SC-100 practice questions 261–270

1. Question 261 · 277 in bank

   HOTSPOT - Your company wants to optimize using Azure to protect its resources from ransomware. You need to recommend which capabilities of Azure Backup and Azure Storage provide the strongest protection against ransomware attacks. The solution must follow Microsoft Security Best Practices. What should you recommend? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   1. Security PIN 2. Immutable storage https://learn.microsoft.com/en-us/azure/security/fundamentals/backup-plan-to-protect-against-ransomware#azure-backup Checks have been added to make sure only valid users can perform various operations. These include adding an extra layer of authentication. As part of adding an extra layer of authentication for critical operations, you're prompted to enter a security PIN before modifying online backups. https://learn.microsoft.com/en-us/azure/security/fundamentals/backup-plan-to-protect-against-ransomware#steps-to-take-before-an-attack Online immutable storage (such as Azure Blob) enables you to store business-critical data objects in a WORM (Write Once, Read Many) state. This state makes the data non-erasable and non-modifiable for a user-specified interval.

   Source: Adapted from community discussion — zellck

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

2. Question 262 · 277 in bank

   You need to recommend a solution for securing the landing zones. The solution must meet the landing zone requirements and the business requirements. What should you configure for each landing zone?

   • Aan ExpressRoute gateway
   • BMicrosoft Defender for Cloud
   • Can Azure Private DNS zone
   • DAzure DDoS Protection Standard

   Show answer

   Answer: B

   Explanation

   A. an ExpressRoute gateway <-- Not that it'd be advised, but one could employ a VPN Gateway instead between landing zones and achieve the hub-spoke landing zone architecture outcome. https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-vnet-vnet-resource-manager-portal B. Microsoft Defender for Cloud <-- Mandated given the requirement for Secure Score per Landing Zone C. an Azure Private DNS zone <-- Instead of Azure Private DNS zone, one could configure DNS queries to be forwarded to a self-operated DNS server in the hub to satisfy the litware.com zone requirement. Not recommended, but just to illustrate that 'Azure Private DNS zone' may not be mandatory. D. Azure DDoS Protection Standard <-- unrelated to the question

   Source: Adapted from community discussion — lt9898

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

3. Question 263 · 277 in bank

   You have an Azure AD tenant that syncs with an Active Directory Domain Services (AD DS) domain. You have an on-premises datacenter that contains 100 servers. The servers run Windows Server and are backed up by using Microsoft Azure Backup Server (MABS). You are designing a recovery solution for ransomware attacks. The solution follows Microsoft Security Best Practices. You need to ensure that a compromised administrator account cannot be used to delete the backups. What should you do?

   • AFrom Azure Backup, configure multi-user authorization by using Resource Guard.
   • BFrom Microsoft Azure Backup Setup, register MABS with a Recovery Services vault.
   • CFrom a Recovery Services vault, generate a security PIN for critical operations.
   • DFrom Azure AD Privileged Identity Management (PIM), create a role assignment for the Backup Contributor role.

   Show answer

   Answer: A

   Explanation

   MUA for Azure Backup uses a new resource called the Resource Guard to ensure critical operations, such as disabling soft delete, stopping and deleting backups, or reducing retention of backup policies, are performed only with applicable authorization. ref: https://learn.microsoft.com/en-us/azure/backup/protect-backups-from-ransomware-faq

   Source: Adapted from community discussion — DashRyde

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

4. Question 264 · 277 in bank

   You are designing a ransomware response plan that follows Microsoft Security Best Practices. You need to recommend a solution to limit the scope of damage of ransomware attacks without being locked out. What should you include in the recommendation?

   • Adevice compliance policies
   • BPrivileged Access Workstations (PAWs)
   • CCustomer Lockbox for Microsoft Azure
   • Demergency access accounts

   Show answer

   Answer: B

   Explanation

   B is the answer. https://learn.microsoft.com/en-us/security/privileged-access-workstations/privileged-access-devices#device-roles-and-profiles Privileged Access Workstation (PAW) – This is the highest security configuration designed for extremely sensitive roles that would have a significant or material impact on the organization if their account was compromised. The PAW configuration includes security controls and policies that restrict local administrative access and productivity tools to minimize the attack surface to only what is absolutely required for performing sensitive job tasks. This makes the PAW device difficult for attackers to compromise because it blocks the most common vector for phishing attacks: email and web browsing. To provide productivity to these users, separate accounts and workstations must be provided for productivity applications and web browsing. While inconvenient, this is a necessary control to protect users whose account could inflict damage to most or all resources in the organization.

   Source: Adapted from community discussion — zellck

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

5. Question 265 · 277 in bank

   You design cloud-based software as a service (SaaS) solutions. You need to recommend a recovery solution for ransomware attacks. The solution must follow Microsoft Security Best Practices. What should you recommend doing first?

   • ADevelop a privileged identity strategy.
   • BImplement data protection.
   • CDevelop a privileged access strategy.
   • DPrepare a recovery plan.

   Show answer

   Answer: D

   Explanation

   I vote for D - creating recovery plan. 1.Recognize different types of ransomware 2.Help an organization mitigate risk of a ransomware attack by creating a recovery plan 3.Help an organization mitigate risk of a ransomware attack by limiting the scope of damage 4.Help an organization mitigate risk of a ransomware attack by hardening key infrastructure elements https://learn.microsoft.com/en-us/training/modules/recommend-ransomware-strategy-by-using-microsoft-security-best-practices/

   Source: Adapted from community discussion — MaciekMT

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

6. Question 266 · 277 in bank

   HOTSPOT - You need to recommend a security methodology for a DevOps development process based on the Microsoft Cloud Adoption Framework for Azure. During which stage of a continuous integration and continuous deployment (CI/CD) DevOps process should each security-related task be performed? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   1. Plan and develop 2. Operate 3. Build and test https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/secure/devsecops-controls#plan-and-develop Typically, modern development follows an agile development methodology. Scrum is one implementation of agile methodology that has every sprint start with a planning activity. Introducing security into this part of the development process should focus on: - Threat modeling to view the application through the lens of a potential attacker - IDE security plug-ins and pre-commit hooks for lightweight static analysis checking within an integrated development environment (IDE). - Peer reviews and secure coding standards to identify effective security coding standards, peer review processes, and pre-commit hooks.

   Source: Adapted from community discussion — zellck

   References

   • Microsoft Learn

   

   Next question

7. Question 267 · 277 in bank

   You use Azure Pipelines with Azure Repos to implement continuous integration and continuous deployment (CI/CD) workflows for the deployment of applications to Azure. You need to recommend what to include in dynamic application security testing (DAST) based on the principles of the Microsoft Cloud Adoption Framework for Azure. What should you recommend?

   • Aunit testing
   • Bpenetration testing
   • Cdependency checks
   • Dthreat modeling

   Show answer

   Answer: B

   Explanation

   B is the answer. https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/secure/devsecops-controls#dynamic-application-security-testing A penetration test consists of several action points, one of which is dynamic application security testing (DAST). DAST is a web application security test that finds security issues in the running application by seeing how the application responds to specially crafted requests. DAST tools are also known as web application vulnerability scanners.

   Source: Adapted from community discussion — zellck

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

8. Question 268 · 277 in bank

   HOTSPOT - What should you create in Azure AD to meet the Contoso developer requirements? Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: A synced user account - Need to use a synched user account. Incorrect: * Not A user account in the fabrikam.onmicrosoft.com tenant The Contoso developers must use their existing contoso.onmicrosoft.com credentials to access the resources in Sub1. * Guest accounts would not meet the requirements. Note: Developers at Contoso will connect to the resources of Fabrikam to test or update applications. The developers will be added to a security group named ContosoDevelopers in fabrikam.onmicrosoft.com that will be assigned to roles in Sub1. The ContosoDevelopers group is assigned the db_owner role for the ClaimsDB database. Contoso Developers Requirements - Fabrikam identifies the following requirements for the Contoso developers: Every month, the membership of the ContosoDevelopers group must be verified. The Contoso developers must use their existing contoso.onmicrosoft.com credentials to access the resources in Sub1. The Contoso developers must be prevented from viewing the data in a column named MedicalHistory in the ClaimDetails table. Box 2: An access review - Scenario: Every month, the membership of the ContosoDevelopers group must be verified. Azure Active Directory (Azure AD) access reviews enable organizations to efficiently manage group memberships, access to enterprise applications, and role assignments. User's access can be reviewed on a regular basis to make sure only the right people have continued access. Access review is part of Azure AD Identity governance. Reference: https://docs.microsoft.com/en-us/azure/active-directory-domain-services/synchronization https://docs.microsoft.com/en-us/azure/active-directory/governance/access-reviews-overview

   Source: Adapted from community discussion — SkippyTheMagnificent

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

9. Question 269 · 277 in bank

   You need to recommend a solution to meet the security requirements for the InfraSec group. What should you use to delegate the access?

   • Aa subscription
   • Ba custom role-based access control (RBAC) role
   • Ca resource group
   • Da management group

   Show answer

   Answer: B

   Explanation

   B is the answer. https://learn.microsoft.com/en-us/azure/role-based-access-control/custom-roles If the Azure built-in roles don't meet the specific needs of your organization, you can create your own custom roles. Just like built-in roles, you can assign custom roles to users, groups, and service principals at management group, subscription, and resource group scopes.

   Source: Adapted from community discussion — zellck

   References

   • Microsoft Learn

   Next question

10. Question 270 · 277 in bank

    HOTSPOT - You need to recommend a solution to meet the AWS requirements. What should you include in the recommendation? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer: See figure below

    Explanation

    The requirement is to identify EC2 instances which are noncompliant with secure score recommendations. Secure Score = Defender for Cloud.

    Source: Adapted from community discussion — d3an

    References

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SC-100 practice, question 261. 277 questions available.