Practice Mode

SC-100

Loading...

SC-100 — 20 free practice questions

Preview the exam for free. Unlock all 339 questions →

Question 1

Your company has a Microsoft 365 ES subscription. The Chief Compliance Officer plans to enhance privacy management in the working environment. You need to recommend a solution to enhance the privacy management. The solution must meet the following requirements: ✑ Identify unused personal data and empower users to make smart data handling decisions. ✑ Provide users with notifications and guidance when a user sends personal data in Microsoft Teams. ✑ Provide users with recommendations to mitigate privacy risks. What should you include in the recommendation? Options: A. communication compliance in insider risk management B. Microsoft Viva Insights C. Privacy Risk Management in Microsoft Priva D. Advanced eDiscovery
  • A. communication compliance in insider risk management
  • B. Microsoft Viva Insights
  • C. Privacy Risk Management in Microsoft Priva Correct
  • D. Advanced eDiscovery

Explanation

Privacy Risk Management in Microsoft Priva allows for the the identification of unused personal data and provides users with notifica notifications and guidance on handling personal data securely, including mi mitigating privacy risks when sending data via Microsoft Teams.

Question 2

You have an Azure subscription that has Microsoft Defender for Cloud enabled. Suspicious authentication activity alerts have been appearing in the Workload protections dashboard. You need to recommend a solution to evaluate and remediate the alerts by using workflow automation. The solution must minimize development effort. What should you include in the recommendation? Options: A. Azure Monitor webhooks B. Azure Event Hubs C. Azure Functions apps D. Azure Logics Apps
  • A. Azure Monitor webhooks
  • B. Azure Event Hubs
  • C. Azure Functions apps
  • D. Azure Logics Apps Correct

Explanation

Azure Logic Apps is the appropriate choice for automating automating workflows in response to suspicious activity alerts from Microso Microsoft Defender for Cloud, as it supports integration with security serv services and enables automated remediation steps without requiring extensiv extensive development effort.

Question 3

Your company is moving a big data solution to Azure. The company plans to use the following storage workloads: ✑ Azure Storage blob containers ✑ Azure Data Lake Storage Gen2 Azure Storage file shares - ✑ Azure Disk Storage Which two storage workloads support authentication by using Azure Active Directory (Azure AD)? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point. Options: A. Azure Storage file shares B. Azure Disk Storage C. Azure Storage blob containers D. Azure Data Lake Storage Gen2
  • A. Azure Storage file shares Correct
  • B. Azure Disk Storage
  • C. Azure Storage blob containers
  • D. Azure Data Lake Storage Gen2 Correct

Explanation

Azure Storage file shares and Azure Data Lake Storage Gen Gen2 support authentication using Azure Active Directory (Azure AD). In con contrast, Azure Disk Storage and Azure Storage blob containers do not nativ natively offer this form of authentication.

Question 4

Your company is migrating data to Azure. The data contains Personally Identifiable Information (PII). The company plans to use Microsoft Information Protection for the PII data store in Azure. You need to recommend a solution to discover PII data at risk in the Azure resources. What should you include in the recommendation? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

Explanation

Statement 1 (Yes): Azure Purview provides capabilities to to discover sensitive information like Personally Identifiable Information (PII) across various data sources in Azure and on-premises. Statement 2 (No (No): While Microsoft Defender for Cloud Apps is useful for visualizing clo cloud application usage and protecting data, the correct tool here is Micro Microsoft Defender for Cloud, which integrates with Purview and provides se security insights specific to PII protection.

Question 5

You have a Microsoft 365 E5 subscription and an Azure subscription. You are designing a Microsoft deployment. You need to recommend a solution for the security operations team. The solution must include custom views and a dashboard for analyzing security events. What should you recommend using in Microsoft Sentinel? Options: A. notebooks B. playbooks C. workbooks D. threat intelligence
  • A. notebooks
  • B. playbooks
  • C. workbooks Correct
  • D. threat intelligence

Explanation

Workbooks in Microsoft Sentinel provide a f flexible canvas for creating custom views and dashboards to analyze securit security events. This makes them the appropriate choice for the security op operations team's needs.

Question 6

Your company has a Microsoft 365 subscription and uses Microsoft Defender for Identity. You are informed about incidents that relate to compromised identities. You need to recommend a solution to expose several accounts for attackers to exploit. When the attackers attempt to exploit the accounts, an alert must be triggered. Which Defender for Identity feature should you include in the recommendation? Options: A. sensitivity labels B. custom user tags C. standalone sensors D. honeytoken entity tags
  • A. sensitivity labels
  • B. custom user tags
  • C. standalone sensors
  • D. honeytoken entity tags Correct

Explanation

Honeytoken entity tags are designed to act as traps for malicious actors. When an attacker attempts to exploit a honey honeytoken-tagged account, Defender for Identity triggers an alert.

Question 7

Your company is moving all on-premises workloads to Azure and Microsoft 365. You need to design a security orchestration, automation, and response (SOAR) strategy in Microsoft Sentinel that meets the following requirements: ✑ Minimizes manual intervention by security operation analysts ✑ Supports triaging alerts within Microsoft Teams channels What should you include in the strategy? Options: A. KQL B. playbooks C. data connectors D. workbooks
  • A. KQL
  • B. playbooks Correct
  • C. data connectors
  • D. workbooks

Explanation

Playbooks in Microsoft Sentinel automate re responses to security alerts, reducing manual intervention by security oper operation analysts and supporting the triaging of alerts within Microsoft T Teams channels.

Question 8

You have an Azure subscription that contains virtual machines, storage accounts, and Azure SQL databases. All resources are backed up multiple times a day by using Azure Backup. You are developing a strategy to protect against ransomware attacks. You need to recommend which controls must be enabled to ensure that Azure Backup can be used to restore the resources in the event of a successful ransomware attack. Which two controls should you include in the recommendation? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point. Options: A. Enable soft delete for backups. B. Require PINs for critical operations. C. Encrypt backups by using customer-managed keys (CMKs). D. Perform offline backups to Azure Data Box. E. Use Azure Monitor notifications when backup configurations change.
  • A. Enable soft delete for backups. Correct
  • B. Require PINs for critical operations.
  • C. Encrypt backups by using customer-managed keys (CMKs). Correct
  • D. Perform offline backups to Azure Data Box.
  • E. Use Azure Monitor notifications when backup configurations change.

Explanation

Enabling soft delete for backups ensures that deleted bac backups can be recovered, protecting against ransomware attacks. Encrypting Encrypting backups with customer-managed keys adds an additional layer of s security by controlling encryption key management.

Question 9

You are creating the security recommendations for an Azure App Service web app named App1. App1 has the following specifications: ✑ Users will request access to App1 through the My Apps portal. A human resources manager will approve the requests. ✑ Users will authenticate by using Azure Active Directory (Azure AD) user accounts. You need to recommend an access security architecture for App1. What should you include in the recommendation? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

Explanation

Statement 1 (Yes): Azure AD Application registration is n necessary because it allows the web app to integrate with Azure Active Dire Directory for authentication. This ensures that only users who are authenti authenticated through Azure AD can access App1. Statement 2 (Yes): An Acces Access Package in Identity Governance should be included as it supports aut automated approval workflows and governance of resource access, which align aligns with the requirement that a human resources manager will approve use user requests to access App1.

Question 10

Your company uses Microsoft Defender for Cloud and Microsoft Sentinel. The company is designing an application that will have the architecture shown in the following exhibit. You are designing a logging and auditing solution for the proposed architecture. The solution must meet the following requirements: ✑ Integrate Azure Web Application Firewall (WAF) logs with Microsoft Sentinel. ✑ Use Defender for Cloud to review alerts from the virtual machines. What should you include in the solution? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

Explanation

Statement 1 (Yes): The answer is correct as it suggests t the use of appropriate tools for logging and auditing. Statement 2 (Yes): F For WAF integration with Sentinel, a Data Connector must be used; for VMs, the Log Analytics agent is necessary to send logs to Azure Monitor and inte integrate them into Sentinel. Statement 3 (Yes): The term 'Log Analytics Ag Agent' can also be referred to as the 'Azure Monitoring Agent', which is co correct according to Microsoft documentation. Statement 4 (Yes): It correct correctly identifies that a Data Connector should be used for WAF, while th the Log Analytics agent must be installed on VMs to enable log collection." collection.

Question 11

Your company has a third-party security information and event management (SIEM) solution that uses Splunk and Microsoft Sentinel. You plan to integrate Microsoft Sentinel with Splunk. You need to recommend a solution to send security events from Microsoft Sentinel to Splunk. What should you include in the recommendation? Options: A. a Microsoft Sentinel data connector B. Azure Event Hubs C. a Microsoft Sentinel workbook D. Azure Data Factory
  • A. a Microsoft Sentinel data connector Correct
  • B. Azure Event Hubs
  • C. a Microsoft Sentinel workbook
  • D. Azure Data Factory

Explanation

A Microsoft Sentinel data connector is designed to export export security events from Microsoft Sentinel to external systems like Spl Splunk. This functionality directly supports the requirement of sending sec security events from Microsoft Sentinel to a third-party SIEM solution such such as Splunk.

Question 12

A customer follows the Zero Trust model and explicitly verifies each attempt to access its corporate applications. The customer discovers that several endpoints are infected with malware. The customer suspends access attempts from the infected endpoints. The malware is removed from the endpoints. Which two conditions must be met before endpoint users can access the corporate applications again? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point. Options: A. The client access tokens are refreshed. B. Microsoft Intune reports the endpoints as compliant. C. A new Azure Active Directory (Azure AD) Conditional Access policy is enforced. D. Microsoft Defender for Endpoint reports the endpoints as compliant.
  • A. The client access tokens are refreshed.
  • B. Microsoft Intune reports the endpoints as compliant. Correct
  • C. A new Azure Active Directory (Azure AD) Conditional Access policy is enforced.
  • D. Microsoft Defender for Endpoint reports the endpoints as compliant. Correct

Explanation

In a Zero Trust model, endpoint compliance is crucial. Mi Microsoft Intune ensures that endpoints meet organizational security requir requirements and reports their status as compliant or non-compliant. Additi Additionally, Microsoft Defender for Endpoint must report the endpoints as clean from threats to ensure they are safe for access.

Question 13

You have a Microsoft 365 subscription and an Azure subscription. Microsoft 365 Defender and Microsoft Defender for Cloud are enabled. The Azure subscription contains a Microsoft Sentinel workspace. Microsoft Sentinel data connectors are configured for Microsoft 365, Microsoft 365 Defender, Defender for Cloud, and Azure. You plan to deploy Azure virtual machines that will run Windows Server. You need to enable extended detection and response (EDR) and security orchestration, automation, and response (SOAR) capabilities for Microsoft Sentinel. How should you recommend enabling each capability? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

Explanation

Statement 1 (Yes): To enable the EDR capability, you shou should use Microsoft Defender for Endpoint. This aligns with the official d documentation that states Microsoft Defender for Endpoint provides endpoint endpoint detection and response capabilities to protect against cyber threa threats. Statement 2 (Yes): To enable the SOAR capability, configuring play playbook automation within Microsoft Sentinel is correct. According to the official documentation on automating responses in Microsoft Sentinel, playb playbooks are used to automate incident responses, which is part of the sec security orchestration, automation, and response capabilities.

Question 14

You have a customer that has a Microsoft 365 subscription and uses the Free edition of Azure Active Directory (Azure AD). The customer plans to obtain an Azure subscription and provision several Azure resources. You need to evaluate the customer's security environment. What will necessitate an upgrade from the Azure AD Free edition to the Premium edition? Options: A. Azure AD Privileged Identity Management (PIM) B. role-based authorization C. resource-based authorization D. Azure AD Multi-Factor Authentication
  • A. Azure AD Privileged Identity Management (PIM) Correct
  • B. role-based authorization
  • C. resource-based authorization
  • D. Azure AD Multi-Factor Authentication

Explanation

Azure AD Privileged Identity Management (PIM) requires Az Azure AD Premium. Role-based and resource-based authorizations can be perfo performed with the Free edition of Azure AD, and while Azure AD Multi-Facto Multi-Factor Authentication is available in the Free tier when using Securi Security Defaults, PIM specifically mandates a Premium license.

Question 15

You are designing the security standards for a new Azure environment. You need to design a privileged identity strategy based on the Zero Trust model. Which framework should you follow to create the design? Options: A. Microsoft Security Development Lifecycle (SDL) B. Enhanced Security Admin Environment (ESAE) C. Rapid Modernization Plan (RaMP) D. Microsoft Operational Security Assurance (OSA)
  • A. Microsoft Security Development Lifecycle (SDL)
  • B. Enhanced Security Admin Environment (ESAE)
  • C. Rapid Modernization Plan (RaMP) Correct
  • D. Microsoft Operational Security Assurance (OSA)

Explanation

The Rapid Modernization Plan (RaMP) is designed to help q quickly adopt Microsoft's recommended privileged access strategy aligned wi with the Zero Trust model. Other options like SDL and OSA are related to so software development lifecycle, while ESAE has been replaced by RaMP.

Question 16

A customer has a hybrid cloud infrastructure that contains a Microsoft 365 E5 subscription and an Azure subscription. All on-premises servers in the perimeter network are prevented from connecting directly to the internet. The customer recently recovered from a ransomware attack. The customer plans to deploy Microsoft Sentinel. You need to recommend solutions to meet the following requirements: ✑ Ensure that the security operations team can access the security logs and the operation logs. ✑ Ensure that the IT operations team can access only the operations logs, including the event logs of the servers in the perimeter network. Which two solutions should you include in the recommendation? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point. Options: A. a custom collector that uses the Log Analytics agent B. the Azure Monitor agent C. resource-based role-based access control (RBAC) D. Azure Active Directory (Azure AD) Conditional Access policies
  • A. a custom collector that uses the Log Analytics agent
  • B. the Azure Monitor agent Correct
  • C. resource-based role-based access control (RBAC) Correct
  • D. Azure Active Directory (Azure AD) Conditional Access policies

Explanation

The Azure Monitor agent with the multi-h multi-homing configuration ensures that logs from on-premises servers are c collected and sent to Microsoft Sentinel. Resource-based role-based access control (RBAC) allows for granular permissions, ensuring that the security operations team can access both security and operation logs while the IT op operations team can only access operation logs.

Question 17

Your company is developing a serverless application in Azure that will have the architecture shown in the following exhibit. You need to recommend a solution to isolate the compute components on an Azure virtual network. What should you include in the recommendation? Options: A. Azure Active Directory (Azure AD) enterprise applications B. an Azure App Service Environment (ASE) C. Azure service endpoints D. an Azure Active Directory (Azure AD) application proxy [Diagram: External services connect to API Management, which routes to Key Vault, Patient API, and Audit API. Patient API and Audit API interact with Key Vault and Azure Cosmos DB.]
  • A. Azure Active Directory (Azure AD) enterprise applications
  • B. an Azure App Service Environment (ASE) Correct
  • C. Azure service endpoints
  • D. an Azure Active Directory (Azure AD) application proxy [Diagram: External services connect to API Management, which routes to Key Vault, Patient API, and Audit API. Patient API and Audit API interact with Key Vault and Azure Cosmos DB.]

Explanation

An Azure App Service Environment (ASE) allows for hosting hosting web apps, mobile apps, and functions within an isolated subnet of a a virtual network in Azure, providing secure network access and isolation r required by the architecture.

Question 18

You are planning the security levels for a security access strategy. You need to identify which job roles to configure at which security levels. The solution must meet security best practices of the Microsoft Cybersecurity Reference Architectures (MCRA). Which security level should you configure for each job role? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Explanation

Statement 1 (Specialised security): According to Microsof Microsoft's documentation, specialized security levels are intended for rol roles with an elevated business impact. This aligns with the context of dev developers or similar roles needing increased controls due to their potenti potential exposure. Statement 2 (Enterprise security): Enterprise security is designed for standard corporate roles that require a balanced level of a access control and operational efficiency. This matches the typical needs f for general enterprise users. Statement 3 (Privileged security): Privileged Privileged security is designated for high-impact roles such as administrat administrators or operators who need elevated permissions, aligning with Mi Microsoft's guidelines on privileged access workstations.

Question 19

Your company plans to apply the Zero Trust Rapid Modernization Plan (RaMP) to its IT environment. You need to recommend the top three modernization areas to prioritize as part of the plan. Which three areas should you recommend based on RaMP? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point. Options: A. data, compliance, and governance B. infrastructure and development C. user access and productivity D. operational technology (OT) and IoT E. modern security operations
  • A. data, compliance, and governance Correct
  • B. infrastructure and development
  • C. user access and productivity Correct
  • D. operational technology (OT) and IoT
  • E. modern security operations Correct

Explanation

According to the official Microsoft documentation on Zero Zero Trust Rapid Modernization Plan (RaMP), prioritizing data, compliance, and governance (A); user access and productivity (C); and modern security o operations (E) ensures a secure foundation for IT environments by addressin addressing critical areas such as trust verification, ransomware readiness, readiness, streamlined response, and unified visibility.

Question 20

For a Microsoft cloud environment, you are designing a security architecture based on the Microsoft Cybersecurity Reference Architectures (MCRA). You need to protect against the following external threats of an attack chain: • An attacker attempts to exfiltrate data to external websites. • An attacker attempts lateral movement across domain-joined computers. What should you include in the recommendation for each threat? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Explanation

Statement 1 (Defender for Cloud Apps): Defender for Cloud Cloud Apps provides comprehensive protection against data exfiltration by m monitoring and controlling access to sensitive data in cloud applications, ensuring that unauthorized attempts to move data out of the organization ar are detected and prevented. Statement 2 (Defender for Identity): Defender f for Identity is designed to detect and prevent lateral movement across doma domain-joined computers by continuously analyzing network traffic and syste system activities to identify and respond to suspicious behaviors indicativ indicative of malicious intent.

Verifying access...