SC-100 practice questions 81–90

1. Question 81 · 277 in bank

   You have a customer that has a Microsoft 365 subscription and an Azure subscription. The customer has devices that run either Windows, iOS, Android, or macOS. The Windows devices are deployed on-premises and in Azure. You need to design a security solution to assess whether all the devices meet the customer's compliance rules. What should you include in the solution?

   • AMicrosoft Defender for Endpoint
   • BMicrosoft Endpoint Manager
   • CMicrosoft Information Protection
   • DMicrosoft Sentinel

   Show answer

   Answer: B

   Explanation

   Correct answer. Covers all of the below running devices Android device administrator Android (AOSP) (preview) Android Enterprise iOS/iPadOS Linux - Ubuntu Desktop, version 20.04 LTS and 22.04 LTS macOS Windows 10 and later Source: https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-monitor#open-the-compliance-dashboard

   Source: Adapted from community discussion — Sec_Arch_Chn

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

2. Question 82 · 277 in bank

   You have an Azure subscription that contains the Azure Virtual Machine Scale Sets shown in the following table.

   

   You are evaluating Azure Update Manager and automatic virtual machine guest patching. Which virtual machine scale sets will automatic guest patching support?

   • AVMSS1 only
   • BVMSS2 only
   • CVMSS1 and VMSS3 only
   • DVMSS2 and VMSS4 only
   • EVMSS1, VMSS2, VMSS3, and VMSS4

   Show answer

   Answer: C

   Next question

3. Question 83 · 277 in bank

   You have a Microsoft Entra tenant named contoso.com. You have a partner company that has a multi-tenant application named App1. App1 is registered to a Microsoft Entra tenant named fabrikam.com. You need to ensure that the users in contoso.com can authenticate to App1. What should you recommend creating in contoso.com?

   • Aa service principal
   • Ba system-assigned managed identity
   • Can application object
   • Da user-assigned managed identity

   Show answer

   Answer: A

   Next question

4. Question 84 · 277 in bank

   Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure subscription that has Microsoft Defender for Cloud enabled. You are evaluating the Azure Security Benchmark V3 report. In the Secure management ports controls, you discover that you have 0 out of a potential 8 points. You need to recommend configurations to increase the score of the Secure management ports controls. Solution: You recommend onboarding all virtual machines to Microsoft Defender for Endpoint. Does this meet the goal?

   • AYes
   • BNo

   Show answer

   Answer: B

   References

   • Microsoft Learn

   Next question

5. Question 85 · 277 in bank

   Your network contains an Active Directory Domain Services (AD DS) domain named Domain1. You have a Microsoft Entra tenant. Domain1 syncs with the tenant by using Microsoft Entra Connect. You need to monitor Domain1 for privilege escalation attacks. What should you use?

   • AMicrosoft Entra ID Protection
   • BMicrosoft Defender for Servers
   • CMicrosoft Defender for Identity
   • DPrivileged Identity Management (PIM)

   Show answer

   Answer: C

   Next question

6. Question 86 · 277 in bank

   Your company has an Azure subscription that has enhanced security enabled for Microsoft Defender for Cloud. The company signs a contract with the United States government. You need to review the current subscription for NIST 800-53 compliance. What should you do first?

   • AFrom Defender for Cloud, review the secure score recommendations.
   • BFrom Microsoft Sentinel, configure the Microsoft Defender for Cloud data connector.
   • CFrom Defender for Cloud, review the Azure security baseline for audit report.
   • DFrom Defender for Cloud, add a regulatory compliance standard.

   Show answer

   Answer: D

   Explanation

   D. From Defender for Cloud, add a regulatory compliance standard. The first step in reviewing the Azure subscription for NIST 800-53 compliance is to add the NIST 800-53 regulatory compliance standard in Defender for Cloud. This will allow you to see if your subscription meets the requirements for the NIST 800-53 standard. After adding the standard, you can review the compliance status and take appropriate actions to address any issues found.

   Source: Adapted from community discussion — Mo22

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

7. Question 87 · 277 in bank

   You have a Microsoft 365 tenant. You have an Azure subscription that contains Azure App Service web apps. The apps have the following characteristics: • The apps use third-party and open-source components. • The apps were developed by using C#, Python, and Java. • The app deployment process is managed by using Azure DevOps. • The source code for the apps is stored in GitHub Enterprise Cloud repositories and protected by using GitHub Advanced Security. You need to reduce the risk of supply chain attacks during the application lifecycle. What should you implement?

   • Asecret scanning
   • BDependabot alerts
   • Capp governance in Microsoft Defender for Cloud Apps
   • DNuGet Audit

   Show answer

   Answer: B

   Next question

8. Question 88 · 277 in bank

   You have an Azure subscription and an Azure DevOps organization. You need to recommend a solution for connecting Azure DevOps pipelines to the resources in the subscription by using Azure Resource Manager (ARM) service connections. The solution must align with Microsoft Cloud Adoption Framework for Azure best practices, including the principle of least privilege. What should you include in the recommendation?

   • Aservice principals and secrets
   • Bworkload identity federation and service principals
   • Cworkload identity federation and user-assigned managed identities
   • Dworkload identity federation and system-assigned managed identities

   Show answer

   Answer: B

   Next question

9. Question 89 · 277 in bank

   Your company has devices that run either Windows 10, Windows 11, or Windows Server. You are in the process of improving the security posture of the devices. You plan to use security baselines from the Microsoft Security Compliance Toolkit. What should you recommend using to compare the baselines to the current device configurations?

   • AMicrosoft Intune
   • BLocal Group Policy Object (LGPO)
   • CWindows Autopilot
   • DPolicy Analyzer

   Show answer

   Answer: D

   Explanation

   The Microsoft Security Compliance Toolkit provides security baselines and allows you to view recommended and current system configurations. When it comes to comparing these baselines to the current device configurations, Policy Analyzer is the appropriate tool. Policy Analyzer is a utility for analyzing and comparing sets of Group Policy Objects (GPOs). It can identify whether current policies are compliant with the desired baselines, making it suitable for this task. So the correct answer is: D. Policy Analyzer

   Source: Adapted from community discussion — WRITER00347

   References

   • Microsoft Learn

   Next question

10. Question 90 · 277 in bank

    You have an Azure subscription and a Microsoft 365 subscription. Your company uses several software as a service (SaaS) applications. To align with Microsoft cloud security benchmark (MCSB) and Microsoft Cybersecurity Reference Architectures (MCRA), you plan to design a solution to provide visibility into user activity across the applications and detect potentially risky behavior in real time. Which service should you recommend?

    • AMicrosoft Defender for Cloud Apps
    • BMicrosoft Purview Information Protection
    • CMicrosoft Sentinel
    • DMicrosoft Defender for Endpoint

    Show answer

    Answer: A

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SC-100 practice, question 81. 277 questions available.