You have an on-premises network that has several legacy applications. The applications perform LDAP queries against an existing directory service. You are migrating the on-premises infrastructure to a cloud-only infrastructure. You need to recommend an identity solution for the infrastructure that supports the legacy applications. The solution must minimize the administrative effort to maintain the infrastructure. Which identity service should you include in the recommendation?

Azure Active Directory Domain Services (Azure AD DS)

Azure Active Directory (Azure AD) B2C

Azure Active Directory (Azure AD)

Active Directory Domain Services (AD DS)

You are creating an application lifecycle management process based on the Microsoft Security Development Lifecycle (SDL). You need to recommend a security standard for onboarding applications to Azure. The standard will include recommendations for application design, development, and deployment What should you include during the application design phase?

threat modeling by using the Microsoft Threat Modeling Tool

static application security testing (SAST) by using SonarQube

dynamic application security testing (DAST) by using Veracode

threat modeling by using the Microsoft Threat Modeling Tool

software decomposition by using Microsoft Visual Studio Enterprise

Your company is developing a new Azure App Service web app. You are providing design assistance to verify the security of the web app. You need to recommend a solution to test the web app for vulnerabilities such as insecure server configurations, cross-site scripting (XSS), and SQL injection. What should you include in the recommendation?

dynamic application security testing (DAST)

interactive application security testing (IAST)

static application security testing (SAST)

runtime application se/f-protection (RASP)

dynamic application security testing (DAST)

Your company plans to deploy several Azure App Service web apps. The web apps will be deployed to the West Europe Azure region. The web apps will be accessed only by customers in Europe and the United States. You need to recommend a solution to prevent malicious bots from scanning the web apps for vulnerabilities. The solution must minimize the attach surface. What should you include in the recommendation?

Azure Traffic Manager and application security groups

Azure Application Gateway Web Application Firewall (WAF)

Azure Traffic Manager and application security groups

You have a Microsoft 365 E5 subscription.You need to recommend a solution to add a watermark to email attachments that contain sensitive dat a. What should you include in the recommendation?

Microsoft Information Protection

Microsoft Defender for Cloud Apps

Microsoft Information Protection

Your company has a hybrid cloud infrastructure.The company plans to hire several temporary employees within a brief period. The temporary employees will need to access applications and data on the company' premises network. The company's security policy prevents the use of personal devices for accessing company data and applications. You need to recommend a solution to provide the temporary employee with access to company resources. The solution must be able to scale on demand. What should you include in the recommendation?

Deploy Azure Virtual Desktop, Azure Active Directory (Azure AD) Conditional Access, and Microsoft Defender for Cloud Apps.

Migrate the on-premises applications to cloud-based applications.

Redesign the VPN infrastructure by adopting a split tunnel configuration.

Deploy Microsoft Endpoint Manager and Azure Active Directory (Azure AD) Conditional Access.

Deploy Azure Virtual Desktop, Azure Active Directory (Azure AD) Conditional Access, and Microsoft Defender for Cloud Apps.

You have an Azure subscription that contains virtual machines, storage accounts, and Azure SQL databases. All resources are backed up multiple times a day by using Azure Backup. You are developing a strategy to protect against ransomware attacks.You need to recommend which controls must be enabled to ensure that Azure Backup can be used to restore the resources in the event of a successful\ ransonvware attack. Which two controls should you include in the recommendation? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.

Use Azure Monitor notifications when backup configurations change.

Require PINs for critical operations.

Use Azure Monitor notifications when backup configurations change.

Require PINs for critical operations.

Perform offline backups to Azure Data Box.

Encrypt backups by using customer-managed keys (CMKs).

Enable soft delete for backups.

Your company develops several applications that are accessed as custom enterprise applications in Azure Active Directory (Azure AD). You need to recommend a solution to prevent users on a specific list of countries from connecting to the applications. What should you include in the recommendation?

activity policies in Microsoft Defender for Cloud Apps

sign-in risk policies in Azure AD Identity Protection

device compliance policies in Microsoft Endpoint Manager

Azure AD Conditional Access policies

user risk policies in Azure AD Identity Protection

Your company has an on-premise network in Seattle and an Azure subscription. The on-premises network contains a Remote Desktop server. The company contracts a third-party development firm from France to develop and deploy resources to the virtual machines hosted in the Azure subscription. Currently, the firm establishes an RDP connection to the Remote Desktop server. From the Remote Desktop connection, the firm can access the virtual machines hosted in Azure by using custom administrative tools installed on the Remote Desktop server. All the traffic to the Remote Desktop server is captured by a firewall, and the firewall only allows specific connections from France to the server. You need to recommend a modern security solution based on the Zero Trust model. The solution must minimize latency tor developers. Which three actions should you recommend? Each correct answer presents part of the solution.NOTE: Each correct selection is worth one point.

Implement Azure Firewall to restrict host pool outbound access.

Configure Azure Active Directory (Azure AD) Conditional Access with multi-factor authentication(MFA) and named locations.

Migrate from the Remote Desktop server to Azure Virtual Desktop.

Configure network security groups (NSGs) to allow access from only specific logical groupings of IP address ranges.

Implement Azure Firewall to restrict host pool outbound access.

Configure Azure Active Directory (Azure AD) Conditional Access with multi-factor authentication(MFA) and named locations.

Migrate from the Remote Desktop server to Azure Virtual Desktop.

Deploy a Remote Desktop server to an Azure region located in France.

Your company plans to provision blob storage by using an Azure Storage account The blob storage will be accessible from 20 application sewers on the internet. You need to recommend a solution to ensure that only the application servers can access the storage account. What should you recommend using to secure the blob storage?

firewall rules for the storage account

service tags in network security groups (NSGs)

managed rule sets in Azure Web Application Firewall (WAF) policies

inbound rules in network security groups (NSGs)

firewall rules for the storage account

inbound rules in Azure Firewall

Your company has a Microsoft 365 E5 subscription.The company plans to deploy 45 mobile self-service kiosks that will run Windows10. You need to provide recommendations to secure the kiosks. The solution must meet the following requirements:• Ensure that only authorized applications can run on the kiosks.• Regularly harden the kiosks against new threats.Which two actions should you include in the recommendations? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

Implement threat and vulnerability management in Microsoft Defender for Endpoint.

Onboard the kiosks to Microsoft Intune and Microsoft Defender for Endpoint.

Onboard the kiosks to Azure Monitor.

Implement Privileged Access Workstation (PAW) for the kiosks.

Implement Automated Investigation and Remediation (AIR) in Microsoft Defender for Endpoint.

Implement threat and vulnerability management in Microsoft Defender for Endpoint.

Onboard the kiosks to Microsoft Intune and Microsoft Defender for Endpoint.

Your company has an office in Seattle.The company has two Azure virtual machine scale sets hosted on different virtual networks.The company plans to contract developers in India.You need to recommend a solution provide the developers with the ability to connect to the virtual machines over SSL from the Azure portal. The solution must meet the following requirements:• Prevent exposing the public IP addresses of the virtual machines.• Provide the ability to connect without using a VPN.• Minimize costs.Which two actions should you perform? Each correct answer presents part of the solution.NOTE: Each correct selection is worth one point.

Deploy Azure Bastion to one virtual network.

Create a hub and spoke network by using virtual network peering.

Deploy Azure Bastion to one virtual network.

Deploy Azure Bastion to each virtual network.

Enable just-in-time VM access on the virtual machines.

Create a hub and spoke network by using virtual network peering.

Create NAT rules and network rules in Azure Firewall.

Your company has a Microsoft 365 E5 subscription.The Chief Compliance Officer plans to enhance privacy management in the working environment.You need to recommend a solution to enhance the privacy management. The solution must meet the following requirements:• Identify unused personal data and empower users to make smart data handling decisions.• Provide users with notifications and guidance when a user sends personal data in Microsoft Teams.• Provide users with recommendations to mitigate privacy risks.What should you include in the recommendation?

Privacy Risk Management in Microsoft Priva

communication compliance in insider risk management

You have an Azure subscription that has Microsoft Defender for Cloud enabled.You are evaluating the Azure Security Benchmark V3 report as shown in the following exhibit. You need to verify whether Microsoft Defender for servers is installed on all the virtual machines that run Windows. Which compliance control should you evaluate?

Posture and Vulnerability Management

A customer is deploying Docker images to 10 Azure Kubernetes Service (AKS) resources across four Azure subscriptions. You are evaluating the security posture of the customer. You discover that the AKS resources are excluded from the secure score recommendations. You need to produce accurate recommendations and update the secure score. Which two actions should you recommend in Microsoft Defender for Cloud? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

Assign regulatory compliance policies.

You have Microsoft Defender for Cloud assigned to Azure management groups.You have a Microsoft Sentinel deployment.During the triage of alerts, you require additional information about the security events, including suggestions for remediation. Which two components can you use to achieve the goal? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.

threat intelligence reports in Defender for Cloud

Microsoft Sentinel threat intelligence workbooks

workload protections in Defender for Cloud

threat intelligence reports in Defender for Cloud

Microsoft Sentinel threat intelligence workbooks

You have a Microsoft 365 subscription and an Azure subscription. Microsoft 365 Defender and Microsoft Defender for Cloud are enabled. The Azure subscription contains 50 virtual machines. Each virtual machine runs different applications on Windows Server 2019. You need to recommend a solution to ensure that only authorized applications can run on the virtual machines. If an unauthorized application attempts to run or be installed, the application must be blocked automatically until an administrator authorizes the application.Which security control should you recommend?

application control policies in Microsoft Defender for Endpoint

Azure Active Directory (Azure AD) Conditional Access App Control policies

OAuth app policies in Microsoft Defender for Cloud Apps

app protection policies in Microsoft Endpoint Manager

application control policies in Microsoft Defender for Endpoint

Your company has an Azure subscription that has enhanced security enabled for Microsoft Defender for Cloud. The company signs a contract with the United States government. You need to review the current subscription for NIST 800-53 compliance. What should you do first?

From Defender for Cloud, enable Defender for Cloud plans.

From Defender for Cloud, review the Azure security baseline for audit report.

From Defender for Cloud, add a regulatory compliance standard.

From Defender for Cloud, enable Defender for Cloud plans.

From Defender for Cloud, review the secure score recommendations.

Your company has devices that run either Windows 10, Windows 11, or Windows Server.You are in the process of improving the security posture of the devices.You plan to use security baselines from the Microsoft Security Compliance Toolkit.What should you recommend using to compare the baselines to the current device configurations?

Local Group Policy Object (LGPO)

A customer follows the Zero Trust model and explicitly verifies each attempt to access its corporate applications. The customer discovers that several endpoints are infected with malware.The customer suspends access attempts from the infected endpoints.The malware is removed from the end point.Which two conditions must be met before endpoint users can access the corporate applications again? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

Microsoft Intune reports the endpoints as compliant.

The client access tokens are refreshed.

Microsoft Defender for Endpoint reports the endpoints as compliant.

Microsoft Intune reports the endpoints as compliant.

A new Azure Active Directory (Azure AD) Conditional Access policy is enforced.

The client access tokens are refreshed.

A customer has a hybrid cloud infrastructure that contains a Microsoft 365 E5 subscription and an Azure subscription. All the on-premises servers in the perimeter network are prevented from connecting directly to the internet. The customer recently recovered from a ransomware attack.The customer plans to deploy Microsoft Sentinel.You need to recommend configurations to meet the following requirements:• Ensure that the security operations team can access the security logs and the operation logs.• Ensure that the IT operations team can access only the operations logs, including the event logs of the servers in the perimeter network. Which two configurations can you include in the recommendation? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.

Use the Azure Monitor agent with the multi-homing configuration.

Implement resource-based role-based access control (RBAC) in Microsoft Sentinel.

Configure Azure Active Directory (Azure AD) Conditional Access policies.

Use the Azure Monitor agent with the multi-homing configuration.

Implement resource-based role-based access control (RBAC) in Microsoft Sentinel.

Create a custom collector that uses the Log Analytics agent.

Your company has the virtual machine infrastructure shown in the following table. The company plans to use Microsoft Azure Backup Server (MABS) to back up the virtual machines to Azure. You need to provide recommendations to increase the resiliency of the backup strategy to mitigate attacks such as ransomware. What should you include in the recommendation?

Require PINs to disable backups.

Use geo-redundant storage (GRS).

Use customer-managed keys (CMKs) for encryption.

Require PINs to disable backups.

Implement Azure Site Recovery replication.

You have a customer that has a Microsoft 365 subscription and an Azure subscription.The customer has devices that run either Windows, iOS, Android, or macOS. The Windows devices are deployed on-premises and in Azure. You need to design a security solution to assess whether all the devices meet the customer's compliance rules. What should you include in the solution?

Microsoft Information Protection

Microsoft Defender for Endpoint

Your company has a hybrid cloud infrastructure.Data and applications are moved regularly between cloud environments.The company's on-premises network is managed as shown in the following exhibit. You are designing security operations to support the hybrid cloud infrastructure. The solution must meet the following requirements: Govern virtual machines and servers across multiple environments.Enforce standards for all the resources across all the environment across the Azure policy.Which two components should you recommend for the on-premises network? Each correct answer presents part of the solution.

guest configuration in Azure Policy

You are designing the security standards for a new Azure environment.You need to design a privileged identity strategy based on the Zero Trust model.Which framework should you follow to create the design?

Rapid Modernization Plan (RaMP)

Enhanced Security Admin Environment (ESAE)

Microsoft Security Development Lifecycle (SDL)

Rapid Modernization Plan (RaMP)

Microsoft Operational Security Assurance (OSA)

Microsoft SC-100 Practice Test 2 - Free Online Exam Questions 41-80

You have an Azure subscription that has Microsoft Defender for Cloud enabled. You have an Amazon Web Services (AWS) implementation. You plan to extend the Azure security strategy to the AWS implementation. The solution will NOT use Azure Arc. Which three services can you use to provide security for the AWS resources? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.

Become a Premium Member for full access

Unlock Premium Member

Microsoft SC-100 Practice Test 2

Question

Microsoft SC-100 Practice Tests

Practice Tests