SC-100 practice questions 251–260

1. Question 251 · 277 in bank

   Your company has an Azure subscription that uses Azure Storage. The company plans to share specific blobs with vendors. You need to recommend a solution to provide the vendors with secure access to specific blobs without exposing the blobs publicly. The access must be time- limited. What should you include in the recommendation?

   • AConfigure private link connections.
   • BConfigure encryption by using customer-managed keys (CMKs).
   • CShare the connection string of the access key.
   • DCreate shared access signatures (SAS).

   Show answer

   Answer: D

   Explanation

   https://docs.microsoft.com/en-us/azure/storage/common/storage-sas-overview. A shared access signature (SAS) provides secure delegated access to resources in your storage account. With a SAS, you have granular control over how a client can access your data. For example: 1. What resources the client may access. 2. What permissions they have to those resources. 3. How long the SAS is valid.

   Source: Adapted from community discussion — TheMCT

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

2. Question 252 · 277 in bank

   Your company wants to optimize using Microsoft Defender for Endpoint to protect its resources against ransomware based on Microsoft Security Best Practices. You need to prepare a post-breach response plan for compromised computers based on the Microsoft Detection and Response Team (DART) approach in Microsoft Security Best Practices. What should you include in the response plan?

   • Acontrolled folder access
   • Bapplication isolation
   • Cmemory scanning
   • Dmachine isolation
   • Euser isolation

   Show answer

   Answer: D

   Explanation

   I agree with D. Machine Isolation as per MS doc: "Isolate compromised systems from the network, but don't shut them off." https://learn.microsoft.com/en-us/security/operations/incident-response-playbook-dart-ransomware-approach#containment

   Source: Adapted from community discussion — cris_exam

   References

   • Microsoft Learn

   Next question

3. Question 253 · 277 in bank

   HOTSPOT - You need to recommend a strategy for securing the litware.com forest. The solution must meet the identity requirements. What should you include in the recommendation? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: Identity Protection https://docs.microsoft.com/en-us/defender-cloud-apps/aadip-integration#configure-identity-protection-policies Box 2: Lockout policy The case study scenario says "Azure AD Connect is used to implement pass-through authentication." The link below explains "Smart lockout can be integrated with hybrid deployments that use password hash sync or pass-through authentication to protect on-premises Active Directory Domain Services (AD DS) accounts from being locked out by attackers. By setting smart lockout policies in Azure AD appropriately, attacks can be filtered out before they reach on-premises AD DS." https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-password-smart-lockout#how-smart-lockout-works Any other solution relies on AD FS. Since the case study doesn't say anything about AD FS, use the lockout policy as described. That's my last comment, I'm taking the exam in 20 minutes. Thank you all and good day.

   Source: Adapted from community discussion — PlumpyTumbler

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

4. Question 254 · 277 in bank

   Select 2

   You have a Microsoft 365 subscription. You are designing a user access solution that follows the Zero Trust principles of the Microsoft Cybersecurity Reference Architectures (MCRA). You need to recommend a solution that automatically restricts access to Microsoft Exchange Online, SharePoint Online, and Teams in near-real-time (NRT) in response to the following Azure AD events: • A user account is disabled or deleted. • The password of a user is changed or reset. • All the refresh tokens for a user are revoked. • Multi-factor authentication (MFA) is enabled for a user. Which two features should you include in the recommendation? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

   • Acontinuous access evaluation
   • BAzure AD Application Proxy
   • Ca sign-in risk policy
   • DAzure AD Privileged Identity Management (PIM)
   • EConditional Access

   Show answer

   Answer: AE

   Explanation

   AE is the answer. https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/concept-continuous-access-evaluation Timely response to policy violations or security issues really requires a "conversation" between the token issuer (Azure AD), and the relying party (enlightened app). This two-way conversation gives us two important capabilities. The relying party can see when properties change, like network location, and tell the token issuer. It also gives the token issuer a way to tell the relying party to stop respecting tokens for a given user because of account compromise, disablement, or other concerns. The mechanism for this conversation is continuous access evaluation (CAE). The goal for critical event evaluation is for response to be near real time, but latency of up to 15 minutes may be observed because of event propagation time; however, IP locations policy enforcement is instant.

   Source: Adapted from community discussion — zellck

   References

   • Microsoft Learn

   Next question

5. Question 255 · 277 in bank

   HOTSPOT - You have an Azure subscription and an on-premises datacenter. The datacenter contains 100 servers that run Windows Server. All the servers are backed up to a Recovery Services vault by using Azure Backup and the Microsoft Azure Recovery Services (MARS) agent. You need to design a recovery solution for ransomware attacks that encrypt the on-premises servers. The solution must follow Microsoft Security Best Practices and protect against the following risks: • A compromised administrator account used to delete the backups from Azure Backup before encrypting the servers • A compromised administrator account used to disable the backups on the MARS agent before encrypting the servers What should you use for each risk? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   From ChatGPT: For deleted backups, I would recommend using a security PIN for critical operations - to prevent a compromised administrator account from deleting the backups. This adds an additional layer of security to prevent unauthorized access to the backups. For disabled backups, I would recommend using Multi-user authorization by using Resource Guard - to prevent a compromised administrator account from disabling the backups. This allows you to specify which users are authorized to perform critical operations and limits the scope of potential attacks.

   Source: Adapted from community discussion — MaciekMT

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

6. Question 256 · 277 in bank

   You have an Azure subscription. You plan to deploy Azure Kubernetes Service (AKS) clusters that will be used to host web services. You need to recommend an ingress controller solution that will protect the hosted web services. What should you include in the recommendation?

   • AAzure Load Balancer
   • BAzure Application Gateway
   • CAzure Front Door
   • DAzure Firewall

   Show answer

   Answer: B

   Next question

7. Question 257 · 277 in bank

   You have an operational model based on the Microsoft Cloud Adoption Framework for Azure. You need to recommend a solution that focuses on cloud-centric control areas to protect resources such as endpoints, databases, files, and storage accounts. What should you include in the recommendation?

   • Abusiness resilience
   • Bmodem access control
   • Cnetwork isolation
   • Dsecurity baselines in the Microsoft Cloud Security Benchmark

   Show answer

   Answer: D

   Explanation

   D is the answer. https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/govern/security-baseline Security baseline is one of the Five Disciplines of Cloud Governance within the Cloud Adoption Framework governance model. Security is a component of any IT deployment, and the cloud introduces unique security concerns. Many businesses are subject to regulatory requirements that make protecting sensitive data a major organizational priority when considering a cloud transformation. Identifying potential security threats to your cloud environment and establishing processes and procedures for addressing these threats should be a priority for any IT security or cybersecurity team. The Security Baseline discipline ensures technical requirements and security constraints are consistently applied to cloud environments, as those requirements mature.

   Source: Adapted from community discussion — zellck

   References

   • Microsoft Learn

   Next question

8. Question 258 · 277 in bank

   HOTSPOT - You need to recommend a SIEM and SOAR strategy that meets the hybrid requirements, the Microsoft Sentinel requirements, and the regulatory compliance requirements. What should you recommend? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: Azure tenant - Microsoft Sentinel multiple workspace architecture There are cases where a single SOC (Security Operations Center) needs to centrally manage and monitor multiple Microsoft Sentinel workspaces, potentially across Azure Active Directory (Azure AD) tenants. An MSSP Microsoft Sentinel Service. A global SOC serving multiple subsidiaries, each having its own local SOC. A SOC monitoring multiple Azure AD tenants within an organization. To address these cases, Microsoft Sentinel offers multiple-workspace capabilities that enable central monitoring, configuration, and management, providing a single pane of glass across everything covered by the SOC. This diagram shows an example architecture for such use cases. This model offers significant advantages over a fully centralized model in which all data is copied to a single workspace. Scenario: Requirements. Microsoft Sentinel Requirements Litware plans to leverage the security information and event management (SIEM) and security orchestration automated response (SOAR) capabilities of Microsoft Sentinel. The company wants to centralize Security Operations Center (SOC) by using Microsoft Sentinel. Hybrid Requirements - Litware identifies the following hybrid cloud requirements: Provide centralized, cross-tenant subscription management without the overhead of maintaining guest accounts. Box 2: Azure Lighthouse subscription onboarding process You can use Azure Lighthouse to extend all cross-workspace activities across tenant boundaries, allowing users in your managing tenant to work on Microsoft Sentinel workspaces across all tenants. Azure Lighthouse enables you to see and manage Azure resources from different tenancies, in the one place, with the power of delegated administration. That tenancy may be a customer (for example, if you're a managed services provider with a support contract arrangement in place), or a separate Azure environment for legal or financial reasons (like franchisee groups or Enterprises with large brand groups). Incorrect: * not Azure AD B2B Azure AD B2B uses guest account, which goes against the requirements in this scenario, Note: Azure Active Directory (Azure AD) B2B collaboration is a feature within External Identities that lets you invite guest users to collaborate with your organization. Reference: https://docs.microsoft.com/en-us/azure/sentinel/extend-sentinel-across-workspaces-tenants https://docs.microsoft.com/en-us/azure/sentinel/best-practices-workspace-architecture https://techcommunity.microsoft.com/t5/itops-talk-blog/onboarding-to-azure-lighthouse-using-a-template/ba-p/1091786 https://docs.microsoft.com/en-us/azure/active-directory/external-identities/what-is-b2b

   Source: Adapted from community discussion — PlumpyTumbler

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

9. Question 259 · 277 in bank

   HOTSPOT - You need to recommend a multi-tenant and hybrid security solution that meets to the business requirements and the hybrid requirements. What should you recommend? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   1. Azure Lighthouse 2. Azure Arc https://learn.microsoft.com/en-us/azure/lighthouse/overview Azure Lighthouse enables multi-tenant management with scalability, higher automation, and enhanced governance across resources. With Azure Lighthouse, service providers can deliver managed services using comprehensive and robust tooling built into the Azure platform. Customers maintain control over who has access to their tenant, which resources they can access, and what actions can be taken. Enterprise organizations managing resources across multiple tenants can use Azure Lighthouse to streamline management tasks.

   Source: Adapted from community discussion — zellck

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

10. Question 260 · 277 in bank

    HOTSPOT - You use Azure Policy with Azure Repos to implement continuous integration and continuous deployment (CI/CD) workflows. You need to recommend best practices to secure the stages of the CI/CD workflows based on the Microsoft Cloud Adoption Framework for Azure. What should you include in the recommendation for each stage? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer: See figure below

    Explanation

    1. Protected branches 2. Azure Key Vault https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/secure/best-practices/secure-devops#restrict-access-to-protected-branches https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/secure/best-practices/secure-devops#azure-key-vault If your CI platform supports it, consider storing credentials in a dedicated secret store, for example Azure Key Vault. Credentials are fetched at runtime by the build agent and your attack surface is reduced.

    Source: Adapted from community discussion — zellck

    References

    • Microsoft Learn

    

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SC-100 practice, question 251. 277 questions available.