You have an Azure AD tenant that syncs with an Active Directory Domain Services {AD DS) domain.Client computers run Windows and are hybrid-joined to Azure AD.You are designing a strategy to protect endpoints against ransomware. The strategy follows Microsoft Security Best Practices. You plan to remove all the domain accounts from the Administrators group on the Windows computers.You need to recommend a solution that will provide users with administrative access to the Windows computers only when access is required. The solution must minimize the lateral movement of ransomware attacks if an administrator account on a computer is compromised.What should you include in the recommendation?

Local Administrator Password Solution (LAPS)

Privileged Access Workstations (PAWs)

Azure AD Privileged Identity Management (PIM)

You have a Microsoft 365 subscription that syncs with Active Directory Domain Services (AD DS).You need to define the recovery steps for a ransomware attack that encrypted data in the subscription The solution must follow Microsoft Security Best Practices. What is the first step in the recovery plan?

Disable Microsoft OneDnve sync and Exchange ActiveSync.

Recover files to a cleaned computer or device.

From Microsoft Defender for Endpoint perform a security scan.

You have an Azure AD tenant that syncs with an Active Directory Domain Services (AD DS) domain.You have an on-premises datacenter that contains 100 servers. The servers run Windows Server and are backed up by using Microsoft Azure Backup Server (MABS). You are designing a recovery solution for ransomware attacks. The solution follows Microsoft Security Best Practices. You need to ensure that a compromised administrator account cannot be used to delete the backupsWhat should you do?

From a Recovery Services vault generate a security PIN for critical operations.

From Azure Backup, configure multi-user authorization by using Resource Guard.

From Microsoft Azure Backup Setup, register MABS with a Recovery Services vault

From Azure AD Privileged identity Management (PIM), create a role assignment for the Backup Contributor role.

You have a Microsoft 365 subscription.You are designing a user access solution that follows the Zero Trust principles of the Microsoft Cybersecurity Reference Architectures (MCRA). You need to recommend a solution that automatically restricts access to Microsoft Exchange Online.SharePoint Online, and Teams m near-real-lime (NRT) in response to the following Azure AD events:• A user account is disabled or deleted• The password of a user is changed or reset.• All the refresh tokens for a user are revoked• Multi-factor authentication (MFA) is enabled for a userWhich two features should you include in the recommendation? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

Azure AD Privileged Identity Management (PIM)

Your company plans to evaluate the security of its Azure environment based on the principles of the Microsoft Cloud Adoption Framework for Azure. You need to recommend a cloud-based service to evaluate whether the Azure resources comply with the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF). What should you recommend?

Compliance Manager in Microsoft Purview

Microsoft Defender for Cloud Apps

Your company uses Azure Pipelines and Azure Repos to implement continuous integration and continuous deployment (CI/CD) workflows for the deployment of applications to Azure. You are updating the deployment process to align with DevSecOps controls guidance in the Microsoft Cloud Adoption Framework for Azure. You need to recommend a solution to ensure that all code changes are submitted by using pull requests before being deployed by the CI/CD workflow. What should you include in the recommendation?

custom roles in Azure Pipelines

Your company plans to apply the Zero Trust Rapid Modernization Plan (RaMP) to its IT environment.You need to recommend the top three modernization areas to prioritize as part of the plan.Which three areas should you recommend based on RaMP? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

data, compliance, and governance

operational technology (OT) and loT

You have an operational model based on the Microsoft Cloud Adoption framework for Azure.You need to recommend a solution that focuses on cloud-centric control areas to protect resources such as endpoints, database, files, and storage accounts.What should you include in the recommendation?

security baselines in the Microsoft Cloud Security Benchmark

You are designing a new Azure environment based on the security best practices of the Microsoft Cloud Adoption Framework for Azure. The environment will contain one subscription for shared infrastructure components and three separate subscriptions for applications.You need to recommend a deployment solution that includes network security groups (NSGs) Azure Key Vault, and Azure Bastion. The solution must minimize deployment effort and follow security best practices of the Microsoft Cloud Adoption Framework for Azure.What should you include in the recommendation?

the Azure landing zone accelerator

the Azure Will-Architected Framework

You have an on-premises network and a Microsoft 365 subscription.You are designing a Zero Trust security strategy.Which two security controls should you include as part of the Zero Trust solution? Each correct answer part of the solution.NOTE: Each correct answer is worth one point.

Block sign-attempts from unknown location.

Block sign-in attempts from noncompliant devices.

Block sign-attempts from unknown location.

Always allow connections from the on-premises network.

Disable passwordless sign-in for sensitive account.

Block sign-in attempts from noncompliant devices.

You have an Azure subscription.You have a DNS domain named contoso.com that is hosted by a third-party DNS registrar.Developers use Azure DevOps to deploy web apps to App Service Environments- When a new app is deployed, a CNAME record for the app is registered in contoso.com.You need to recommend a solution to secure the DNS record tor each web app. The solution must meet the following requirements:* Ensure that when an app is deleted, the CNAME record for the app is removed also* Minimize administrative effort.What should you include in the recommendation?

Microsoft Defender for Cloud Apps

Microsoft Defender foe App Service

Microsoft Defender for Cloud Apps

You are designing a security operations strategy based on the Zero Trust framework.You need to minimize the operational load on Tier 1 Microsoft Security Operations Center (SOC) analysts.What should you do?

Enable built-in compliance policies in Azure Policy.

Enable self-healing in Microsoft 365 Defender.

Create hunting queries in Microsoft 365 Defender.

You have an Azure AD tenant that syncs with an Active Directory Domain Services (AD DS) domain.You are designing an Azure DevOps solution to deploy applications to an Azure subscription by using continuous integration and continuous deployment (CI/CD) pipelines.You need to recommend which types of identities to use for the deployment credentials of the service connection. The solution must follow DevSecOps best practices from the Microsoft Cloud Adoption Framework for Azure.What should you recommend?

an Azure AD user account that has a password stored in Azure Key Vault

a group managed service account (gMSA)

an Azure AD user account that has role assignments in Azure AD Privileged Identity Management {PIM)

For of an Azure deployment you are designing a security architecture based on the Microsoft Cloud Security Benchmark. You need to recommend a best practice for implementing service accounts for Azure API management What should you include in the recommendation?

device registrations in Azure AD

application registrations m Azure AD

Azure service principals with certificate credentials

Azure service principals with usernames and passwords

You have a Microsoft 365 tenant. Your company uses a third-party software as a service (SaaS) app named App1. App1 supports authenticating users by using Azure AO credentials. You need to recommend a solution to enable users to authenticate to App1 by using their Azure AD credentials. What should you include in the recommendation?

an Azure AD enterprise application

a retying party trust in Active Directory Federation Services (AD FS)

You are designing a ransomware response plan that follows Microsoft Security Best Practices.You need to recommend a solution to minimize the risk of a ransomware attack encrypting local user files.What should you include in the recommendation?

Microsoft Defender for Endpoint

BitLocker Drive Encryption (BitLocker)

You have a Microsoft 365 subscription.You need to design a solution to block file downloads from Microsoft SharePoint Online by authenticated users on unmanaged devices.Which two services should you include in the solution? Each correct answer presents part of the solution.NOTE: Each correct selection is worth one point.

Microsoft Defender for Cloud Apps

Microsoft Purview Information Protection

You have an Azure subscription.Your company has a governance requirement that resources must be created in the West Europe or North Europe Azure regions.What should you recommend using to enforce the governance requirement?

regulatory compliance standards in Microsoft Defender for Cloud

You have a Microsoft 365 tenant.Your company uses a third-party software as a service (SaaS) app named App1 that is integrated with an Azure AD tenant. You need to design a security strategy to meet the following requirements:* Users must be able to request access to App1 by using a self-service request.* When users request access to App1, they must be prompted to provide additional information about their request.* Every three months, managers must verify that the users still require access to Appl.What should you include in the design?

Microsoft Entra Identity Governance

connected apps in Microsoft Defender for Cloud Apps

Microsoft Entra Identity Governance

access policies in Microsoft Defender for Cloud Apps

You have an Azure subscription. The subscription contains 100 virtual machines that run Windows Server. The virtual machines are managed by using Azure Policy and Microsoft Defender for Servers.You need to enhance security on the virtual machines. The solution must meet the following requirements:* Ensure that only apps on an allowlist can be run.* Require administrators to confirm each app added to the allowlist.* Automatically add unauthorized apps to a blocklist when an attempt is made to launch the app.* Require administrators to approve an app before the app can be moved from the blocklist to the allowlist.What should you include in the solution?

adaptive application controls in Defender for Servers

a compute policy in Azure Policy

admin consent settings for enterprise applications in Azure AD

adaptive application controls in Defender for Servers

app governance in Microsoft Defender for Cloud Apps

You design cloud-based software as a service (SaaS) solutions.You need to recommend ransomware attacks. The solution must follow Microsoft Security Best Practices.What should you recommend doing first?

Develop a privileged access strategy.

Develop a privileged identity strategy.

You have the following on-premises servers that run Windows Server:* Two domain controllers in an Active Directory Domain Services (AD DS) domain* Two application servers named Server1 and Server2 that run ASP.NET web apps* A VPN server named Server3 that authenticates by using RADIUS and AD DSEnd users use a VPN to access the web apps over the internet.You need to redesign a user access solution to increase the security of the connections to the web apps. The solution must minimize the attack surface and follow the Zero Trust principles of the Microsoft Cybersecurity Reference Architectures (MCRA).What should you include in the recommendation?

Publish the web apps by using Azure AD Application Proxy.

Configure connectors and rules in Microsoft Defender for Cloud Apps.

Configure web protection in Microsoft Defender for Endpoint.

Publish the web apps by using Azure AD Application Proxy.

Configure the VPN to use Azure AD authentication.

Microsoft SC-100 Practice Test 4 - Free Online Exam Prep & Questions

Your company plans to follow DevSecOps best practices of the Microsoft Cloud Adoption Framework for Azure. You need to perform threat modeling by using a top-down approach based on the Microsoft Cloud Adoption Framework for Azure. What should you use to start the threat modeling process?

Become a Premium Member for full access

Unlock Premium Member

Microsoft SC-100 Practice Test 4

Question

Microsoft SC-100 Practice Tests

Practice Tests