SC-100 practice questions 11–20

1. Question 11 · 277 in bank

   Select 3

   Your company plans to apply the Zero Trust Rapid Modernization Plan (RaMP) to its IT environment. You need to recommend the top three modernization areas to prioritize as part of the plan. Which three areas should you recommend based on RaMP? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

   • Adata, compliance, and governance
   • Binfrastructure and development
   • Cuser access and productivity
   • Doperational technology (OT) and IoT
   • Emodern security operations

   Show answer

   Answer: ACE

   Explanation

   Correct, link below lists all three as top priorities: https://learn.microsoft.com/en-us/security/zero-trust/zero-trust-ramp-overview in order: 1. user access and productivity: explicitly verify trust for identities, devices, apps and networks 2. data, complaince and governance: ransomware readiness and data policies 3. modern security operations: streamline response, unify visibility, reduce manual effort.

   Source: Adapted from community discussion — Discuss4certi

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

2. Question 12 · 277 in bank

   You have an Azure subscription that has Microsoft Defender for Cloud enabled. Suspicious authentication activity alerts have been appearing in the Workload protections dashboard. You need to recommend a solution to evaluate and remediate the alerts by using workflow automation. The solution must minimize development effort. What should you include in the recommendation?

   • AAzure Monitor webhooks
   • BAzure Event Hubs
   • CAzure Functions apps
   • DAzure Logics Apps

   Show answer

   Answer: D

   Explanation

   D is the answer. https://learn.microsoft.com/en-us/azure/defender-for-cloud/workflow-automation Every security program includes multiple workflows for incident response. These processes might include notifying relevant stakeholders, launching a change management process, and applying specific remediation steps. Security experts recommend that you automate as many steps of those procedures as you can. Automation reduces overhead. It can also improve your security by ensuring the process steps are done quickly, consistently, and according to your predefined requirements. This feature can trigger consumption logic apps on security alerts, recommendations, and changes to regulatory compliance. For example, you might want Defender for Cloud to email a specific user when an alert occurs. You'll also learn how to create logic apps using Azure Logic Apps.

   Source: Adapted from community discussion — zellck

   References

   • Microsoft Learn

   Next question

3. Question 13 · 277 in bank

   HOTSPOT - For a Microsoft cloud environment, you are designing a security architecture based on the Microsoft Cybersecurity Reference Architectures (MCRA). You need to protect against the following external threats of an attack chain: • An attacker attempts to exfiltrate data to external websites. • An attacker attempts lateral movement across domain-joined computers. What should you include in the recommendation for each threat? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   For Box 1: The recommendation should be MS Defender for Cloud Apps as it can protect the cloud application and its data from unauthorized access, and it has the capability to detect and prevent data exfiltration attempts. For Box 2: The recommendation should be MS Defender for Identity, as it can protect against lateral movement by detecting and blocking suspicious activities across domain-joined computers. It can also identify and remediate misconfigurations and vulnerabilities in the identity infrastructure that attackers could exploit to move laterally.

   Source: Adapted from community discussion — OCHT

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

4. Question 14 · 277 in bank

   For an Azure deployment, you are designing a security architecture based on the Microsoft Cloud Security Benchmark. You need to recommend a best practice for implementing service accounts for Azure API management. What should you include in the recommendation?

   • Aapplication registrations in Azure AD
   • Bmanaged identities in Azure
   • CAzure service principals with usernames and passwords
   • Ddevice registrations in Azure AD
   • EAzure service principals with certificate credentials

   Show answer

   Answer: B

   Explanation

   Configuration Guidance: Use a Managed Service Identity generated by Azure Active Directory (Azure AD) to allow your API Management instance to easily and securely access other Azure AD-protected resources, such as Azure Key Vault instead of using service principals. Managed identity credentials are fully managed, rotated, and protected by the platform, avoiding hard-coded credentials in source code or configuration files. https://learn.microsoft.com/en-us/security/benchmark/azure/baselines/api-management-security-baseline

   Source: Adapted from community discussion — AJ2021

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

5. Question 15 · 277 in bank

   Your company has on-premises datacenters in Seattle, Chicago, and New York City. You plan to migrate the on-premises workloads to the East US Azure region. You need to design a governance solution for the management group hierarchy. The solution must be based on Microsoft Cloud Adoption Framework for Azure principles and must ensure that the hierarchy aligns with the Azure landing conceptual architecture. What should you use to identify which archetype-aligned management groups to create beneath the landing zones management group?

   • Ageographical locations
   • Bthe internal billing chargeback structure
   • Cthe hybrid connectivity requirements
   • Dsoftware development lifecycle (SDLC) environments

   Show answer

   Answer: D

   Next question

6. Question 16 · 277 in bank

   You have an Azure AD tenant that syncs with an Active Directory Domain Services (AD DS) domain. Client computers run Windows and are hybrid-joined to Azure AD. You are designing a strategy to protect endpoints against ransomware. The strategy follows Microsoft Security Best Practices. You plan to remove all the domain accounts from the Administrators groups on the Windows computers. You need to recommend a solution that will provide users with administrative access to the Windows computers only when access is required. The solution must minimize the lateral movement of ransomware attacks if an administrator account on a computer is compromised. What should you include in the recommendation?

   • ALocal Administrator Password Solution (LAPS)
   • BAzure AD Identity Protection
   • CAzure AD Privileged Identity Management (PIM)
   • DPrivileged Access Workstations (PAWs)

   Show answer

   Answer: A

   Explanation

   A is the answer. https://learn.microsoft.com/en-us/windows-server/identity/laps/laps-overview Windows Local Administrator Password Solution (Windows LAPS) is a Windows feature that automatically manages and backs up the password of a local administrator account on your Azure Active Directory-joined or Windows Server Active Directory-joined devices. You also can use Windows LAPS to automatically manage and back up the Directory Services Restore Mode (DSRM) account password on your Windows Server Active Directory domain controllers. An authorized administrator can retrieve the DSRM password and use it.

   Source: Adapted from community discussion — zellck

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

7. Question 17 · 277 in bank

   29 DRAG DROP For a Microsoft cloud environment, you need to recommend a security architecture that follows the Zero Trust principles of the Microsoft Cybersecurity Reference Architectures (MCRA). Which security methodologies should you include in the recommendation? To answer, drag the appropriate methodologies to the correct principles. Each methodology may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   1. Segmenting access 2. Data classification 3. JIT access https://learn.microsoft.com/en-us/security/zero-trust/zero-trust-overview#guiding-principles-of-zero-trust - Assume breach Minimize blast radius and segment access. Verify end-to-end encryption and use analytics to get visibility, drive threat detection, and improve defenses. - Verify explicitly Always authenticate and authorize based on all available data points. - Use least privilege access Limit user access with Just-In-Time and Just-Enough-Access (JIT/JEA), risk-based adaptive policies, and data protection.

   Source: Adapted from community discussion — zellck

   References

   • Microsoft Learn

   

   Next question

8. Question 18 · 277 in bank

   Select 2

   You have legacy operational technology (OT) devices and IoT devices. You need to recommend best practices for applying Zero Trust principles to the OT and IoT devices based on the Microsoft Cybersecurity Reference Architectures (MCRA). The solution must minimize the risk of disrupting business operations. Which two security methodologies should you include in the recommendation? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

   • Aactive scanning
   • Bthreat monitoring
   • Csoftware patching
   • Dpassive traffic monitoring

   Show answer

   Answer: BD

   Explanation

   From MCRA slide 17 (OT): "Many well-established IT security best practices like software patching aren’t practical or fully effective in an OT environment, so they can only be selectively applied (or have a limited security effect). Basic security hygiene for OT starts with network isolation (including good maintenance/**monitoring** of that isolation boundaries), **threat monitoring**, and carefully managing vendor access risk."

   Source: Adapted from community discussion — El_m_o

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

9. Question 19 · 277 in bank

   Select 2

   You have an on-premises network and a Microsoft 365 subscription. You are designing a Zero Trust security strategy. Which two security controls should you include as part of the Zero Trust solution? Each correct answer presents part of the solution. NOTE: Each correct answer is worth one point.

   • AAlways allow connections from the on-premises network.
   • BDisable passwordless sign-in for sensitive accounts.
   • CBlock sign-in attempts from unknown locations.
   • DBlock sign-in attempts from noncompliant devices.

   Show answer

   Answer: CD

   Explanation

   MRCA slide 15 recommmends using passwordless so B is wrong.. "The top priority is to require strong multi-factor authentication (MFA), (and preferably Passwordless authentication). Attackers have easy availability to compromised username/passwords and commonly used passwords, so organizations must prioritize moving beyond password-only authentication as their first step. "

   Source: Adapted from community discussion — bmulvIT

   References

   • Microsoft Learn

   Next question

10. Question 20 · 277 in bank

    You are designing a ransomware response plan that follows Microsoft Security Best Practices. You need to recommend a solution to minimize the risk of a ransomware attack encrypting local user files. What should you include in the recommendation?

    • AWindows Defender Device Guard
    • BMicrosoft Defender for Endpoint
    • CAzure Files
    • DBitLocker Drive Encryption (BitLocker)
    • Eprotected folders

    Show answer

    Answer: E

    Explanation

    The primary goal here is to minimize the risk of ransomware encrypting local user files. A feature designed to protect against unauthorized access to critical system files and user data, particularly from ransomware, is protected folders. Option E, "protected folders," should be included in the recommendation. In Windows, the Controlled Folder Access feature protects files in key system folders and user-defined folders by only allowing authorized apps to make changes. This can prevent ransomware from encrypting files in those folders. While some of the other options listed, such as B. Microsoft Defender for Endpoint, may provide broader protection against malware, option E specifically targets the requirement to protect local user files against ransomware encryption. Therefore, the correct answer is: E. protected folders.

    Source: Adapted from community discussion — WRITER00347

    References

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SC-100 practice, question 11. 277 questions available.