SC-100 practice questions 241–250

1. Question 241 · 277 in bank

   You have an Azure subscription. You plan to deploy Azure App Services apps by using Azure DevOps. You need to recommend a solution to ensure that deployed apps maintain compliance with Microsoft cloud security benchmark (MCSB) recommendations. What should you include in the recommendation?

   • ADevOps security in Microsoft Defender for Cloud
   • BMicrosoft Defender for App Service
   • CAzure Policy
   • Da branch policy in Azure DevOps

   Show answer

   Answer: C

   Explanation

   Azure Policy allows you to enforce rules and guidelines to ensure that deployed apps and resources maintain compliance with Microsoft Cloud Security Benchmark (MCSB) recommendations

   Source: Adapted from community discussion — Ali96

   References

   • Microsoft Learn

   Next question

2. Question 242 · 277 in bank

   HOTSPOT - Your company has two offices named Office1 and Office2. The offices contain 1,000 on-premises Windows 11 devices that are Microsoft Entra joined. You have a Microsoft 365 subscription and use Microsoft Intune. You plan to deploy Microsoft Entra Internet Access from the offices to Microsoft 365. You enable the Microsoft 365 profile and configure the following: • A traffic policy for all Microsoft 365 traffic • A linked Conditional Access policy that has the following configurations: o Applies to all users o Performs compliant network checks o Allows Microsoft 365 traffic from compliant devices • An assignment to all devices • An assignment to the remote network associated with Office1 You deploy the Global Secure Access client to all the devices in Office2 and establish connections. Which users can access Microsoft 365 services from compliant devices, and which users are blocked from accessing Microsoft 365 services when using noncompliant devices? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   

   Next question

3. Question 243 · 277 in bank

   HOTSPOT - You have an Azure subscription that contains multiple storage accounts. The accounts contain Azure Files shares and Azure Blob Storage containers. The accounts have encryption scopes and infrastructure encryption enabled. You need to implement customer-managed key-based encryption for the shares and the containers. The solution must ensure that the encryption keys are applied at the most granular level. At which level should you apply the encryption keys? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   References

   • Microsoft Learn

   

   Next question

4. Question 244 · 277 in bank

   HOTSPOT - You have an Azure subscription. You plan to implement Azure Synapse Analytics SQL dedicated pools and SQL serverless pools. You need to recommend a solution to provide additional encryption-at-rest security for each type of pool. The solution must use customer-managed keys, whenever possible. What should you recommend for each pool type? To answer, drag the appropriate recommendations to the correct pool types. Each recommendation may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Serverless SQL pool has to be 'Azure Storage Infrastructure Encryption w/ Microsoft Managed Keys' because TDE isn’t supported on Serverless - https://learn.microsoft.com/en-us/azure/synapse-analytics/sql/overview-features#security

   Source: Adapted from community discussion — cl1984

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

5. Question 245 · 277 in bank

   DRAG DROP - You have an Azure subscription that contains a resources group named RG1. RG1 contains multiple Azure Files shares. You need to recommend a solution to deploy a backup solution for the shares. The solution must meet the following requirements: • Prevent the deletion of backups and the vault used to store the backups. • Prevent privilege escalation attacks against the backup solution. • Prevent the modification of the backup retention period. Which three actions should you recommend be performed in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   

   Next question

6. Question 246 · 277 in bank

   You are creating an application lifecycle management process based on the Microsoft Security Development Lifecycle (SDL). You need to recommend a security standard for onboarding applications to Azure. The standard will include recommendations for application design, development, and deployment. What should you include during the application design phase?

   • Asoftware decomposition by using Microsoft Visual Studio Enterprise
   • Bdynamic application security testing (DAST) by using Veracode
   • Cthreat modeling by using the Microsoft Threat Modeling Tool
   • Dstatic application security testing (SAST) by using SonarQube

   Show answer

   Answer: C

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

7. Question 247 · 277 in bank

   HOTSPOT - You have a Microsoft 365 E5 subscription. You plan to deploy Global Secure Access universal tenant restrictions v2. Which authentication plane resources and which data plane resources will be protected? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Authentication plane resources: All Microsoft Entra ID integrated apps, including third-party apps Data plane resources: Microsoft SharePoint Online and Exchange Online only

   Source: Adapted from community discussion — AlbertE1nstein

   References

   • Microsoft Learn

   

   Next question

8. Question 248 · 277 in bank

   DRAG DROP - Your company has Microsoft 365 E5 licenses and Azure subscriptions. The company plans to automatically label sensitive data stored in the following locations: ✑ Microsoft SharePoint Online ✑ Microsoft Exchange Online ✑ Microsoft Teams You need to recommend a strategy to identify and protect sensitive data. Which scope should you recommend for the sensitivity label policies? To answer, drag the appropriate scopes to the correct locations. Each scope may only be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   To me is group and sites for teams and sharepoint then for exchange file and emails https://docs.microsoft.com/en-us/microsoft-365/compliance/sensitivity-labels?view=o365-worldwide Go to label scopes

   Source: Adapted from community discussion — Gar23

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

9. Question 249 · 277 in bank

   Your company is developing a new Azure App Service web app. You are providing design assistance to verify the security of the web app. You need to recommend a solution to test the web app for vulnerabilities such as insecure server configurations, cross-site scripting (XSS), and SQL injection. What should you include in the recommendation?

   • Adynamic application security testing (DAST)
   • Bstatic application security testing (SAST)
   • Cinteractive application security testing (IAST)
   • Druntime application self-protection (RASP)

   Show answer

   Answer: A

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

10. Question 250 · 277 in bank

    Your company develops several applications that are accessed as custom enterprise applications in Azure Active Directory (Azure AD). You need to recommend a solution to prevent users on a specific list of countries from connecting to the applications. What should you include in the recommendation?

    • Aactivity policies in Microsoft Defender for Cloud Apps
    • Bsign-in risk policies in Azure AD Identity Protection
    • CAzure AD Conditional Access policies
    • Ddevice compliance policies in Microsoft Endpoint Manager
    • Euser risk poticies in Azure AD Identity Protection

    Show answer

    Answer: C

    Explanation

    C is the answer. https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/overview#common-signals Common signals that Conditional Access can take in to account when making a policy decision include the following signals: IP Location information - Organizations can create trusted IP address ranges that can be used when making policy decisions. - Administrators can specify entire countries/regions IP ranges to block or allow traffic from.

    Source: Adapted from community discussion — zellck

    References

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SC-100 practice, question 241. 277 questions available.