
   • Bconnections from the branch office computers
   • CContinuous Access Evaluation for Microsoft Exchange Online
   • Dconnections to the on-premises apps

   Show answer

   Answer: AC

   Explanation

   Browse to Global Secure Access > Settings > Session management > Adaptive access. Select the toggle to Enable CA Signaling for Entra ID (covering all cloud apps). This will automatically enable CAE signaling for Office 365. If your organization is enrolling devices into Microsoft Intune, it is recommended to exclude the applications Microsoft Intune Enrollment and Microsoft Intune from your Conditional Access policy to avoid a circular dependency. https://learn.microsoft.com/en-us/entra/global-secure-access/how-to-compliant-network#enable-global-secure-access-signaling-for-conditional-access

   Source: Adapted from community discussion — 424ede1

   References

   • Microsoft Learn

   Next question

3. Question 163 · 277 in bank

   HOTSPOT - Your company has a Microsoft 365 ES subscription, an Azure subscription, on-premises applications, and Active Directory Domain Services (AD DS). You need to recommend an identity security strategy that meets the following requirements: ✑ Ensures that customers can use their Facebook credentials to authenticate to an Azure App Service website ✑ Ensures that partner companies can access Microsoft SharePoint Online sites for the project to which they are assigned The solution must minimize the need to deploy additional infrastructure components. What should you include in the recommendation? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: Azure AD B2C authentication Ensures that customers can use their Facebook credentials to authenticate to an Azure App Service website. You can set up sign-up and sign-in with a Facebook account using Azure Active Directory B2C. Box 2: Azure AD B2B authentication with access package assignments Govern access for external users in Azure AD entitlement management Azure AD entitlement management uses Azure AD business-to-business (B2B) to share access so you can collaborate with people outside your organization. With Azure AD B2B, external users authenticate to their home directory, but have a representation in your directory. The representation in your directory enables the user to be assigned access to your resources. Incorrect: Not: Password hash synchronization in Azure AD connect The partners are not integrated with AD DS. Reference: https://docs.microsoft.com/en-us/azure/active-directory-b2c/identity-provider-facebook?pivots=b2c-user-flow https://docs.microsoft.com/en-us/azure/active-directory/governance/entitlement-management-external-users https://docs.microsoft.com/en-us/microsoft-365/enterprise/microsoft-365-integration

   Source: Adapted from community discussion — TheMCT

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

4. Question 164 · 277 in bank

   Select 2

   You have an Azure subscription that contains virtual machines. Port 3389 and port 22 are disabled for outside access. You need to design a solution to provide administrators with secure remote access to the virtual machines. The solution must meet the following requirements: ✑ Prevent the need to enable ports 3389 and 22 from the internet. ✑ Only provide permission to connect the virtual machines when required. ✑ Ensure that administrators use the Azure portal to connect to the virtual machines. Which two actions should you include in the solution? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

   • AConfigure Azure VPN Gateway.
   • BEnable Just Enough Administration (JEA).
   • CConfigure Azure Bastion.
   • DEnable just-in-time (JIT) VM access.
   • EEnable Azure Active Directory (Azure AD) Privileged Identity Management (PIM) roles as virtual machine contributors.

   Show answer

   Answer: CD

   Explanation

   C. Azure Bastion is a fully managed service that provides more secure and seamless Remote Desktop Protocol (RDP) and Secure Shell Protocol (SSH) access to virtual machines (VMs) without any exposure through public IP addresses. Provision the service directly in your local or peered virtual network to get support for all the VMs within it --> https://azure.microsoft.com/en-us/services/azure-bastion/#overview D --> https://docs.microsoft.com/en-us/azure/defender-for-cloud/just-in-time-access-overview?tabs=defender-for-container-arch-aks

   Source: Adapted from community discussion — zts

   References

   • azure.microsoft.com documentation
   • Microsoft Learn
   • Microsoft Learn

   Next question

5. Question 165 · 277 in bank

   Your company has on-premises Microsoft SQL Server databases. The company plans to move the databases to Azure. You need to recommend a secure architecture for the databases that will minimize operational requirements for patching and protect sensitive data by using dynamic data masking. The solution must minimize costs. What should you include in the recommendation?

   • AAzure SQL Managed Instance
   • BAzure Synapse Analytics dedicated SQL pools
   • CAzure SQL Database
   • DSQL Server on Azure Virtual Machines

   Show answer

   Answer: C

   Explanation

   Azure SQL Database is a general-purpose relational database, provided as a managed service. Categorized as a platform as a service (PaaS), Azure SQL Databases are built on standardized hardware and software that is owned, hosted, and maintained by Microsoft. When using Azure SQL Database, you pay-as-you-go, with the option to scale up or out with no service interruption. Within Azure SQL Database, you have the option to deploy a managed instance. Azure SQL Database Managed Instance is a collection of system and user databases with a shared set of resources. In addition to all the PaaS benefits of Azure SQL Database, this option provides a native virtual network (VNet) and near 100 percent compatibility with on-premises SQL Server. Azure SQL Database Managed Instance provides you with full SQL Server access and feature compatibility for migrating SQL Servers to Azure. Recommendation: Choose Azure SQL Database for your modern cloud applications, or when you have time constraints in development and marketing.

   Source: Adapted from community discussion — ele123

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

6. Question 166 · 277 in bank

   Your company plans to move all on-premises virtual machines to Azure. A network engineer proposes the Azure virtual network design shown in the following table.

   

   You need to recommend an Azure Bastion deployment to provide secure remote access to all the virtual machines. Based on the virtual network design, how many Azure Bastion subnets are required?

   • A1
   • B2
   • C3
   • D4
   • E5

   Show answer

   Answer: B

   Explanation

   So i thought it was 3 Bastions but when you actually look a bit closer you will see that the Vnet column on the left hand side shows the VNET the VM is in and the column on right is the Peered VNET so : VNET 1-2 ARE PEERED VNET 3-4 ARE PEERED ...THEREFORE KIDS WE NEED ONLY TWO BASTION : B

   Source: Adapted from community discussion — awssecuritynewbie

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

7. Question 167 · 277 in bank

   HOTSPOT - Your company has an Azure App Service plan that is used to deploy containerized web apps. You are designing a secure DevOps strategy for deploying the web apps to the App Service plan. You need to recommend a strategy to integrate code scanning tools into a secure software development lifecycle. The code must be scanned during the following two phases: ✑ Uploading the code to repositories ✑ Building containers Where should you integrate code scanning for each phase? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: GitHub Enterprise - A GitHub Advanced Security license provides the following additional features: Code scanning - Search for potential security vulnerabilities and coding errors in your code. Secret scanning - Detect secrets, for example keys and tokens, that have been checked into the repository. If push protection is enabled, also detects secrets when they are pushed to your repository. Etc. Code scanning is a feature that you use to analyze the code in a GitHub repository to find security vulnerabilities and coding errors. Any problems identified by the analysis are shown in GitHub Enterprise Cloud. Box 2: Azure Pipelines - Building Containers with Azure DevOps using DevTest Pattern with Azure Pipelines The pattern enabled as to build container for development, testing and releasing the container for further reuse (production ready). Azure Pipelines integrates metadata tracing into your container images, including commit hashes and issue numbers from Azure Boards, so that you can inspect your applications with confidence. Incorrect: * Not Azure Boards: Azure Boards provides software development teams with the interactive and customizable tools they need to manage their software projects. It provides a rich set of capabilities including native support for Agile, Scrum, and Kanban processes, calendar views, configurable dashboards, and integrated reporting. * Not Microsoft Defender for Cloud Microsoft Defender for Containers is the cloud-native solution that is used to secure your containers so you can improve, monitor, and maintain the security of your clusters, containers, and their applications. You cannot use Microsoft Defender for Cloud to scan code, it scans images. Reference: https://docs.github.com/en/enterprise-cloud@latest/get-started/learning-about-github/about-github-advanced-security https://microsoft.github.io/code-with-engineering-playbook/automated-testing/tech-specific-samples/azdo-container-dev-test-release/

   Source: Adapted from community discussion — TJ001

   

   Next question

8. Question 168 · 277 in bank

   Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You are designing the encryption standards for data at rest for an Azure resource. You need to provide recommendations to ensure that the data at rest is encrypted by using AES-256 keys. The solution must support rotating the encryption keys monthly. Solution: For Azure SQL databases, you recommend Transparent Data Encryption (TDE) that uses customer-managed keys (CMKs). Does this meet the goal?

   • AYes
   • BNo

   Show answer

   Answer: A

   Explanation

   Yes, this solution meets the goal of ensuring that the data at rest is encrypted by using AES-256 keys and supporting rotating the encryption keys monthly. Transparent Data Encryption (TDE) is a feature of Azure SQL that allows you to encrypt your databases and their backups with AES-256 keys. By using TDE with customer-managed keys (CMKs), you can manage the encryption keys yourself, which means that you have full control over the keys and can rotate them on a regular basis. This can help ensure that your data at rest is encrypted using AES-256 keys and that the encryption keys are rotated regularly to enhance security.

   Source: Adapted from community discussion — CertShooter

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

9. Question 169 · 277 in bank

   A customer uses Azure to develop a mobile app that will be consumed by external users as shown in the following exhibit.

   

   You need to design an identity strategy for the app. The solution must meet the following requirements: ✑ Enable the usage of external IDs such as Google, Facebook, and Microsoft accounts. ✑ Use a customer identity store. ✑ Support fully customizable branding for the app. Which service should you recommend to complete the design?

   • AAzure Active Directory (Azure AD) B2B
   • BAzure Active Directory Domain Services (Azure AD DS)
   • CAzure Active Directory (Azure AD) B2C
   • DAzure AD Connect

   Show answer

   Answer: C

   Explanation

   Very obvious. Second link shows technical procedures for Facebook, Apple, Amazon, Google, etc. I've used most of them. Good answer and resources here.

   Source: Adapted from community discussion — PlumpyTumbler

   References

   • Microsoft Learn

   Next question

10. Question 170 · 277 in bank

    Select 2

    Your company has a hybrid cloud infrastructure. Data and applications are moved regularly between cloud environments. The company's on-premises network is managed as shown in the following exhibit.

    

    You are designing security operations to support the hybrid cloud infrastructure. The solution must meet the following requirements: ✑ Govern virtual machines and servers across multiple environments. ✑ Enforce standards for all the resources across all the environments by using Azure Policy. Which two components should you recommend for the on-premises network? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

    • Aon-premises data gateway
    • BAzure VPN Gateway
    • Cguest configuration in Azure Policy
    • DAzure Arc
    • EAzure Bastion

    Show answer

    Answer: CD

    Explanation

    Simple process of elimination here, even if you're not sure. The other 3 options have nothing to do with governance. However, guest configuration policy is no longer called that. Answers could look different on the real test. Remember this is the Beta dump and SC-100 isn't in Beta anymore. https://docs.microsoft.com/en-us/azure/governance/machine-configuration/overview Not the answers: https://docs.microsoft.com/en-us/data-integration/gateway/service-gateway-onprem https://docs.microsoft.com/en-us/learn/modules/connect-on-premises-network-with-vpn-gateway/2-connect-on-premises-networks-to-azure-using-site-to-site-vpn-gateways

    Source: Adapted from community discussion — PlumpyTumbler

    References

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SC-100 practice, question 161. 277 questions available.