You have an Azure subscription. The subscription contains 50 virtual machines that run Windows Server and 50 virtual machines that run Linux. You need to perform vulnerability assessments on the virtual machines. The solution must meet the following requirements:* Identify missing updates and insecure configurations.* Use the Qualys engine.What should you use?

Microsoft Defender Threat Intelligence (Defender Tl)

Microsoft Defender for Endpoint

Microsoft Defender External Attack Surface Management (Defender EASM)

You have an Azure AD tenant that contains 10 Windows 11 devices and two groups named Group1 and Group2. The Windows 11 devices are joined to the Azure AD tenant and are managed by using Microsoft Intune.You are designing a privileged access strategy based on the rapid modernization plan (RaMP). The strategy will include the following configurations:* Each user in Group1 will be assigned a Windows 11 device that will be configured as a privileged access device.* The Security Administrator role will be mapped to the privileged access security level.* The users in Group1 will be assigned the Security Administrator role.* The users in Group2 will manage the privileged access devices.You need to configure the local Administrators group for each privileged access device. The solution must follow the principle of least privilege.What should you include in the solution?

Add Group2 to the local Administrators group.

Only add Group2 to the local Administrators group.

Configure Windows Local Administrator Password Solution (Windows LAPS) in legacy Microsoft LAPS emulation mode.

Add Group2 to the local Administrators group.

Add the user that is assigned the Security Administrator role to the local Administrators group of the user's assigned privileged access device.

You have a Microsoft 365 subscription. You have an Azure subscription.You need to implement a Microsoft Purview communication compliance solution for Microsoft Teams and Yammer. The solution must meet the following requirements:* Assign compliance policies to Microsoft 365 groups based on custom Microsoft Exchange Online attributes.* Minimize the number of compliance policies* Minimize administrative effortWhat should you include in the solution?

Azure AD Information Protection labels

Microsoft 365 Defender user tags

You have an on-premises server that runs Windows Server and contains a Microsoft SQL Server database named DB1.You plan to migrate DB1 to Azure.You need to recommend an encrypted Azure database solution that meets the following requirements:* Minimizes the risks of malware that uses elevated privileges to access sensitive data* Prevents database administrators from accessing sensitive data* Enables pattern matching for server-side database operations* Supports Microsoft Azure Attestation* Uses hardware-based encryptionWhat should you include in the recommendation?

Azure SQL Database with Intel Software Guard Extensions (Intel SGX) enclaves

SQL Server on Azure Virtual Machines with virtualization-based security (VBS) enclaves

Azure SQL Database with virtualization-based security (VBS) enclaves

Azure SQL Managed Instance that has Always Encrypted configured

Azure SQL Database with Intel Software Guard Extensions (Intel SGX) enclaves

You have an Azure subscription that has Microsoft Defender for Cloud enabled.You need to enforce ISO 27001:2013 standards for new resources deployed to the subscription. The solution must ensure that noncompliant resources are automatically detected.What should you use?

the regulatory compliance dashboard in Defender for Cloud

Azure role-based access control (Azure RBAC)

You have a Microsoft 365 tenant that contains 5,000 users and 5,000 Windows 11 devices. All users are assigned Microsoft 365 5 licenses and the Microsoft Defender Vulnerability Management add-on. The Windows 11 devices are managed by using Microsoft Intune and Microsoft Defender for Endpoint. The Windows 11 devices are configured during deployment to comply with Center for Internet Security (CIS) benchmarks for Windows 11.You need to recommend a compliance solution for the Windows 11 devices. The solution must identify devices that were modified and no longer comply with the CIS benchmarks.What should you include in the recommendation?

security baselines assessments in Microsoft Defender Vulnerability Management

Authenticated scan for Windows in Microsoft Defender Vulnerability Management

Microsoft Secure Score for Devices in Defender for Endpoint

attack surface reduction (ASR) rules in Defender for Endpoint

security baselines assessments in Microsoft Defender Vulnerability Management

You have a multicloud environment that contains Azure, Amazon Web Services (AWS), and Google Cloud Platform (GCP) subscriptions.You need to discover and review role assignments across the subscriptions.What should you use?

Microsoft Entra Permissions Management

Microsoft Defender for Identity

You have a Microsoft 365 tenant that uses Microsoft SharePoint Online and Microsoft Purview. Microsoft Purview has a sensitivity label named Label1 that is applied to the files stored on SharePoint Online sites.You need to recommend a Microsoft Purview Data Loss Prevention (DLP) policy that meets the following requirements:* Prevents users from uploading the files to third-party external websites* Allows users to upload the files to Microsoft OneDrive for BusinessTo which location should you apply the DLP policy?

Microsoft Defender for Cloud Apps

You have an on-premises app named App1. Remote users access App1 by using VPN connections. You have a third-party software as a service (SaaS) app named App2. You need to deploy Global Secure Access to manage access to App1 and App2. What should you use for each app?

Microsoft Entra Private Access for App1 and Microsoft Entra Internet Access for App2

Microsoft Entra Private Access for App1 and App2

Microsoft Entra Internet Access for App1 and App2

Microsoft Entra Private Access for App2 and Microsoft Entra Internet Access for App1

You have an Azure subscription that contains multiple network security groups (NSGs), multiple virtual machines, and an Azure Bastion host named bastion1.Several NSGs contain rules that allow direct RDP access to the virtual machines by bypassing bastion!You need to ensure that the virtual machines can be accessed only by using bastion! The solution must prevent the use of NSG rules to bypass bastion1.What should you include in the solution?

Azure Virtual Network Manager security admin rules

Azure Virtual Network Manager connectivity configurations

Azure Virtual Network Manager security admin rules

Azure Firewall application rules

Your company has a main office and 10 branch offices. Each branch office contains an on-premises file server that runs Windows Server and multiple devices that run either Windows 11 or macOS. The devices are enrolled in Microsoft Intune.You have a Microsoft Entra tenant.You need to deploy Global Secure Access to implement web filtering for device traffic to the internet The solution must ensure that all the web traffic from the devices in the branch offices is controlled by using Global Secure Access.What should you do first in each branch office?

Configure an IPsec tunnel on the router.

Configure an Intune policy to deploy the Global Secure Access client to each device.

Configure an IPsec tunnel on the router.

Install the Microsoft Entra private network connector on the file server.

Configure an Intune policy to onboard Microsoft Defender for Endpoint to each device.

You have an Azure Kubernetes Service (AKS) cluster that hosts Linux nodes.You need to recommend a solution to ensure that deployed worker nodes have the latest kernel updates. The solution must minimize administrative effort.What should you recommend?

The updates must first be applied to the image used to provision the nodes.

The AKS cluster version must be upgraded.

The updates must first be applied to the image used to provision the nodes.

The nodes must restart after the updates are applied.

You have a Microsoft 365 subscription that contains 1,000 users. Each user is assigned a Microsoft 365 E5 license.The subscription uses sensitivity labels to classify corporate documents. All the users have Windows 11 devices that are onboarded to Microsoft Defender for Endpoint and are configured to sync files to Microsoft OneDrive.You need to prevent the users from uploading the documents from OneDrive to external websites.What should you include in the solution?

Microsoft Purview data loss prevention (DLP)

Microsoft Purview Information Protection

Microsoft Purview data loss prevention (DLP)

web content filtering in Defender for Endpoint

You have to Azure subscriptions that contain 100 role-based access control (RBAC) role assignments.You plan to consolidate the role assignments.You need to recommend a solution to identify which role assignments were NOT used during the last 90 days. The solution must minimize administrative effort.What should you include in the recommendation?

Microsoft Entra Permissions Management

Microsoft Entra Privileged Identity Management (PIM)

Microsoft Entra Permissions Management

You have a Microsoft Entra tenant. The tenant contains 500 Windows devices that have the Global Secure Access client deployed.You have a third-party software as a service (SaaS) app named App1.You plan to implement Global Secure Access to manage access to App1.You need to recommend a solution to manage connections to App1. The solution must ensure that users authenticate by using their Microsoft Entra credentials before they can connect to App1.What should you include the recommendation?

a private access traffic forwarding profile

an internet access traffic forwarding profile

You have a Microsoft Entra tenant named contoso.com and use Microsoft Intune. Each user in contoso.com has a Microsoft Entra ID P1 license and a Windows 11 device that has the Global Secure Access client deployed.You plan to deploy the following configuration of Microsoft Entra Internet Access:* Enable a baseline profile.* Create a security profile named Profile` that has a priority of 300 and contains a single web content filtering policy named WCFPolicy configure WCFPolicy1 as follows:o Set Action to allow.o Include a single rule that has a fully qualified domain name (FQDN) destination of '. adatum.com.* Link Profile1 to a Conditional Access policy named CAPolicy1, apply CAPolicy1 to all users, and grant access unless a user's device is noncompliantYou need to evaluate the impact of the planned deployment on traffic to the following resources:* https://www.adatum.com:8433* https://www.fabrikam.comWhich two traffic scenarios will occur? Each correct answer presents a complete solution.NOTE: Each correct selection is worth one point

Traffic to https://www.fabrikam.com will be allowed from all the devices.

Traffic to https://www.adatum.com:8433 will be allowed from compliant devices only.

Traffic to https://www.fabrikam.com will be allowed from all the devices.

Traffic to https://www.adatum.com:8433 will be blocked from all the devices.

Traffic to https://www.adatum.com:8433 will be allowed from all the devices.

Traffic to https://www.fabrikam.com will be allowed from compliant devices only.

Traffic to https://www.adatum.com:8433 will be allowed from compliant devices only.

Traffic to https://www.fabrikam.com will be blocked from noncompliant devices only.

Microsoft SC-100 Practice Test 5 - Free Online Exam Prep & Questions

HOTSPOT

You need to recommend a security methodology for a DevOps development process based on the Microsoft Cloud Adoption Framework for Azure.

During which stage of a continuous integration and continuous deployment (CI/CD) DevOps process should each security-related task be performed? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point

Become a Premium Member for full access

Unlock Premium Member

Microsoft SC-100 Practice Test 5

Question

Microsoft SC-100 Practice Tests

Practice Tests