Microsoft Cybersecurity Architect277 questions across 28 pages are complete and free, with no account or card.
277 questions in this bank
Free access · progress saved on this device
You need to recommend a solution to resolve the virtual machine issue. What should you include in the recommendation?
Answer: A
This came out on the actual exam today (09/19/2022), and it requires two answers: I selected A. Enable the Qualys scanner in Defender for Cloud. B. Onboard the virtual machines to Microsoft Defender for Endpoint. Passed with a score of 94X.
Source: Adapted from community discussion — zts
You need to recommend a solution to meet the security requirements for the virtual machines. What should you include in the recommendation?
Answer: C
The security requirement this question wants us to meet is "The secure host must be provisioned from a custom operating system image." https://docs.microsoft.com/en-us/azure/virtual-desktop/set-up-golden-image
Source: Adapted from community discussion — PlumpyTumbler
HOTSPOT - You need to recommend a solution to meet the compliance requirements. What should you include in the recommendation? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:
This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.
Answer: See figure below
The question is about what you can use to enforce compliance to regulatory standards not to remediate non-compliance - A Blueprint is Correct. Azure Blueprints are used to enforce standards.
Source: Adapted from community discussion — TheMCT
HOTSPOT - You need to recommend a solution to evaluate regulatory compliance across the entire managed environment. The solution must meet the regulatory compliance requirements and the business requirements. What should you recommend? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:
This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.
Answer: See figure below
Box 1: Azure Policy initiatives to management groups If your organization has many Azure subscriptions, you may need a way to efficiently manage access, policies, and compliance for those subscriptions. Management groups provide a governance scope above subscriptions. You organize subscriptions into management groups the governance conditions you apply cascade by inheritance to all associated subscriptions. If you plan to apply a policy definition to multiple subscriptions, the location must be a management group that contains the subscriptions you assign the policy to. The same is true for an initiative definition. With an initiative definition, you can group several policy definitions to achieve one overarching goal. An initiative evaluates resources within scope of the assignment for compliance to the included policies. Incorrect: Not: Azure Policy initiatives to subscriptions Must use a management group as we have multiple subscriptions. Scenario: Requirements. Business Requirements Litware identifies the following business requirements: ג€¢ Minimize any additional on-premises infrastructure. ג€¢ Minimize the operational costs associated with administrative overhead. Box 2: Azure Arc - With Azure Arc: Meet governance and compliance standards for apps, infrastructure, and data with Azure Policy. Take advantage of elastic scale, consistent on-premises and multicloud management, and cloud-style billing models. Note: Azure Arc is a bridge that extends the Azure platform to help you build applications and services with the flexibility to run across datacenters, at the edge, and in multicloud environments. Develop cloud-native applications with a consistent development, operations, and security model. Azure Arc runs on both new and existing hardware, virtualization and Kubernetes platforms, IoT devices, and integrated systems. Reference: https://docs.microsoft.com/en-us/azure/governance/management-groups/overview https://azure.microsoft.com/en-us/services/azure-arc/#product-overview
Source: Adapted from community discussion — zellck
You need to recommend a strategy for routing internet-bound traffic from the landing zones. The solution must meet the landing zone requirements. What should you recommend as part of the landing zone deployment?
Answer: C
Chatgpt explanation for using Forced tunneling: According to the requirements for the landing zone architecture, all internet-bound traffic from landing zones should be routed through Azure Firewall in a dedicated Azure subscription. To meet this requirement, you can use forced tunneling which is a feature of Azure VPN gateways. Forced tunneling sends all traffic through the VPN tunnel, regardless of the destination address. This ensures that all traffic is subjected to the security provided by the VPN gateway. Service chaining is not the correct option because it is used to direct traffic from one virtual network to a virtual appliance, or virtual network gateway, in a peered virtual network, through another virtual appliance or virtual network gateway. It is not used for routing internet-bound traffic from landing zones through Azure Firewall in a dedicated Azure subscription. Forced tunneling is used to direct traffic from a virtual network to an on-premises location. However, it can also be used to route internet-bound traffic from landing zones through Azure Firewall in a dedicated Azure subscription.
Source: Adapted from community discussion — KallMeDan
HOTSPOT - You need to recommend a strategy for App Service web app connectivity. The solution must meet the landing zone requirements. What should you recommend? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:
This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.
Answer: See figure below
Box 1: Virtual network integration Integrate your app with an Azure virtual network. With Azure virtual networks, you can place many of your Azure resources in a non-internet-routable network. The App Service virtual network integration feature enables your apps to access resources in or through a virtual network. Box 2: Private endpoints - Ensure that the Azure virtual machines in each landing zone communicate with Azure App Service web apps in the same zone over the Microsoft backbone network, rather than over public endpoints. A virtual machine can connect to the web app across the private endpoint. Reference: https://docs.microsoft.com/en-us/azure/app-service/overview-vnet-integration https://docs.microsoft.com/en-us/azure/private-link/tutorial-private-endpoint-webapp-portal
Source: Adapted from community discussion — TheMCT
HOTSPOT - You need to recommend an identity security solution for the Azure AD tenant of Litware. The solution must meet the identity requirements and the regulatory compliance requirements. What should you recommend? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:
This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.
Answer: See figure below
Box 1: Azure AD administrative units Implement delegated management of users and groups in the Azure AD tenant of Litware, including support for: * The delegation of user management based on business units Without Azure AD administrative units, assigning a user to the User Administrator role in Azure AD gives them rights to manage all Azure AD users. With administrative units, the user is delegated the same role, User Administrator, but that role only applies to the specified administrative unit. The administrative unit contains the users and groups that are under the scope of management. Box 2: Enable password hash synchronization in the Azure AD Connect deployment Existing environment: Azure AD Connect is used to implement pass-through authentication. Password hash synchronization - Risk detections like leaked credentials require the presence of password hashes for detection to occur. Reference: https://4sysops.com/archives/an-introduction-to-azure-ad-administrative-units/ https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/concept-identity-protection-risks#password-hash-synchronization
Source: Adapted from community discussion — zellck
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
SC-100 practice, question 271. 277 questions available.
Version 1.0.0. How we source questions