SC-100 practice questions 171–180

1. Question 171 · 277 in bank

   A customer has a Microsoft 365 E5 subscription and an Azure subscription. The customer wants to centrally manage security incidents, analyze logs, audit activities, and search for potential threats across all deployed services You need to recommend a solution for the customer. What should you include in the recommendation?

   • AMicrosoft Defender for Cloud
   • BMicrosoft Defender for Cloud Apps
   • CMicrosoft 365 Defender
   • DMicrosoft Sentinel

   Show answer

   Answer: D

   Explanation

   hunt is more used now instead of search. But when it says something by hunting/search, its reffering to Microsoft Sentinel

   Source: Adapted from community discussion — InformationOverload

   References

   • Microsoft Learn

   Next question

2. Question 172 · 277 in bank

   Select 2

   Your company has an office in Seattle. The company has two Azure virtual machine scale sets hosted on different virtual networks. The company plans to contract developers in India. You need to recommend a solution provide the developers with the ability to connect to the virtual machines over SSL from the Azure portal. The solution must meet the following requirements: ✑ Prevent exposing the public IP addresses of the virtual machines. ✑ Provide the ability to connect without using a VPN. ✑ Minimize costs. Which two actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

   • ACreate a hub and spoke network by using virtual network peering.
   • BDeploy Azure Bastion to each virtual network.
   • CDeploy Azure Bastion to one virtual network.
   • DCreate NAT rules and network rules in Azure Firewall.
   • EEnable just-in-time VM access on the virtual machines.

   Show answer

   Answer: AC

   Explanation

   AC is the answer. https://learn.microsoft.com/en-us/azure/bastion/vnet-peering Azure Bastion and VNet peering can be used together. When VNet peering is configured, you don't have to deploy Azure Bastion in each peered VNet. This means if you have an Azure Bastion host configured in one virtual network (VNet), it can be used to connect to VMs deployed in a peered VNet without deploying an additional bastion host.

   Source: Adapted from community discussion — zellck

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

3. Question 173 · 277 in bank

   HOTSPOT - Your company plans to follow DevSecOps best practices of the Microsoft Cloud Adoption Framework for Azure to integrate DevSecOps processes into continuous integration and continuous deployment (CI/CD) DevOps pipelines. You need to recommend which security-related tasks to integrate into each stage of the DevOps pipelines. What should recommend? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   1. Build and test 2. Commit the code https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/secure/devsecops-controls#commit-the-code Typically, developers create, manage, and share their code in repositories such as GitHub or Azure Repos. This approach provides a central, version-controlled library of code for developers to collaborate on easily. However, enabling many collaborators on a single codebase also runs the risk of changes being introduced. That risk can lead to vulnerabilities or unintentionally including credentials or tokens in commits. To address this risk, development teams should evaluate and implement a repository scanning capability. Repository scanning tools perform static code analysis on source code within repositories. The tools look for vulnerabilities or credentials changes and flag any items found for remediation. This capability acts to protect against human error and is a useful safeguard for distributed teams where many people are collaborating in the same repository.

   Source: Adapted from community discussion — zellck

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

4. Question 174 · 277 in bank

   Select 3

   For a Microsoft cloud environment, you are designing a security architecture based on the Microsoft Cloud Security Benchmark. What are three best practices for identity management based on the Azure Security Benchmark? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.

   • AManage application identities securely and automatically.
   • BManage the lifecycle of identities and entitlements.
   • CProtect identity and authentication systems.
   • DEnable threat detection for identity and access management.
   • EUse a centralized identity and authentication system.

   Show answer

   Answer: ACE

   Explanation

   ACE is the answer. https://learn.microsoft.com/en-us/security/benchmark/azure/security-controls-v3-identity-management#im-1-use-centralized-identity-and-authentication-system Security Principle: Use a centralized identity and authentication system to govern your organization's identities and authentications for cloud and non-cloud resources. https://learn.microsoft.com/en-us/security/benchmark/azure/security-controls-v3-identity-management#im-2-protect-identity-and-authentication-systems Security Principle: Secure your identity and authentication system as a high priority in your organization's cloud security practice.

   Source: Adapted from community discussion — zellck

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

5. Question 175 · 277 in bank

   Your company plans to follow DevSecOps best practices of the Microsoft Cloud Adoption Framework for Azure. You need to perform threat modeling by using a top-down approach based on the Microsoft Cloud Adoption Framework for Azure. What should you use to start the threat modeling process?

   • Athe STRIDE model
   • Bthe DREAD model
   • COWASP threat modeling

   Show answer

   Answer: A

   Explanation

   Here you will find that DevSecOps uses SDL (Security Development Lifecycle) as the security framework. https://www.microsoft.com/en-us/securityengineering/devsecops And then while researching about SDL and Threat Modeling, you'll reach to the Threats section of documentation where it explains about SDL saying "allows software architects to identify and mitigate potential security issues" (aka DevSecOps), and refers to the STRIDE Model to achieve this security framework. https://learn.microsoft.com/en-us/azure/security/develop/threat-modeling-tool-threats hope this clarifies it.

   Source: Adapted from community discussion — cris_exam

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

6. Question 176 · 277 in bank

   You are designing a new Azure environment based on the security best practices of the Microsoft Cloud Adoption Framework for Azure. The environment will contain one subscription for shared infrastructure components and three separate subscriptions for applications. You need to recommend a deployment solution that includes network security groups (NSGs), Azure Firewall, Azure Key Vault, and Azure Bastion. The solution must minimize deployment effort and follow security best practices of the Microsoft Cloud Adoption Framework for Azure. What should you include in the recommendation?

   • Athe Azure landing zone accelerator
   • Bthe Azure Well-Architected Framework
   • CAzure Security Benchmark v3
   • DAzure Advisor

   Show answer

   Answer: A

   Explanation

   A is the answer. https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/scenarios/app-platform/app-services/landing-zone-accelerator The Azure App Service landing zone accelerator is an open-source collection of architectural guidance and reference implementation to accelerate deployment of Azure App Service at scale. It can provide a specific architectural approach and reference implementation via infrastructure as code templates to prepare your landing zones. The landing zones adhere to the architecture and best practices of the Cloud Adoption Framework.

   Source: Adapted from community discussion — zellck

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

7. Question 177 · 277 in bank

   Your company uses Azure Pipelines and Azure Repos to implement continuous integration and continuous deployment (CI/CD) workflows for the deployment of applications to Azure. You are updating the deployment process to align with DevSecOps controls guidance in the Microsoft Cloud Adoption Framework for Azure. You need to recommend a solution to ensure that all code changes are submitted by using pull requests before being deployed by the CI/CD workflow. What should you include in the recommendation?

   • Acustom roles in Azure Pipelines
   • Bbranch policies in Azure Repos
   • CAzure policies
   • Dcustom Azure roles

   Show answer

   Answer: B

   Explanation

   from ChatGPT: Based on the requirements of ensuring that all code changes are submitted through pull requests before being deployed by the CI/CD workflow and aligning with DevSecOps controls guidance, the recommended solution for ensuring this process is followed should be branch policies in Azure Repos. Branch policies in Azure Repos provide a way to enforce code review policies before a pull request can be completed and merged into a target branch. This ensures that all code changes are submitted through a pull request and reviewed by other members of the team before being deployed by the CI/CD workflow. Branch policies can be configured to require specific reviewers, require a minimum number of approvals, and block direct pushes to the target branch. This helps to ensure that code changes are thoroughly reviewed and meet the established standards before being merged into the target branch. Therefore, the correct answer is B) branch policies in Azure Repos.

   Source: Adapted from community discussion — MaciekMT

   References

   • Microsoft Learn

   Next question

8. Question 178 · 277 in bank

   You have an Azure subscription that contains a Microsoft Sentinel workspace. Your on-premises network contains firewalls that support forwarding event logs in the Common Event Format (CEF). There is no built-in Microsoft Sentinel connector for the firewalls. You need to recommend a solution to ingest events from the firewalls into Microsoft Sentinel. What should you include in the recommendation?

   • Aan Azure logic app
   • Ban on-premises Syslog server
   • Can on-premises data gateway
   • DAzure Data Factory

   Show answer

   Answer: B

   Explanation

   To ingest events from the firewalls into Microsoft Sentinel, you should include the following recommendation: B. An on-premises Syslog server Setting up an on-premises Syslog server is a common approach for collecting and forwarding logs from various devices, including firewalls, to a central location for further processing and analysis. You can configure the Syslog server to receive logs in the Common Event Format (CEF) from your firewalls and then forward those logs to your Microsoft Sentinel workspace. Microsoft Sentinel has built-in support for Syslog, making it a suitable choice for this scenario.

   Source: Adapted from community discussion — sherifhamed

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

9. Question 179 · 277 in bank

   You have an on-premises datacenter and an Azure Kubernetes Service (AKS) cluster named AKS1. You need to restrict internet access to the public endpoint of AKS1. The solution must ensure that AKS1 can be accessed only from the public IP addresses associated with the on-premises datacenter. What should you use?

   • Aa private endpoint
   • Ba network security group (NSG)
   • Ca service endpoint
   • Dan authorized IP range

   Show answer

   Answer: D

   Explanation

   "To secure access to the otherwise publicly accessible AKS control plane / API server, you can enable and use authorized IP ranges." https://learn.microsoft.com/en-us/azure/aks/api-server-authorized-ip-ranges

   Source: Adapted from community discussion — Intrudire

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

10. Question 180 · 277 in bank

    HOTSPOT - You have a multi-cloud environment that contains an Azure subscription and an Amazon Web Services (AWS) account. You need to implement security services in Azure to manage the resources in both subscriptions. The solution must meet the following requirements: • Automatically identify threats found in AWS CloudTrail events. • Enforce security settings on AWS virtual machines by using Azure policies. What should you include in the solution for each requirement? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer: See figure below

    References

    • Microsoft Learn
    • Microsoft Learn

    

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SC-100 practice, question 171. 277 questions available.