SC-100 practice questions 181–190

1. Question 181 · 277 in bank

   You have an Azure subscription. The subscription contains 50 virtual machines that run Windows Server and 50 virtual machines that run Linux. You need to perform vulnerability assessments on the virtual machines. The solution must meet the following requirements: • Identify missing updates and insecure configurations. • Use the Qualys engine. What should you use?

   • AMicrosoft Defender for Servers
   • BMicrosoft Defender Threat Intelligence (Defender TI)
   • CMicrosoft Defender for Endpoint
   • DMicrosoft Defender External Attack Surface Management (Defender EASM)

   Show answer

   Answer: A

   Explanation

   Vulnerability assessment for machines allows you to select between two vulnerability assessment solutions: Microsoft Defender Vulnerability Management Microsoft Defender for Cloud integrated Qualys scanner

   Source: Adapted from community discussion — Murtuza

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

2. Question 182 · 277 in bank

   HOTSPOT - You are designing security for a runbook in an Azure Automation account. The runbook will copy data to Azure Data Lake Storage Gen2. You need to recommend a solution to secure the components of the copy process. What should you include in the recommendation for each component? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Data Security : Access Keys stored in Azure Key Vault Network access control : Azure Private Link with network service tags

   Source: Adapted from community discussion — HardcodedCloud

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

3. Question 183 · 277 in bank

   You have an Azure subscription that contains 100 virtual machines, a virtual network named VNet1, and 20 users. The virtual machines run Windows Server and are connected to VNet1. The users work remotely and access Azure resources from Linux workstations. You need to ensure that the users can connect to the virtual machines from the workstations by using Secure Shell (SSH). The solution must meet the following requirements: • Ensure that the users authenticate by using their Microsoft Entra credentials. • Prevent the users from transferring files from the virtual machines by using SSH. • Prevent the users from directly accessing the virtual machines by using the public IP address of the virtual machines. What should you include in the solution?

   • AAzure NAT Gateway
   • Bjust-in-time (JIT) VM access
   • CAzure Bastion
   • DPoint-to-Site (P2S) VPN

   Show answer

   Answer: C

   Next question

4. Question 184 · 277 in bank

   You have an on-premises network that has several legacy applications. The applications perform LDAP queries against an existing directory service. You are migrating the on-premises infrastructure to a cloud-only infrastructure. You need to recommend an identity solution for the infrastructure that supports the legacy applications. The solution must minimize the administrative effort to maintain the infrastructure. Which identity service should you include in the recommendation?

   • AMicrosoft Entra External ID
   • BMicrosoft Entra Domain Services
   • CMicrosoft Entra ID
   • DActive Directory Domain Services (AD DS)

   Show answer

   Answer: B

   Next question

5. Question 185 · 277 in bank

   You have a Microsoft 365 tenant that contains 5,000 users and 5,000 Windows 11 devices. All users are assigned Microsoft 365 E5 licenses and the Microsoft Defender Vulnerability Management add-on. The Windows 11 devices are managed by using Microsoft Intune and Microsoft Defender for Endpoint. The Windows 11 devices are configured during deployment to comply with Center for Internet Security (CIS) benchmarks for Windows 11. You need to recommend a compliance solution for the Windows 11 devices. The solution must identify devices that were modified and no longer comply with the CIS benchmarks. What should you include in the recommendation?

   • AAuthenticated scan for Windows in Microsoft Defender Vulnerability Management
   • BMicrosoft Secure Score for Devices in Defender for Endpoint
   • Cattack surface reduction (ASR) rules in Defender for Endpoint
   • Dsecurity baselines assessments in Microsoft Defender Vulnerability Management

   Show answer

   Answer: D

   Next question

6. Question 186 · 277 in bank

   You plan to deploy 20 Azure Kubernetes Service (AKS) clusters. The cluster configuration will be managed declaratively by using Kubernetes manifest files stored in Azure Repos. You need to recommend a solution to ensure that the configuration of all the clusters remains consistent by using the manifest files stored in Azure Repos. What should you include in the recommendation?

   • AGatekeeper
   • BDependency Tracker
   • CDependabot
   • DFlux

   Show answer

   Answer: D

   References

   • Microsoft Learn

   Next question

7. Question 187 · 277 in bank

   HOTSPOT - You have on-premises servers and virtual machines that run Windows Server, Red Hat Enterprise Linux (RHEL) 7, or RHEL 8. You have an Azure subscription. The subscription contains virtual machines that run Windows Server Datacenter: Azure Edition. You need to recommend a solution to manage operating system updates for the on-premises servers and the virtual machines. The solution must meet the following requirements: • Enable hotpatching for the Azure virtual machines. • Enable the on-demand inventory and deployment of updates. • Enable the deployment of Extended Security Update (ESU) patches to the on-premises servers. What should you include in the recommendation? To answer, select the options in the answer area. NOTE: Each correct answer is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   

   Next question

8. Question 188 · 277 in bank

   HOTSPOT - You have an Azure subscription. The subscription contains an Azure Bastion host and 100 virtual machines that run Windows Server 2022. The virtual machines have Microsoft Defender for Servers Plan 2 enabled. You need to recommend a security solution for the virtual machines that meets the following requirements: • Administrators must request RDP access to the virtual machines by using the Azure portal. • Remote Desktop sessions must be limited to a maximum of three hours. • Agentless scanning must be scheduled to run on each virtual machine. What should you recommend using? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   

   Next question

9. Question 189 · 277 in bank

   You have a Microsoft 365 tenant named contoso.com. You need to ensure that users can authenticate only to contoso.com. The solution must meet the following requirements: • Prevent the users from authenticating to other Microsoft 365 tenants. • Minimize administrative effort. What should you use?

   • AMicrosoft Entra Private Access
   • BMicrosoft Defender for Endpoint
   • CMicrosoft Entra Internet Access
   • DMicrosoft Defender for Cloud Apps

   Show answer

   Answer: C

   Explanation

   C -is designed to provide secure access to private applications and resources, typically replacing traditional VPNs with a Zero Trust Network Access (ZTNA) solution12. It focuses on securing access to internal resources from any device and network, which is not directly related to restricting user authentication to a specific Microsoft 365 tenant.

   Source: Adapted from community discussion — Elisa2021

   Next question

10. Question 190 · 277 in bank

    You have on-premises Windows 11 devices that have the Global Secure Access client deployed. You have a Microsoft 365 subscription that uses Microsoft SharePoint Online and Exchange Online. You deploy Microsoft Entra Internet Access from the on-premises network to Microsoft 365. The deployment has the Microsoft 365 profile enabled and contains the following: • Default traffic policies for Microsoft 365 services • A linked Conditional Access policy that performs compliant network checks with continuous access evaluation and is applied to all users • An assignment to all the devices • An assignment to a remote network associated with the on-premises network Which Microsoft 365 resources are protected by using continuous access evaluation?

    • ASharePoint Online only
    • BExchange Online only
    • Cboth SharePoint Online and Exchange Online

    Show answer

    Answer: C

    References

    • Microsoft Learn

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SC-100 practice, question 181. 277 questions available.