SC-100 practice questions 221–230

1. Question 221 · 277 in bank

   HOTSPOT - You have two on-premises servers named Server1 and Server2 that run Windows Server. Server1 contains an app named App1 and is isolated from the internet. You have a Microsoft Entra tenant. You plan to deploy Global Secure Access to provide remote access to App1. You need to configure the tenant and Server2 to support the planned deployment. The solution must ensure that when users attempt to access App1, they must authenticate by using their Microsoft Entra credentials. What should you create in the tenant, and what should you install on Server2? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Server does not have internet so arc is out. Entra connect is a sync method to Entra. So private network connector is it. Ent app registration 1st

   Source: Adapted from community discussion — Er_01

   

   Next question

2. Question 222 · 277 in bank

   HOTSPOT - Your on-premises network contains an Active Directory Domain Services (AD DS) domain. The domain contains a group named Group1 and five servers that run Windows Server. Each server contains a standalone app. Each app is used by the members of Group1. You have a Microsoft Entra tenant that syncs with the domain. You plan to manage access to the apps by deploying Global Secure Access. You will use a Conditional Access policy to enforce security controls for all connections to the apps. You need to recommend a Global Secure Access app and Microsoft Entra private network connector configuration for the planned deployment. The solution must minimize administrative effort and be highly available. What is the minimum number of Global Secure Access apps and private network connectors you should recommend? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Global Secure Access apps: Five enterprise applications (since each server has a standalone app) Private network connectors: 2 connectors (for redundancy and high availability)

   Source: Adapted from community discussion — Ali96

   

   Next question

3. Question 223 · 277 in bank

   You have an on-premises app named App1. Remote users access App1 by using VPN connections. You have a third-party software as a service (SaaS) app named App2. You need to deploy Global Secure Access to manage access to App1 and App2. What should you use for each app?

   • AMicrosoft Entra Private Access for App2 and Microsoft Entra Internet Access for App1
   • BMicrosoft Entra Private Access for App1 and Microsoft Entra Internet Access for App2
   • CMicrosoft Entra Internet Access for App1 and App2
   • DMicrosoft Entra Private Access for App1 and App2

   Show answer

   Answer: B

   Explanation

   The best choice is Option B: Microsoft Entra Private Access for App1 (for the on-premises app) and Microsoft Entra Internet Access for App2 (for the SaaS application).

   Source: Adapted from community discussion — Ali96

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

4. Question 224 · 277 in bank

   Select 2

   You have a Microsoft 365 subscription. You need to design a solution to block file downloads from Microsoft SharePoint Online by authenticated users on unmanaged devices. Which two services should you include in the solution? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

   • AAzure AD Conditional Access
   • BAzure Data Catalog
   • CMicrosoft Purview Information Protection
   • DAzure AD Application Proxy
   • EMicrosoft Defender for Cloud Apps

   Show answer

   Answer: AE

   Explanation

   AE is the answer. https://learn.microsoft.com/en-us/defender-cloud-apps/use-case-proxy-block-session-aad#create-a-block-download-policy-for-unmanaged-devices Defender for Cloud Apps session policies allow you to restrict a session based on device state. To accomplish control of a session using its device as a condition, create both a conditional access policy AND a session policy.

   Source: Adapted from community discussion — zellck

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

5. Question 225 · 277 in bank

   Your company is developing a modern application that will un as an Azure App Service web app. You plan to perform threat modeling to identity potential security issues by using the Microsoft Threat Modeling Tool. Which type of diagram should you create?

   • Asystem flow
   • Bdata flow
   • Cprocess flow
   • Dnetwork flow

   Show answer

   Answer: B

   Explanation

   The link provided in the explanation is a nice article but this is a Microsoft exam. The answers must come from Microsoft, using vendor terminology. https://docs.microsoft.com/en-us/learn/modules/tm-create-a-threat-model-using-foundational-data-flow-diagram-elements/1b-elements

   Source: Adapted from community discussion — PlumpyTumbler

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

6. Question 226 · 277 in bank

   HOTSPOT - You have an Azure SQL database named DB1 that contains customer information. A team of database administrators has full access to DB1. To address customer inquiries, operators in the customer service department use a custom web app named App1 to view the customer information. You need to design a security strategy for DB1. The solution must meet the following requirement: • When the database administrators access DB1 by using SQL management tools, they must be prevented from viewing the content of the CreditCard attribute of each customer record. • When the operators view customer records in App1, they must view only the last four digits of the CreditCard attribute. What should you include in the design? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   For the database administrators: Always Encrypted For the operators: Dynamic Data Masking Always Encrypted is a feature designed to protect sensitive data, such as credit card numbers or national/regional identification numbers. Always Encrypted allows clients to encrypt sensitive data inside client applications and never reveal the encryption keys to the Database Engine. https://learn.microsoft.com/en-us/sql/relational-databases/security/encryption/always-encrypted-database-engine?view=sql-server-ver16 Dynamic data masking helps prevent unauthorized access to sensitive data by enabling customers to designate how much of the sensitive data to reveal with minimal effect on the application layer. https://learn.microsoft.com/en-us/azure/azure-sql/database/dynamic-data-masking-overview?view=azuresql

   Source: Adapted from community discussion — kanag1

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

7. Question 227 · 277 in bank

   You have a Microsoft 365 tenant. Your company uses a third-party software as a service (SaaS) app named App1. App1 supports authenticating users by using Azure AD credentials. You need to recommend a solution to enable users to authenticate to App1 by using their Azure AD credentials. What should you include in the recommendation?

   • AAzure AD Application Proxy
   • BAzure AD B2C
   • Can Azure AD enterprise application
   • Da relying party trust in Active Directory Federation Services (AD FS)

   Show answer

   Answer: C

   Explanation

   To enable users to authenticate to App1 by using their Azure AD credentials, you should include an Azure AD enterprise application in your recommendation. An Azure AD enterprise application is an instance of an application that is integrated with Azure AD. You can add App1 as an enterprise application in your Azure AD tenant and configure it to support single sign-on (SSO) using Azure AD. This will allow users to authenticate to App1 using their Azure AD credentials. https://learn.microsoft.com/en-us/azure/active-directory/manage-apps/add-application-portal

   Source: Adapted from community discussion — Victory007

   References

   • Microsoft Learn

   Next question

8. Question 228 · 277 in bank

   You have a Microsoft 365 tenant. Your company uses a third-party software as a service (SaaS) app named App1 that is integrated with an Azure AD tenant. You need to design a security strategy to meet the following requirements: • Users must be able to request access to App1 by using a self-service request. • When users request access to App1, they must be prompted to provide additional information about their request. • Every three months, managers must verify that the users still require access to App1. What should you include in the design?

   • AMicrosoft Entra Identity Governance
   • Bconnected apps in Microsoft Defender for Cloud Apps
   • Caccess policies in Microsoft Defender for Cloud Apps
   • DAzure AD Application Proxy

   Show answer

   Answer: A

   Explanation

   Microsoft Entra Identity Governance allows you to balance your organization’s need for security and employee productivity with the right processes and visibility. It provides you with capabilities to ensure that the right people have the right access to the right resources. https://learn.microsoft.com/en-us/azure/active-directory/governance/identity-governance-overview

   Source: Adapted from community discussion — Victory007

   References

   • Microsoft Learn

   Next question

9. Question 229 · 277 in bank

   You have an Azure subscription. You have a DNS domain named contoso.com that is hosted by a third-party DNS registrar. Developers use Azure DevOps to deploy web apps to App Service Environments. When a new app is deployed, a CNAME record for the app is registered in contoso.com. You need to recommend a solution to secure the DNS record for each web app. The solution must meet the following requirements: • Ensure that when an app is deleted, the CNAME record for the app is removed also. • Minimize administrative effort. What should you include in the recommendation?

   • AMicrosoft Defender for Cloud Apps
   • BMicrosoft Defender for DevOps
   • CMicrosoft Defender for App Service
   • DMicrosoft Defender for DNS

   Show answer

   Answer: C

   Explanation

   Defender for App Service identifies any DNS entries remaining in your DNS registrar when an App Service website is decommissioned - these are known as dangling DNS entries. https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction#dangling-dns-detection Microsoft Defender for DNS provides an additional layer of protection for resources that use Azure DNS's Azure-provided name resolution capability. https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service-introduction#dangling-dns-detection

   Source: Adapted from community discussion — kanag1

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

10. Question 230 · 277 in bank

    HOTSPOT - You have an on-premises datacenter named Site1. You have an Azure subscription that contains a virtual network named VNet1 and multiple Azure App Service apps. Site1 is connected to VNet1 by using a Site-to-Site (P2S) VPN connection. The apps are accessed by using public internet connections. You need to recommend a solution for providing secure access to the apps. The solution must meet the following requirements: • Servers on Site1 must use a VPN connection to access the apps. • Access to the apps must be restricted to specific servers on Site1. • Security administrators for VNet1 must be able to control which servers can access the apps. • Costs must be minimized. What should you include in the recommendation? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer: See figure below

    Explanation

    IMO 1. Private Endpoint - "You can use private endpoint for your App Service apps to allow clients located in your private network to securely access the app over Azure Private Link". See vpn use case at link below https://learn.microsoft.com/en-us/azure/app-service/overview-private-endpoint PrivateLink describes the established connectivity channel between the Private Endpoint and the destination app, which is not the feature we're trying to leverage. Service Endpoints are a virtual networking trick to allow private communication from your vnet via the Azure private backbone to a Microsoft provided Azure Cloud Service (despite the DNS resolved IP address for the service remaining a public IP). An example of one of these services could be Azure Storage. https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-service-endpoints-overview 2. App service static IP address restrictions https://learn.microsoft.com/en-us/azure/app-service/app-service-ip-restrictions?tabs=azurecli

    Source: Adapted from community discussion — lt9898

    References

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SC-100 practice, question 221. 277 questions available.