SC-100 practice questions 51–60

1. Question 51 · 277 in bank

   Select 2

   You are designing security for an Azure landing zone. Your company identifies the following compliance and privacy requirements: ✑ Encrypt cardholder data by using encryption keys managed by the company. ✑ Encrypt insurance claim files by using encryption keys hosted on-premises. Which two configurations meet the compliance and privacy requirements? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

   • AStore the cardholder data in an Azure SQL database that is encrypted by using Microsoft-managed keys.
   • BStore the insurance claim data in Azure Blob storage encrypted by using customer-provided keys.
   • CStore the cardholder data in an Azure SQL database that is encrypted by using keys stored in Azure Key Vault Managed HSM.
   • DStore the insurance claim data in Azure Files encrypted by using Azure Key Vault Managed HSM.

   Show answer

   Answer: BC

   Explanation

   I would go for B & C. "Customer provided keys (CPK) enables you to store and manage keys in on-premises or key stores other than Azure Key Vault to meet corporate, contractual, and regulatory compliance requirements for data security." https://azure.microsoft.com/en-us/blog/customer-provided-keys-with-azure-storage-service-encryption/

   Source: Adapted from community discussion — zts

   References

   • azure.microsoft.com documentation
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

2. Question 52 · 277 in bank

   You have an Azure subscription that has Microsoft Defender for Cloud enabled. You need to enforce ISO 27001:2013 standards for the subscription. The solution must ensure that noncompliant resources are remediated automatically. What should you use?

   • AAzure Policy
   • BAzure Blueprints
   • Cthe regulatory compliance dashboard in Defender for Cloud
   • DAzure role-based access control (Azure RBAC)

   Show answer

   Answer: A

   Explanation

   A is the answer. https://learn.microsoft.com/en-us/azure/governance/policy/overview Azure Policy helps to enforce organizational standards and to assess compliance at-scale. Through its compliance dashboard, it provides an aggregated view to evaluate the overall state of the environment, with the ability to drill down to the per-resource, per-policy granularity. It also helps to bring your resources to compliance through bulk remediation for existing resources and automatic remediation for new resources.

   Source: Adapted from community discussion — zellck

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • azure.microsoft.com documentation
   • Microsoft Learn

   Next question

3. Question 53 · 277 in bank

   DRAG DROP - You have a Microsoft 365 subscription. You need to recommend a security solution to monitor the following activities: ✑ User accounts that were potentially compromised ✑ Users performing bulk file downloads from Microsoft SharePoint Online What should you include in the recommendation for each activity? To answer, drag the appropriate components to the correct activities. Each component may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: Azure Active Directory (Azure AD) Identity Protection Risk detections in Azure AD Identity Protection include any identified suspicious actions related to user accounts in the directory. Risk detections (both user and sign-in linked) contribute to the overall user risk score that is found in the Risky Users report. Identity Protection provides organizations access to powerful resources to see and respond quickly to these suspicious actions. Note: Premium sign-in risk detections include: * Token Issuer Anomaly - This risk detection indicates the SAML token issuer for the associated SAML token is potentially compromised. The claims included in the token are unusual or match known attacker patterns. * Suspicious inbox manipulation rules - This detection is discovered by Microsoft Defender for Cloud Apps. This detection profiles your environment and triggers alerts when suspicious rules that delete or move messages or folders are set on a user's inbox. This detection may indicate that the user's account is compromised, that messages are being intentionally hidden, and that the mailbox is being used to distribute spam or malware in your organization. * Etc. Incorrect: Not: Microsoft 365 Defender for Cloud Part of your incident investigation can include user accounts. You can see the details of user accounts identified in the alerts of an incident in the Microsoft 365 Defender portal from Incidents & alerts > incident > Users. Box 2: Microsoft 365 Defender for App Defender for Cloud apps detect mass download (data exfiltration) policy Detect when a certain user accesses or downloads a massive number of files in a short period of time. Reference: https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/concept-identity-protection-risks https://docs.microsoft.com/en-us/defender-cloud-apps/policies-threat-protection#detect-mass-download-data-exfiltration https://docs.microsoft.com/en-us/microsoft-365/security/defender/investigate-users

   Source: Adapted from community discussion — zellck

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

4. Question 54 · 277 in bank

   Select 2

   You are designing a ransomware mitigation strategy. You perform a ransomware risk assessment and identify business-critical assets. You need to recommend a solution to mitigate ransomware threats. The solution must follow Microsoft security best practices. Which two actions should you include in the recommendation? Each correct answer presents a complete solution. NOTE: Each correct answer is worth one point.

   • AEnable firewall logging for auditing, without restricting inbound or outbound traffic.
   • BUse extended patching cycles to reduce the risk of update-related service disruptions.
   • CImplement immutable, offline backups that have restricted access and test restore procedures regularly.
   • DDeploy Privileged Identity Management (PIM) that uses just-in-time (JIT) access and approval workflows.

   Show answer

   Answer: CD

   Next question

5. Question 55 · 277 in bank

   Your company finalizes the adoption of Azure and is implementing Microsoft Defender for Cloud. You receive the following recommendations in Defender for Cloud ✑ Access to storage accounts with firewall and virtual network configurations should be restricted. ✑ Storage accounts should restrict network access using virtual network rules. ✑ Storage account should use a private link connection. ✑ Storage account public access should be disallowed. You need to recommend a service to mitigate identified risks that relate to the recommendations. What should you recommend?

   • AAzure Policy
   • BAzure Network Watcher
   • CAzure Storage Analytics
   • DMicrosoft Sentinel

   Show answer

   Answer: A

   Explanation

   A is the answer. https://learn.microsoft.com/en-us/azure/governance/policy/overview Azure Policy helps to enforce organizational standards and to assess compliance at-scale. Through its compliance dashboard, it provides an aggregated view to evaluate the overall state of the environment, with the ability to drill down to the per-resource, per-policy granularity. It also helps to bring your resources to compliance through bulk remediation for existing resources and automatic remediation for new resources.

   Source: Adapted from community discussion — zellck

   References

   • Microsoft Learn

   Next question

6. Question 56 · 277 in bank

   You receive a security alert in Microsoft Defender for Cloud as shown in the exhibit. (Click the Exhibit tab.)

   

   After remediating the threat, which policy definition should you assign to prevent the threat from reoccurring?

   • AStorage account public access should be disallowed
   • BAzure Key Vault Managed HSM should have purge protection enabled
   • CStorage accounts should prevent shared key access
   • DStorage account keys should not be expired

   Show answer

   Answer: C

   Explanation

   C is the correct answer. You should read Microburst toolkit - it is an open-source tool. Find Get-AZStorageKeysREST.ps1 it tries to enumerate all storage accounts then the respective storage keys. There is nothing to do with anonymous access here. Even if a storage account allows public acces you can't get the key without being authenticated and authorized. The preventive control here is to manage Shared Key Authorization.

   Source: Adapted from community discussion — walkaway

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • azure.microsoft.com documentation

   Next question

7. Question 57 · 277 in bank

   You have two Azure subscriptions named Sub1 and Sub2 that contain the vaults shown in the following table.

   

   You need to design a multi-user authorization (MUA) solution for security operations on the vaults. The solution must meet the following requirements: • RSVault1 and RSVault2 must require MUA for disabling soft delete, removing MUA protection, and disabling immutability. • BackupVault1 and BackupVault2 must require MUA for disabling soft delete and removing MUA protection. What is the minimum number of Resource Guard resources required?

   • A1
   • B2
   • C3
   • D4

   Show answer

   Answer: B

   Next question

8. Question 58 · 277 in bank

   Select 2

   You have 50 Azure subscriptions. You need to monitor the resource in the subscriptions for compliance with the ISO 27001:2013 standards. The solution must minimize the effort required to modify the list of monitored policy definitions for the subscriptions. What are two ways to achieve the goal? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.

   • AAssign an initiative to a management group.
   • BAssign a policy to each subscription.
   • CAssign a policy to a management group.
   • DAssign an initiative to each subscription.
   • EAssign a blueprint to each subscription.
   • FAssign a blueprint to a management group.

   Show answer

   Answer: AF

   Explanation

   Initiative; A group of related policies joined logically to accomplish a common goal. Better to use initiatives than a single policy in this case. Use it on management group level. Answer is correct.

   Source: Adapted from community discussion — InformationOverload

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

9. Question 59 · 277 in bank

   You have a Microsoft 365 subscription that contains a group named Group1. The subscription contains 1,000 Windows devices that are joined to a Microsoft Entra tenant and managed by using Microsoft Intune. All users sign in to the devices by using standard user accounts. You plan to deploy a new app named App1 to the members of Group1. The Group1 members must have administrative rights to install new versions of App1. You need to ensure that the Group1 members can install new versions of App1. The solution must follow the principles of Zero Trust. What should you implement?

   • AMicrosoft Entra Privileged Identity Management (PIM)
   • BMicrosoft Intune Endpoint Privilege Management (EPM)
   • CMicrosoft Local Administrator Password Solution (Microsoft LAPS)
   • DMicrosoft Entra entitlement management

   Show answer

   Answer: B

   Next question

10. Question 60 · 277 in bank

    HOTSPOT - You open Microsoft Defender for Cloud as shown in the following exhibit.

    

    Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic. NOTE: Each correct selection is worth one point. Hot Area:

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer: See figure below

    Explanation

    Wrong Answer:WAF is under Protect applications against DDoS attacks in secure score Security control and description. Correct Answer: NSG is under Restrict unauthorized network access in secure score Security control and description. Correct Answer: Microsoft Defender for servers. https://learn.microsoft.com/en-us/azure/defender-for-cloud/secure-score-security-controls

    Source: Adapted from community discussion — Janusguru

    References

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SC-100 practice, question 51. 277 questions available.