SC-100 practice questions 231–240

1. Question 231 · 277 in bank

   DRAG DROP - You have a Microsoft 365 subscription. You need to recommend a security solution to monitor the following activities: • User accounts that were potentially compromised • Users performing bulk file downloads from Microsoft SharePoint Online What should you include in the recommendation for each activity? To answer, drag the appropriate components to the correct activities. Each component may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   1. Azure AD Identity Protection 2. Microsoft Defender for Cloud Apps https://learn.microsoft.com/en-us/azure/active-directory/identity-protection/concept-identity-protection-risks#nonpremium-user-risk-detections https://learn.microsoft.com/en-us/defender-cloud-apps/policies-threat-protection#detect-mass-download-data-exfiltration Detect when a certain user accesses or downloads a massive number of files in a short period of time.

   Source: Adapted from community discussion — Murtuza

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

2. Question 232 · 277 in bank

   HOTSPOT - You plan to automate the development and deployment of a Node.js-based app by using GitHub. You need to recommend a DevSecOps solution for the app. The solution must meet the following requirements: • Automate the generation of pull requests that remediate identified vulnerabilities. • Automate vulnerability code scanning for public and private repositories. • Minimize administrative effort. • Minimize costs. What should you recommend using? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Code scanning is a feature that you use to analyze the code in a GitHub repository to find security vulnerabilities and coding errors. Any problems identified by the analysis are shown in GitHub Enterprise Cloud.

   Source: Adapted from community discussion — Murtuza

   

   Next question

3. Question 233 · 277 in bank

   HOTSPOT - You have an Azure subscription. The subscription contains an Azure application gateway that use Azure Web Application Firewall (WAF). You deploy new Azure App Services web apps. Each app is registered automatically in the DNS domain of your company and accessible from the Internet. You need to recommend a security solution that meets the following requirements: • Detects vulnerability scans of the apps • Detects whether newly deployed apps are vulnerable to attack What should you recommend using? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   - To detect vulnerability scans of the apps: Microsoft Defender for App Service - To detect whether newly deployed apps are vulnerable to attack: Microsoft Defender External Attack Surface Management (Defender EASM)

   Source: Adapted from community discussion — Ali96

   

   Next question

4. Question 234 · 277 in bank

   You have an Azure subscription. The subscription contains 100 virtual machines that run Windows Server. The virtual machines are managed by using Azure Policy and Microsoft Defender for Servers. You need to enhance security on the virtual machines. The solution must meet the following requirements: • Ensure that only apps on an allowlist can be run. • Require administrators to confirm each app added to the allowlist. • Automatically add unauthorized apps to a blocklist when an attempt is made to launch the app. • Require administrators to approve an app before the app can be moved from the blocklist to the allowlist. What should you include in the solution?

   • Aa compute policy in Azure Policy
   • Bapp governance in Microsoft Defender for Cloud Apps
   • Cadmin consent settings for enterprise applications in Microsoft Entra ID
   • Dadaptive application controls in Defender for Servers

   Show answer

   Answer: D

   Next question

5. Question 235 · 277 in bank

   HOTSPOT - You have a Microsoft 365 tenant. You need to recommend a Microsoft 365 Defender solution to enhance security for the tenant. The solution must meet the following requirements: • Identify users that are downloading an unusually high number of files from Microsoft SharePoint Online sites and are possibly involved in a data exfiltration attempt. • Block Microsoft Teams messages that contain potentially malicious content by using zero-hour auto purge (ZAP). What should you recommend for each requirement? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   References

   • Microsoft Learn

   

   Next question

6. Question 236 · 277 in bank

   Your company has an on-premises network and an Azure subscription. The company does NOT have a Site-to-Site VPN or an ExpressRoute connection to Azure. You are designing the security standards for Azure App Service web apps. The web apps will access Microsoft SQL Server databases on the network. You need to recommend security standards that will allow the web apps to access the databases. The solution must minimize the number of open internet- accessible endpoints to the on-premises network. What should you include in the recommendation?

   • Avirtual network NAT gateway integration
   • Bhybrid connections
   • Cvirtual network integration
   • Da private endpoint

   Show answer

   Answer: B

   Explanation

   B is the answer. https://learn.microsoft.com/en-us/azure/app-service/app-service-hybrid-connections Within App Service, Hybrid Connections can be used to access application resources in any network that can make outbound calls to Azure over port 443. Hybrid Connections provides access from your app to a TCP endpoint and doesn't enable a new way to access your app. As used in App Service, each Hybrid Connection correlates to a single TCP host and port combination. This enables your apps to access resources on any OS, provided it's a TCP endpoint. The Hybrid Connections feature doesn't know or care what the application protocol is, or what you are accessing. It simply provides network access.

   Source: Adapted from community discussion — zellck

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

7. Question 237 · 277 in bank

   You have an on-premises server that runs Windows Server and contains a Microsoft SQL Server database named DB1. You plan to migrate DB1 to Azure. You need to recommend an encrypted Azure database solution that meets the following requirements: • Minimizes the risks of malware that uses elevated privileges to access sensitive data • Prevents database administrators from accessing sensitive data • Enables pattern matching for server-side database operations • Supports Microsoft Azure Attestation • Uses hardware-based encryption What should you include in the recommendation?

   • ASQL Server on Azure Virtual Machines with virtualization-based security (VBS) enclaves
   • BAzure SQL Database with virtualization-based security (VBS) enclaves
   • CAzure SQL Managed Instance that has Always Encrypted configured
   • DAzure SQL Database with Intel Software Guard Extensions (Intel SGX) enclaves

   Show answer

   Answer: D

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

8. Question 238 · 277 in bank

   You have an Azure subscription that contains multiple Azure Data Lake Storage accounts. You need to recommend a solution to encrypt the content of the accounts by using service-side encryption and customer-managed keys. The solution must ensure that individual encryption keys are applied at the most granular level. At which level should you recommend the encryption be applied?

   • Afile
   • Bcontainer
   • Cfolder
   • Daccount

   Show answer

   Answer: A

   Explanation

   A. file level. By applying service-side encryption with customer-managed keys (CMKs) at the file level, you can ensure that each file can have its own unique encryption key, providing the highest level of granularity and security for your data

   Source: Adapted from community discussion — sweetykaur

   References

   • Microsoft Learn

   Next question

9. Question 239 · 277 in bank

   You have an Azure subscription. You plan to deploy multiple containerized microservice-based apps to Azure Kubernetes Service (AKS). You need to recommend a solution that meets the following requirements: • Manages secrets • Provides encryption • Secures service-to-service communication by using mTLS encryption • Minimizes administrative effort What should you include in the recommendation?

   • AFlux
   • BEnvoy
   • CDapr
   • DIstio

   Show answer

   Answer: C

   Explanation

   Es una malla de servicios que proporciona mTLS, gestión de tráfico y políticas. Aunque potente, Istio puede ser complejo de instalar y gestionar, implicando un mayor esfuerzo administrativo.

   Source: Adapted from community discussion — 676ae1a

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

10. Question 240 · 277 in bank

    You have an Azure subscription that contains multiple Azure Blob Storage accounts. You need to recommend a solution to detect threats in files after the files are uploaded to a blob container. What should you include in the recommendation?

    • Asensitive data threat detection in Microsoft Defender for Storage
    • Bruntime threat protection in Microsoft Defender for Containers
    • Cvulnerability assessment in Microsoft Defender for Containers
    • Dmalware scanning in Microsoft Defender for Storage

    Show answer

    Answer: D

    Explanation

    Malware scanning improves the security of your Azure Storage accounts by detecting and mitigating malware threats. After uploading the blob --> on-demand malware scanning. https://learn.microsoft.com/en-us/azure/defender-for-cloud/introduction-malware-scanning

    Source: Adapted from community discussion — 424ede1

    References

    • Microsoft Learn

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SC-100 practice, question 231. 277 questions available.