SC-100 practice questions 31–40

1. Question 31 · 277 in bank

   You have an Azure subscription. You plan to deploy enterprise-scale landing zones based on the Microsoft Cloud Adoption Framework for Azure. The deployment will include a single-platform landing zone for all shared services and three application landing zones that will each host a different Azure application. You need to recommend which resource to deploy to each landing zone. The solution must meet the Cloud Adoption Framework best-practice recommendations for enterprise-scale landing zones. What should you recommend?

   • Aan Azure firewall
   • Ban Azure virtual network gateway
   • Can Azure Private DNS zone
   • Dan Azure key vault

   Show answer

   Answer: D

   Explanation

   The question related to ent scale application landing zones from the document only shows Azure Key Vault in each one. Also, in the access section it states to “separate key vaults for each application environment in each region”. Pg 419

   Source: Adapted from community discussion — Er_01

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

2. Question 32 · 277 in bank

   HOTSPOT - You have 1,000 on-premises servers that run Windows Server 2022 and 500 on-premises servers that run Linux. You have an Azure subscription that contains the following resources: • A Log Analytics workspace • A Microsoft Defender Cloud Security Posture Management (CSPM) plan You need to deploy Update Management for the servers. What should you configure? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

3. Question 33 · 277 in bank

   HOTSPOT - You have an Active Directory Domain Services (AD DS) domain that contains a virtual desktop infrastructure (VDI). The VDI uses non-persistent images and cloned virtual machine templates. VDI devices are members of the domain. You have an Azure subscription that contains an Azure Virtual Desktop environment. The environment contains host pools that use a custom golden image. All the Azure Virtual Desktop deployments are members of a single Microsoft Entra Domain Services domain. You need to recommend a solution to deploy Microsoft Defender for Endpoint to the hosts. The solution must meet the following requirements: • Ensure that the hosts are onboarded to Defender for Endpoint during the first startup sequence. • Ensure that the Microsoft Defender portal contains a single entry for each deployed VDI host. • Minimize administrative effort. What should you recommend? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   1. For VDI: Add the Defender for Endpoint onboarding script to the virtual machine template. https://learn.microsoft.com/en-us/defender-endpoint/configure-endpoints-vdi 2. Add the Defender for Endpoint onboarding script to the golden image. https://learn.microsoft.com/en-us/defender-endpoint/onboard-windows-multi-session-device

   Source: Adapted from community discussion — 424ede1

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

4. Question 34 · 277 in bank

   You have 10 Azure subscriptions that contain 100 role-based access control (RBAC) role assignments. You plan to consolidate the role assignments. You need to recommend a solution to identify which role assignments were NOT used during the last 90 days. The solution must minimize administrative effort. What should you include in the recommendation?

   • AMicrosoft Defender for Cloud
   • BMicrosoft Entra access reviews
   • CMicrosoft Entra Privileged Identity Management (PIM)
   • DMicrosoft Entra Permissions Management

   Show answer

   Answer: D

   Explanation

   Wrong answer, correct is D. Access review is to see if users should still belong to groups, not to see if a role wasn't used in 90 days.

   Source: Adapted from community discussion — zpack

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

5. Question 35 · 277 in bank

   HOTSPOT - Your company is migrating data to Azure. The data contains Personally Identifiable Information (PII). The company plans to use Microsoft Information Protection for the PII data store in Azure. You need to recommend a solution to discover PII data at risk in the Azure resources. What should you include in the recommendation? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: Azure Purview - Microsoft Purview is a unified data governance service that helps you manage and govern your on-premises, multi-cloud, and software-as-a-service (SaaS) data. Microsoft Purview allows you to: Create a holistic, up-to-date map of your data landscape with automated data discovery, sensitive data classification, and end-to-end data lineage. Enable data curators to manage and secure your data estate. Empower data consumers to find valuable, trustworthy data. Box 2: Microsoft Defender for Cloud Microsoft Purview provides rich insights into the sensitivity of your data. This makes it valuable to security teams using Microsoft Defender for Cloud to manage the organization's security posture and protect against threats to their workloads. Data resources remain a popular target for malicious actors, making it crucial for security teams to identify, prioritize, and secure sensitive data resources across their cloud environments. The integration with Microsoft Purview expands visibility into the data layer, enabling security teams to prioritize resources that contain sensitive data. References: https://docs.microsoft.com/en-us/azure/purview/overview https://docs.microsoft.com/en-us/azure/purview/how-to-integrate-with-azure-security-products

   Source: Adapted from community discussion — zellck

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

6. Question 36 · 277 in bank

   You have a Microsoft Entra tenant that syncs with an Active Directory Domain Services (AD DS) domain. You have an on-premises datacenter that contains 100 servers. The servers run Windows Server and are backed up by using Microsoft Azure Backup Server (MABS). You are designing a recovery solution for ransomware attacks. The solution follows Microsoft Security Best Practices. You need to ensure that a compromised local administrator account cannot be used to stop scheduled backups. What should you do?

   • AFrom Azure Backup, configure multi-user authorization by using Resource Guard.
   • BFrom Microsoft Entra Privileged Identity Management (PIM), create a role assignment for the Backup Contributor role.
   • CFrom Microsoft Azure Backup Setup, register MABS with a Recovery Services vault.
   • DFrom a Recovery Services vault, generate a security PIN for critical operations.

   Show answer

   Answer: A

   Explanation

   Ransomware Protection and Multi-User Authorization Microsoft recommends enabling multi-user authorization (MUA) to protect backup configurations from unauthorized changes. Resource Guard allows you to enforce MUA for critical backup operations, ensuring that a compromised administrator account alone cannot modify or disable backups without additional authorization.

   Source: Adapted from community discussion — SMHcalicut

   Next question

7. Question 37 · 277 in bank

   HOTSPOT - You have an Azure subscription that contains multiple Azure Storage blobs and Azure Files shares. You need to recommend a security solution for authorizing access to the blobs and shares. The solution must meet the following requirements: • Support access to the shares by using the SMB protocol. • Limit access to the blobs to specific periods of time. • Include authentication support when possible. What should you recommend for each resource? To answer, select the options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Blob: User delegation shared access signatures (SAS) Share: Microsoft Entra Domain Services When SAS authorization is necessary (access for limited time), Microsoft recommends using user delegation SAS for limited delegated access to blob resources. https://learn.microsoft.com/en-us/azure/storage/common/authorize-data-access?tabs=blobs#authorization-for-data-operations

   Source: Adapted from community discussion — 424ede1

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

8. Question 38 · 277 in bank

   DRAG DROP - You need to design a solution to accelerate a Zero Trust security implementation. The solution must be based on the Zero Trust Rapid Modernization Plan (RaMP). Which three initiatives should you include in the solution, and in which order should you implement the initiatives? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

9. Question 39 · 277 in bank

   You have a Microsoft 365 E5 subscription and an Azure subscription. You are designing a Microsoft deployment. You need to recommend a solution for the security operations team. The solution must include custom views and a dashboard for analyzing security events. What should you recommend using in Microsoft Sentinel?

   • Anotebooks
   • Bplaybooks
   • Cworkbooks
   • Dthreat intelligence

   Show answer

   Answer: C

   Explanation

   C is the answer. https://learn.microsoft.com/en-us/azure/sentinel/monitor-your-data Once you have connected your data sources to Microsoft Sentinel, you can visualize and monitor the data using the Microsoft Sentinel adoption of Azure Monitor Workbooks, which provides versatility in creating custom dashboards. While the Workbooks are displayed differently in Microsoft Sentinel, it may be useful for you to see how to create interactive reports with Azure Monitor Workbooks. Microsoft Sentinel allows you to create custom workbooks across your data, and also comes with built-in workbook templates to allow you to quickly gain insights across your data as soon as you connect a data source.

   Source: Adapted from community discussion — zellck

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

10. Question 40 · 277 in bank

    Your company has a Microsoft 365 subscription and uses Microsoft Defender for Identity. You are informed about incidents that relate to compromised identities. You need to recommend a solution to expose several accounts for attackers to exploit. When the attackers attempt to exploit the accounts, an alert must be triggered. Which Defender for Identity feature should you include in the recommendation?

    • Asensitivity labels
    • Bcustom user tags
    • Cstandalone sensors
    • Dhoneytoken entity tags

    Show answer

    Answer: D

    Explanation

    Ans is correct as The Sensitive tag is used to identify high value assets.(user / devices / groups)Honeytoken entities are used as traps for malicious actors. Any authentication associated with these honeytoken entities triggers an alert. and Defender for Identity considers Exchange servers as high-value assets and automatically tags them as Sensitive

    Source: Adapted from community discussion — prabhjot

    References

    • Microsoft Learn
    • Microsoft Learn

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SC-100 practice, question 31. 277 questions available.