SC-100 practice questions 41–50

1. Question 41 · 277 in bank

   Your company is moving all on-premises workloads to Azure and Microsoft 365. You need to design a security orchestration, automation, and response (SOAR) strategy in Microsoft Sentinel that meets the following requirements: ✑ Minimizes manual intervention by security operation analysts ✑ Supports triaging alerts within Microsoft Teams channels What should you include in the strategy?

   • AKQL
   • Bplaybooks
   • Cdata connectors
   • Dworkbooks

   Show answer

   Answer: B

   Explanation

   https://learn.microsoft.com/en-us/azure/sentinel/tutorial-respond-threats-playbook?tabs=LAC%2Cincidents Playbooks are collections of procedures that can be run from Microsoft Sentinel in response to an alert or incident. A playbook can help automate and orchestrate your response, and can be set to run automatically when specific alerts or incidents are generated, by being attached to an analytics rule or an automation rule, respectively. It can also be run manually on-demand. Playbooks in Microsoft Sentinel are based on workflows built in Azure Logic Apps, which means that you get all the power, customizability, and built-in templates of Logic Apps. Each playbook is created for the specific subscription to which it belongs, but the Playbooks display shows you all the playbooks available across any selected subscriptions.

   Source: Adapted from community discussion — AJ2021

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

2. Question 42 · 277 in bank

   Select 2

   You have an Azure subscription that contains virtual machines, storage accounts, and Azure SQL databases. All resources are backed up multiple times a day by using Azure Backup. You are developing a strategy to protect against ransomware attacks. You need to recommend which controls must be enabled to ensure that Azure Backup can be used to restore the resources in the event of a successful ransomware attack. Which two controls should you include in the recommendation? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.

   • AEnable soft delete for backups.
   • BRequire PINs for critical operations.
   • CEncrypt backups by using customer-managed keys (CMKs).
   • DPerform offline backups to Azure Data Box.
   • EUse Azure Monitor notifications when backup configurations change.

   Show answer

   Answer: AB

   Explanation

   AB is the answer. https://learn.microsoft.com/en-us/azure/backup/backup-azure-security-feature-cloud Concerns about security issues, like malware, ransomware, and intrusion, are increasing. These security issues can be costly, in terms of both money and data. To guard against such attacks, Azure Backup now provides security features to help protect backup data even after deletion. One such feature is soft delete. With soft delete, even if a malicious actor deletes a backup (or backup data is accidentally deleted), the backup data is retained for 14 additional days, allowing the recovery of that backup item with no data loss. The additional 14 days of retention for backup data in the "soft delete" state don't incur any cost to you. https://learn.microsoft.com/en-us/azure/backup/backup-azure-security-feature#authentication-to-perform-critical-operations

   Source: Adapted from community discussion — zellck

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

3. Question 43 · 277 in bank

   HOTSPOT - You are creating the security recommendations for an Azure App Service web app named App1. App1 has the following specifications: ✑ Users will request access to App1 through the My Apps portal. A human resources manager will approve the requests. ✑ Users will authenticate by using Azure Active Directory (Azure AD) user accounts. You need to recommend an access security architecture for App1. What should you include in the recommendation? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Answer is incorrect Box 1 is the Azure AD Application https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app Box 2 is Access Package in Identity Governance https://docs.microsoft.com/en-us/azure/active-directory/governance/entitlement-management-access-package-create

   Source: Adapted from community discussion — BillyB2022

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

4. Question 44 · 277 in bank

   HOTSPOT - You are evaluating the security of ClaimsApp. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: No - Box 2: Yes - Users will connect to ClaimsApp by using a URL of https://claims.fabrikam.com. Need certificate for HTTPS. TLS/SSL certificates - To enable the HTTPS protocol for securely delivering content on a Front Door custom domain, you must use a TLS/SSL certificate. You can choose to use a certificate that is managed by Azure Front Door or use your own certificate. Box 3: Yes - By default, Azure Front Door will respond to all user requests regardless of the location where the request is coming from. In some scenarios, you may want to restrict the access to your web application by countries/regions. The Web application firewall (WAF) service in Front Door enables you to define a policy using custom access rules for a specific path on your endpoint to either allow or block access from specified countries/regions. Note: Requirements. Security Requirements Fabrikam identifies the following security requirements: ג€¢ Internet-accessible applications must prevent connections that originate in North Korea. Reference: https://techcommunity.microsoft.com/t5/azure-architecture-blog/permit-access-only-from-azure-front-door-to-azure-app-service-as/ba-p/2000173 https://docs.microsoft.com/en-us/azure/frontdoor/front-door-custom-domain-https#tlsssl-certificates

   Source: Adapted from community discussion — emiliocb4

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

5. Question 45 · 277 in bank

   You need to recommend a solution to scan the application code. The solution must meet the application development requirements. What should you include in the recommendation?

   • AGitHub Advanced Security
   • BAzure Key Vault
   • CAzure DevTest Labs
   • DApplication Insights in Azure Monitor

   Show answer

   Answer: A

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

6. Question 46 · 277 in bank

   Select 2

   You need to design a strategy for securing the SharePoint Online and Exchange Online data. The solution must meet the application security requirements. Which two services should you leverage in the strategy? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

   • AAzure AD Conditional Access
   • Baccess reviews in Azure AD
   • CMicrosoft Defender for Cloud
   • DMicrosoft Defender for Cloud Apps
   • EMicrosoft Defender for Endpoint

   Show answer

   Answer: AD

   Explanation

   AD is the answer. https://learn.microsoft.com/en-us/azure/active-directory/conditional-access/overview The modern security perimeter now extends beyond an organization's network to include user and device identity. Organizations can use identity-driven signals as part of their access control decisions. Conditional Access brings signals together, to make decisions, and enforce organizational policies. Azure AD Conditional Access is at the heart of the new identity-driven control plane. https://learn.microsoft.com/en-us/defender-cloud-apps/protect-office-365 Connecting Office 365 to Defender for Cloud Apps gives you improved insights into your users' activities, provides threat detection using machine learning based anomaly detections, information protection detections (such as detecting external information sharing), enables automated remediation controls, and detects threats from enabled third-party apps in your organization.

   Source: Adapted from community discussion — zellck

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

7. Question 47 · 277 in bank

   Select 2

   To meet the application security requirements, which two authentication methods must the applications support? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.

   • ASecurity Assertion Markup Language (SAML)
   • BNTLMv2
   • Ccertificate-based authentication
   • DKerberos

   Show answer

   Answer: AD

   Explanation

   AD is the answer. https://learn.microsoft.com/en-us/azure/active-directory/app-proxy/application-proxy-configure-single-sign-on-on-premises-apps You can provide single sign-on (SSO) to on-premises applications that are secured with SAML authentication and provide remote access to these applications through Application Proxy. With SAML single sign-on, Azure Active Directory (Azure AD) authenticates to the application by using the user's Azure AD account. Azure AD communicates the sign-on information to the application through a connection protocol. You can also map users to specific application roles based on rules you define in your SAML claims. By enabling Application Proxy in addition to SAML SSO, your users will have external access to the application and a seamless SSO experience.

   Source: Adapted from community discussion — zellck

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

8. Question 48 · 277 in bank

   You need to recommend a solution to secure the MedicalHistory data in the ClaimsDetail table. The solution must meet the Contoso developer requirements. What should you include in the recommendation?

   • Arow-level security (RLS)
   • BTransparent Data Encryption (TDE)
   • CAlways Encrypted
   • Ddata classification
   • Edynamic data masking

   Show answer

   Answer: C

   Explanation

   Always Encrypted is a feature designed to protect sensitive data, such as credit card numbers or national identification numbers (for example, U.S. social security numbers), stored in Azure SQL Database, Azure SQL Managed Instance, and SQL Server databases. Always Encrypted allows clients to encrypt sensitive data inside client applications and never reveal the encryption keys to the Database Engine. This provides a separation between those who own the data and can view it, and those who manage the data but should have no access - on-premises database administrators, cloud database operators, or other high-privileged unauthorized users. As a result, Always Encrypted enables customers to confidently store their sensitive data in the cloud, and to reduce the likelihood of data theft by malicious insiders.

   Source: Adapted from community discussion — AKS2504

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

9. Question 49 · 277 in bank

   HOTSPOT - You need to recommend a solution to meet the requirements for connections to ClaimsDB. What should you recommend using for each requirement? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: A private endpoint - Scenario: An Azure SQL database named ClaimsDB that contains a table named ClaimDetails Requirements. ClaimsApp Deployment. Fabrikam plans to implement an internet-accessible application named ClaimsApp that will have the following specifications: ✑ ClaimsApp will be deployed to Azure App Service instances that connect to Vnet1 and Vnet2. Users will connect to ClaimsApp by using a URL of https://claims.fabrikam.com. ✑ ClaimsApp will access data in ClaimsDB. ✑ ClaimsDB must be accessible only from Azure virtual networks. ✑ The app services permission for ClaimsApp must be assigned to ClaimsDB. Web app private connectivity to Azure SQL Database. Architecture: Workflow - 1. Using Azure App Service regional VNet Integration, the web app connects to Azure through an AppSvcSubnet delegated subnet in an Azure Virtual Network. 2. In this example, the Virtual Network only routes traffic and is otherwise empty, but other subnets and workloads could also run in the Virtual Network. 3. The App Service and Private Link subnets could be in separate peered Virtual Networks, for example as part of a hub-and-spoke network configuration. 4. Azure Private Link sets up a private endpoint for the Azure SQL Database in the PrivateLinkSubnet of the Virtual Network. 5. The web app connects to the SQL Database private endpoint through the PrivateLinkSubnet of the Virtual Network. The database firewall allows only traffic coming from the PrivateLinkSubnet to connect, making the database inaccessible from the public internet. Box 2: A managed identity - Managed identities for Azure resources provide Azure services with an automatically managed identity in Azure Active Directory. Using a managed identity, you can authenticate to any service that supports Azure AD authentication without managing credentials. Reference: https://docs.microsoft.com/en-us/azure/architecture/example-scenario/private-web-app/private-web-app https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/managed-identities-status

   Source: Adapted from community discussion — JakeCallham

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

10. Question 50 · 277 in bank

    You are evaluating an Azure environment for compliance. You need to design an Azure Policy implementation that can be used to evaluate compliance without changing any resources. Which effect should you use in Azure Policy?

    • ADeny
    • BModify
    • CAppend
    • DDisabled

    Show answer

    Answer: D

    Explanation

    The question is misleadingly worded. The question asks which effect can be used to report on compliance without changing anything. The Azure Policy "effect" used to do this is "Audit", which is not one of the provided options. There isn't an "effect" setting in the choices that matches the criteria. However, "Disabled" and "Enabled" are the two Azure Policy "enforcement" setting options. If an Azure Policy's "enforcement" is set to "Disabled", any "effect" set on this Azure Policy will report but will not make changes. "Disabled" is the best answer available, although technically incorrect because "Disabled" isn't an Azure Policy "effect".

    Source: Adapted from community discussion — [Removed]

    References

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SC-100 practice, question 41. 277 questions available.