Download Free Microsoft SC-100 Exam Questions & Answer
Online VALID SC-100 Exam Dumps File Instantly
NEW QUESTION # 15
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You are designing the encryption standards for data at rest for an Azure resource.
You need to provide recommendations to ensure that the data at rest is encrypted by using AES-
256 keys. The solution must support rotating the encryption keys monthly.
Solution: For Azure SQL databases, you recommend Transparent Data Encryption (TDE) that uses customer-managed keys (CMKs).
Does this meet the goal?
- A. Yes
- B. No
Answer: A
Explanation:
We need to use customer-managed keys.
Transparent data encryption (TDE) helps protect Azure SQL Database, Azure SQL Managed Instance, and Azure Synapse Analytics against the threat of malicious offline activity by encrypting data at rest. It performs real-time encryption and decryption of the database, associated backups, and transaction log files at rest without requiring changes to the application.
In Azure, the default setting for TDE is that the Database Encryption Key (DEK) is protected by a built-in server certificate. The built-in server certificate is unique for each server and the encryption algorithm used is AES 256.
TDE protector is either a service-managed certificate (service-managed transparent data encryption) or an asymmetric key stored in Azure Key Vault (customer- managed transparent data encryption).
Note: Automated key rotation in Key Vault allows users to configure Key Vault to automatically generate a new key version at a specified frequency. You can use rotation policy to configure rotation for each individual key. Our recommendation is to rotate encryption keys at least every two years to meet cryptographic best practices.
This feature enables end-to-end zero-touch rotation for encryption at rest for Azure services with customer-managed key (CMK) stored in Azure Key Vault. Please refer to specific Azure service documentation to see if the service covers end-to-end rotation.
Reference:
https://docs.microsoft.com/en-us/azure/azure-sql/database/transparent-data-encryption-tde- overview
https://docs.microsoft.com/en-us/azure/key-vault/keys/how-to-configure-key-rotation
NEW QUESTION # 16
Your company has an office in Seattle.
The company has two Azure virtual machine scale sets hosted on different virtual networks.
The company plans to contract developers in India.
You need to recommend a solution provide the developers with the ability to connect to the virtual machines over SSL from the Azure portal. The solution must meet the following requirements:
* Prevent exposing the public IP addresses of the virtual machines.
* Provide the ability to connect without using a VPN.
* Minimize costs.
Which two actions should you perform? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
- A. Deploy Azure Bastion to each virtual network.
- B. Create a hub and spoke network by using virtual network peering.
- C. Deploy Azure Bastion to one virtual network.
- D. Create NAT rules and network rules in Azure Firewall.
- E. Enable just-in-time VM access on the virtual machines.
Answer: B,D
NEW QUESTION # 17
You have a Microsoft 365 E5 subscription and an Azure subscripts You need to evaluate the existing environment to increase the overall security posture for the following components:
* Windows 11 devices managed by Microsoft Intune
* Azure Storage accounts
* Azure virtual machines
What should you use to evaluate the components? To answer, select the appropriate options in the answer area.
Answer:
Explanation:
NEW QUESTION # 18
You are designing the encryption standards for data at rest for an Azure resource You need to provide recommendations to ensure that the data at rest is encrypted by using AES-256 keys. The solution must support rotating the encryption keys monthly.
Solution: For blob containers in Azure Storage, you recommend encryption that uses Microsoft-managed keys within an encryption scope.
Does this meet the goal?
- A. No
- B. Yes
Answer: A
Explanation:
Explanation
https://docs.microsoft.com/en-us/azure/key-vault/keys/how-to-configure-key-rotation
NEW QUESTION # 19
You need to recommend a solution to meet the AWS requirements.
What should you include in the recommendation? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Explanation:
NEW QUESTION # 20
You need to recommend a solution to scan the application code. The solution must meet the application development requirements. What should you include in the recommendation?
- A. Application Insights in Azure Monitor
- B. Azure Key Vault
- C. GitHub Advanced Security
- D. Azure DevTest Labs
Answer: D
NEW QUESTION # 21
You are creating the security recommendations for an Azure App Service web app named App1.
App1 has the following specifications:
* Users will request access to App1 through the My Apps portal. A human resources manager will approve the requests.
* Users will authenticate by using Azure Active Directory (Azure AD) user accounts.
You need to recommend an access security architecture for App1.
What should you include in the recommendation? To answer, select the appropriate options in the answer are a. NOTE: Each correct selection is worth one point.
Answer:
Explanation:
NEW QUESTION # 22
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have an Azure subscription that has Microsoft Defender for Cloud enabled.
You are evaluating the Azure Security Benchmark V3 report.
In the Secure management ports controls, you discover that you have 0 out of a potential 8 points.
You need to recommend configurations to increase the score of the Secure management ports controls.
Solution: You recommend enabling the VM Access extension on all virtual machines.
Does this meet the goal?
- A. No
- B. Yes
Answer: A
Explanation:
Instead: You recommend enabling just-in-time (JIT) VM access on all virtual machines.
Note:
Secure management ports - Brute force attacks often target management ports. Use these recommendations to reduce your exposure with tools like just-in-time VM access and network security groups.
Recommendations:
- Internet-facing virtual machines should be protected with network security groups
- Management ports of virtual machines should be protected with just-in-time network access control
- Management ports should be closed on your virtual machines
Reference:
https://docs.microsoft.com/en-us/azure/defender-for-cloud/secure-score-security-controls
NEW QUESTION # 23
Your company is developing a modern application that will run as an Azure App Service web app. You plan to perform threat modeling to identify potential security issues by using the Microsoft Threat Modeling Tool.
Which type of diagram should you create?
- A. system flow
- B. data flow
- C. process flow
- D. network flow
Answer: B
Explanation:
https://docs.microsoft.com/en-us/learn/modules/tm-create-a-threat-model-using-foundational-data-flow- diagram-elements/1b-elements
https://docs.microsoft.com/en-us/azure/security/develop/threat-modeling-tool-getting-started?
source=recommendations
NEW QUESTION # 24
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
Your on-premises network contains an e-commerce web app that was developed in Angular and Node,js. The web app uses a MongoDB database. You plan to migrate the web app to Azure.
The solution architecture team proposes the following architecture as an Azure landing zone.
You need to provide recommendations to secure the connection between the web app and the database. The solution must follow the Zero Trust model.
Solution: You recommend implementing Azure Front Door with Azure Web Application Firewall (WAF).
Does this meet the goal?
- A. No
- B. Yes
Answer: A
Explanation:
When using Azure-provided PaaS services (e.g., Azure Storage, Azure Cosmos DB, or Azure Web App, use the PrivateLink connectivity option to ensure all data exchanges are over the private IP space and the traffic never leaves the Microsoft network.
NEW QUESTION # 25
Hotspot Question
You have a Microsoft Entra tenant named contoso.com. You have 30 Azure subscriptions that are linked to contoso.com. The tenant contains the management groups shown in the following table.
You need to design a governance solution to manage access to all the Azure Storage accounts across the subscriptions. The solution must meet the following requirements:
- Use custom role-based access control (RBAC) to provide granular
access to control plane and data plane operations.
- Minimize administrative effort.
At which scope should you assign the roles, and what is the minimum number of assignments per role? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Explanation:
Box 1: ..Mgmt1 AND .. Mgmt2
For Microsoft Entra's two management groups, the appropriate scope for assigning roles is the management group level itself. This is because management groups are designed to be a broader scope for managing access and policies across multiple subscriptions.
Box 2: 2
Note:
Broadest Scope:
Management groups are the broadest scope in Azure, encompassing multiple subscriptions.
Reference:
https://learn.microsoft.com/en-us/azure/governance/management-groups/overview
NEW QUESTION # 26
You have a Microsoft Entra tenant named contoso.com.
You have an external partner that has a Microsoft Entra tenant named fabnkam.com.
You need to recommend an identity governance solution for contoso.com that meets the following requirements:
- Enables the users in contoso.com and fabrikam.com to communicate by
using shared Microsoft Teams channels
- Manages access to shared Teams channels in contoso.com by using
groups in fabrikam.com
- Supports single sign-on (SSO)
- Minimizes administrative effort
- Maximizes security
What should you include in the recommendation?
- A. B2B direct connect
- B. Microsoft Entra B2B collaboration
- C. Microsoft Entra Connect Sync
- D. Cross-tenant synchronization
Answer: A
Explanation:
B2B direct connect is a feature of Microsoft Entra External ID that lets you set up a mutual trust relationship with another Microsoft Entra organization for seamless collaboration. This feature currently works with Microsoft Teams shared channels. With B2B direct connect, users from both organizations can work together using their home credentials and a shared channel in Teams, without having to be added to each other's organizations as guests.
Use B2B direct connect to share resources with external Microsoft Entra organizations. Or use it to share resources across multiple Microsoft Entra tenants within your own organization.
B2B direct connect requires a mutual trust relationship between two Microsoft Entra organizations to allow access to each other's resources. Both the resource organization and the external organization need to mutually enable B2B direct connect in their cross-tenant access settings.
When the trust is established, the B2B direct connect user has single sign-on access to resources outside their organization using credentials from their home Microsoft Entra organization.
Reference:
https://learn.microsoft.com/en-us/entra/external-id/b2b-direct-connect-overview
NEW QUESTION # 27
Drag and Drop Question
Your company wants to optimize ransomware incident investigations.
You need to recommend a plan to investigate ransomware incidents based on the Microsoft Detection and Response Team (DART) approach.
Which three actions should you recommend performing in sequence in the plan? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.
Answer:
Explanation:
Explanation:
https://learn.microsoft.com/en-us/security/compass/incident-response-playbook-dart- ransomware-approach
NEW QUESTION # 28
Your company plans to deploy several Azure App Service web apps. The web apps will be deployed to the West Europe Azure region. The web apps will be accessed only by customers in Europe and the United States.
You need to recommend a solution to prevent malicious bots from scanning the web apps for vulnerabilities. The solution must minimize the attach surface.
What should you include in the recommendation?
- A. Azure Firewall Premium
- B. network security groups (NSGs)
- C. Azure Traffic Manager and application security groups
- D. Azure Application Gateway Web Application Firewall (WAF)
Answer: D
Explanation:
Roughly 20% of all Internet traffic comes from bad bots. They do things like scraping, scanning, and looking for vulnerabilities in your web application. When these bots are stopped at the Web Application Firewall (WAF), they can't attack you. They also can't use up your resources and services, such as your backends and other underlying infrastructure.
You can enable a managed bot protection rule set for your WAF to block or log requests from known malicious IP addresses. The IP addresses are sourced from the Microsoft Threat Intelligence feed. Intelligent Security Graph powers Microsoft threat intelligence and is used by multiple services including Microsoft Defender for Cloud.
https://docs.microsoft.com/en-us/azure/web-application-firewall/ag/bot-protection-overview
NEW QUESTION # 29
You have an Azure subscription that contains 100 virtual machines, a virtual network named VNet1, and 20 users. The virtual machines run Windows Server and are connected to VNet1. The users work remotely and access Azure resources from Linux workstations.
You need to ensure that the users can connect to the virtual machines from the workstations by using Secure Shell (SSH). The solution must meet the following requirements:
- Ensure that the users authenticate by using their Microsoft Entra
credentials.
- Prevent the users from transferring files from the virtual machines
by using SSH.
- Prevent the users from directly accessing the virtual machines by
using the public IP address of the virtual machines.
What should you include in the solution?
- A. just-in-time (JIT) VM access
- B. Azure Bastion
- C. Point-to-Site (P2S) VPN
- D. Azure NAT Gateway
Answer: B
Explanation:
Azure Bastion is a fully managed service that provides more secure and seamless Remote Desktop Protocol (RDP) and Secure Shell Protocol (SSH) access to virtual machines (VMs) without any exposure through public IP addresses.
Azure Bastion supports Kerberos Entra authentication.
Reference:
https://learn.microsoft.com/en-us/azure/bastion/bastion-overview
NEW QUESTION # 30
You have a Microsoft 365 subscription and an Azure subscription. Microsoft 365 Defender and Microsoft Defender for Cloud are enabled.
The Azure subscription contains 50 virtual machines. Each virtual machine runs different applications on Windows Server 2019.
You need to recommend a solution to ensure that only authorized applications can run on the virtual machines. If an unauthorized application attempts to run or be installed, the application must be blocked automatically until an administrator authorizes the application.
Which security control should you recommend?
- A. app registrations in Azure AD
- B. adaptive application controls in Defender for Cloud
- C. Azure AD Conditional Access App Control policies
- D. app discovery anomaly detection policies in Microsoft Defender for Cloud Apps
Answer: B
NEW QUESTION # 31
Your company is migrating data to Azure. The data contains Personally Identifiable Information (Pll). The company plans to use Microsoft Information Protection for the Pll data store in Azure. You need to recommend a solution to discover Pll data at risk in the Azure resources.
What should you include in the recommendation? To answer, select the appropriate options in the answer are a. NOTE: Each correct selection is worth one point.
Answer:
Explanation:
NEW QUESTION # 32
You have an Azure subscription.
You have a DNS domain named contoso.com that is hosted by a third-party DNS registrar.
Developers use Azure DevOps to deploy web apps to App Service Environments. When a new app is deployed, a CNAME record for the app is registered in contoso.com.
You need to recommend a solution to secure the DNS record for each web app. The solution must meet the following requirements:
- Ensure that when an app is deleted, the CNAME record for the app is
removed also.
- Minimize administrative effort.
What should you include in the recommendation?
- A. Microsoft Defender for App Service
- B. Microsoft Defender for Cloud Apps
- C. Microsoft Defender for DNS
- D. Microsoft Defender for DevOps
Answer: A
Explanation:
Defender for App Service identifies any DNS entries remaining in your DNS registrar when an App Service website is decommissioned - these are known as dangling DNS entries.
https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service- introduction#dangling-dns-detection Microsoft Defender for DNS provides an additional layer of protection for resources that use Azure DNS's Azure-provided name resolution capability.
https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-app-service- introduction#dangling-dns-detection
NEW QUESTION # 33
You need to recommend a solution to meet the AWS requirements.
What should you include in the recommendation? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
NEW QUESTION # 34
A customer uses Azure to develop a mobile app that will be consumed by external users as shown in the following exhibit.
You need to design an identity strategy for the app. The solution must meet the following requirements:
* Enable the usage of external IDs such as Google, Facebook, and Microsoft accounts.
* Be managed separately from the identity store of the customer.
* Support fully customizable branding for each app.
Which service should you recommend to complete the design?
- A. Azure Active Directory (Azure AD) B2C
- B. Azure Active Directory Domain Services (Azure AD DS)
- C. Azure AD Connect
- D. Azure Active Directory (Azure AD) B2B
Answer: A
Explanation:
https://docs.microsoft.com/en-us/azure/active-directory-b2c/identity-provider-facebook?pivots=b2c-user-flow
https://docs.microsoft.com/en-us/azure/active-directory-b2c/customize-ui-with-html?pivots=b2c-user-flow
NEW QUESTION # 35
You receive a security alert in Microsoft Defender for Cloud as shown in the exhibit. (Click the Exhibit tab.)
After remediating the threat which policy definition should you assign to prevent the threat from reoccurring?
- A. Storage account public access should be disallowed
- B. Storage accounts should prevent shared key access
- C. Azure Key Vault Managed HSM should have purge protection enabled
- D. Storage account keys should not be expired
Answer: A
NEW QUESTION # 36
......
Microsoft SC-100 (Microsoft Cybersecurity Architect) Certification Exam is a comprehensive test designed to evaluate a candidate's knowledge and skills in cybersecurity architecture. Microsoft Cybersecurity Architect certification is ideal for IT professionals who are responsible for planning, designing, and implementing security solutions for organizations. SC-100 exam is intended to validate the candidate's expertise in various areas of cybersecurity, including threat protection, identity and access management, cloud security, and compliance.
Microsoft SC-100 exam covers a range of topics related to cybersecurity, including identity and access management, threat protection, data protection, and security management. SC-100 exam also covers topics such as cloud security, network security, and application security. SC-100 exam consists of multiple-choice questions and is conducted online.
SC-100 Exam Dumps For Certification Exam Preparation: https://www.prepawaytest.com/Microsoft/SC-100-practice-exam-dumps.html
100% Pass Guaranteed Download Microsoft Certified: Cybersecurity Architect Expert Exam PDF Q&A: https://drive.google.com/open?id=1iOjEuMXJGmrRl0fqPicaV-tyI4UYfUGO