SC-100 practice questions 211–220

1. Question 211 · 277 in bank

   Select 2

   You have a Microsoft 365 E5 subscription. You are designing a solution to protect confidential data in Microsoft SharePoint Online sites that contain more than one million documents. You need to recommend a solution to prevent Personally Identifiable Information (PII) from being shared. Which two components should you include in the recommendation? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

   • Adata loss prevention (DLP) policies
   • Bretention label policies
   • CeDiscovery cases
   • Dsensitivity label policies

   Show answer

   Answer: AD

   Explanation

   A and D, "data loss prevention (DLP) policies" and "sensitivity label policies," should be included in the recommendation. DLP policies are designed to detect, monitor, and protect sensitive information across SharePoint Online and other Microsoft 365 services. They can be used to identify and block the sharing of confidential data such as Personally Identifiable Information (PII) by using rule-based detection, reporting, and remediation. Sensitivity label policies, on the other hand, are used to classify, protect, and monitor sensitive data within SharePoint Online. They can be used to automatically label content based on specific conditions and to apply restrictions on how the content can be accessed or shared. These policies can help prevent confidential information from being shared outside the organization or with unauthorized users.

   Source: Adapted from community discussion — Mo22

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

2. Question 212 · 277 in bank

   Your company has the virtual machine infrastructure shown in the following table.

   

   The company plans to use Microsoft Azure Backup Server (MABS) to back up the virtual machines to Azure. You need to provide recommendations to increase the resiliency of the backup strategy to mitigate attacks such as ransomware. What should you include in the recommendation?

   • AUse geo-redundant storage (GRS).
   • BMaintain multiple copies of the virtual machines.
   • CEncrypt the backups by using customer-managed keys (CMKS).
   • DRequire PINs to disable backups.

   Show answer

   Answer: D

   Explanation

   D is the answer. https://learn.microsoft.com/en-us/azure/backup/backup-azure-security-feature#authentication-to-perform-critical-operations As part of adding an extra layer of authentication for critical operations, you're prompted to enter a security PIN when you perform Stop Protection with Delete data and Change Passphrase operations.

   Source: Adapted from community discussion — zellck

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

3. Question 213 · 277 in bank

   You have a Microsoft 365 tenant that uses Microsoft SharePoint Online and Microsoft Purview. Microsoft Purview has a sensitivity label named Label1 that is applied to the files stored on SharePoint Online sites. You need to recommend a Microsoft Purview Data Loss Prevention (DLP) policy that meets the following requirements: • Prevents users from uploading the files to third-party external websites • Allows users to upload the files to Microsoft OneDrive for Business To which location should you apply the DLP policy?

   • ADevices
   • BOneDrive accounts
   • CSharePoint sites
   • DMicrosoft Defender for Cloud Apps

   Show answer

   Answer: D

   Explanation

   The most suitable choice is Option D: Microsoft Defender for Cloud Apps. This will allow the DLP policy to monitor and manage uploads to both OneDrive for Business and third-party websites as needed.

   Source: Adapted from community discussion — Ali96

   Next question

4. Question 214 · 277 in bank

   Your company plans to provision blob storage by using an Azure Storage account. The blob storage will be accessible from 20 application servers on the internet. You need to recommend a solution to ensure that only the application servers can access the storage account. What should you recommend using to secure the blob storage?

   • Amanaged rule sets in Azure Web Application Firewall (WAF) policies
   • Binbound rules in network security groups (NSGs)
   • Cfirewall rules for the storage account
   • Dinbound rules in Azure Firewall
   • Eservice tags in network security groups (NSGs)

   Show answer

   Answer: C

   Explanation

   To ensure that only the application servers can access the storage account, you should recommend: C. Firewall rules for the storage account Azure Blob Storage supports setting up firewall rules directly on the storage account. You can specify the IP addresses or ranges of your application servers to allow access while denying all other incoming traffic. This provides fine-grained control over who can access the storage account.

   Source: Adapted from community discussion — sherifhamed

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

5. Question 215 · 277 in bank

   HOTSPOT - You have a hybrid cloud infrastructure. You plan to deploy the Azure applications shown in the following table.

   

   What should you use to meet the requirement of each app? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   I believe answers are correct. Reference for mobile app + B2C + LinkedIn - https://learn.microsoft.com/en-us/azure/active-directory-b2c/identity-provider-linkedin?pivots=b2c-user-flow Reference for WAF - https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/ag-overview

   Source: Adapted from community discussion — purek77

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

6. Question 216 · 277 in bank

   DRAG DROP - Your company wants to optimize ransomware incident investigations. You need to recommend a plan to investigate ransomware incidents based on the Microsoft Detection and Response Team (DART) approach. Which three actions should you recommend performing in sequence in the plan? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   1. Assess the current situation and identify the scope. 2. Identify which LOB apps are unavailable due to a ransomware incident. 3. Identify the compromise recovery process. https://learn.microsoft.com/en-us/security/operations/incident-response-playbook-dart-ransomware-approach#the-dart-approach-to-conducting-ransomware-incident-investigations The following are three key steps in DART ransomware investigations: 1. Assess the current situation 2. Identify the affected line-of-business (LOB) apps 3. Determine the compromise recovery (CR) process

   Source: Adapted from community discussion — zellck

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

7. Question 217 · 277 in bank

   You have a Microsoft 365 subscription that syncs with Active Directory Domain Services (AD DS). You need to define the recovery steps for a ransomware attack that encrypted data in the subscription. The solution must follow Microsoft Security Best Practices. What is the first step in the recovery plan?

   • AFrom Microsoft Defender for Endpoint, perform a security scan.
   • BRecover files to a cleaned computer or device.
   • CContact law enforcement.
   • DDisable Microsoft OneDrive sync and Exchange ActiveSync.

   Show answer

   Answer: D

   Explanation

   D is the answer. https://learn.microsoft.com/en-us/microsoft-365/security/defender/playbook-responding-ransomware-m365-defender?view=o365-worldwide#step-3-prevent-the-spread Use this list to keep the attack from spreading to additional entities. - Disable Exchange ActiveSync and OneDrive sync Pausing OneDrive sync helps protect your cloud data from being updated by potentially infected devices.

   Source: Adapted from community discussion — zellck

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

8. Question 218 · 277 in bank

   HOTSPOT - You have an Azure subscription. You plan to deploy a storage account named storage1 that will store confidential data. You will assign tags to the confidential data. You need to ensure that access to storage1 can be defined by using the assigned tags. Which authorization mechanism should you enable, and which type of resource should you use to store the data? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   References

   • Microsoft Learn

   

   Next question

9. Question 219 · 277 in bank

   Select 2

   Your company is developing an invoicing application that will use Azure AD B2C. The application will be deployed as an App Service web app. You need to recommend a solution to the application development team to secure the application from identity-related attacks. Which two configurations should you recommend? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

   • AAzure AD Conditional Access integration with user flows and custom policies
   • Bsmart account lockout in Azure AD B2C
   • Caccess packages in Identity Governance
   • Dcustom resource owner password credentials (ROPC) flows in Azure AD B2C

   Show answer

   Answer: AB

   Explanation

   https://learn.microsoft.com/en-us/azure/active-directory-b2c/threat-management#how-smart-lockout-works Azure AD B2C uses a sophisticated strategy to lock accounts. The accounts are locked based on the IP of the request and the passwords entered. The duration of the lockout also increases based on the likelihood that it's an attack. After a password is tried 10 times unsuccessfully (the default attempt threshold), a one-minute lockout occurs. The next time a login is unsuccessful after the account is unlocked (that is, after the account has been automatically unlocked by the service once the lockout period expires), another one-minute lockout occurs and continues for each unsuccessful login. Entering the same, or similar password repeatedly doesn't count as multiple unsuccessful logins.

   Source: Adapted from community discussion — zellck

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

10. Question 220 · 277 in bank

    Your company plans to evaluate the security of its Azure environment based on the principles of the Microsoft Cloud Adoption Framework for Azure. You need to recommend a cloud-based service to evaluate whether the Azure resources comply with the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF). What should you recommend?

    • ACompliance Manager in Microsoft Purview
    • BMicrosoft Defender for Cloud
    • CMicrosoft Sentinel
    • DMicrosoft Defender for Cloud Apps

    Show answer

    Answer: B

    Explanation

    B. Microsoft Defender for Cloud Microsoft Defender for Cloud (formerly known as Azure Security Center) is a comprehensive cloud security management system that helps you monitor and improve the security of your Azure resources. It provides continuous security assessment based on various compliance standards, including NIST CSF. It offers recommendations and best practices to help you align with the NIST CSF and other security frameworks. The other options (A, C, and D) have different purposes and are not specifically designed for evaluating compliance with NIST CSF

    Source: Adapted from community discussion — sherifhamed

    References

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SC-100 practice, question 211. 277 questions available.