Microsoft SC-100 Exam Dumps

Microsoft Cybersecurity Architect

Microsoft SC-100 Sample Questions

Question # 1

You have a Microsoft 365 tenant that contains 5,000 users and 5,000 Windows 11 devices. All users are assigned Microsoft 365 £5 licenses and the Microsoft Defender Vulnerability Management add-on. The Windows 11 devices are managed by using Microsoft Intune and Microsoft Defender for Endpoint. The Windows 11 devices are configured during deployment to comply with Center for Internet Security (CIS) benchmarks for Windows 11. You need to recommend a compliance solution for the Windows 11 devices. The solution must identify devices that were modified and no longer comply with the CIS benchmarks. What should you include in the recommendation?  

A. Authenticated scan for Windows in Microsoft Defender Vulnerability Management 
B. Microsoft Secure Score for Devices in Defender for Endpoint 
C. attack surface reduction (ASR) rules in Defender for Endpoint 
D. security baselines assessments in Microsoft Defender Vulnerability Management

Show Answer

Question # 2

You have an Azure subscription that has Microsoft Defender for Cloud enabled. You need to enforce ISO 27001:2013 standards for new resources deployed to the subscription. The solution must ensure that noncompliant resources are automatically detected. What should you use? 

A. Azure Blueprints 
B. the regulatory compliance dashboard in Defender for Cloud 
C. Azure role-based access control (Azure RBAC) 
D. Azure Policy 

Show Answer

Question # 3

You design cloud-based software as a service (SaaS) solutions. You need to recommend ransomware attacks. The solution must follow Microsoft Security Best Practices. What should you recommend doing first?

A. Implement data protection. 
B. Develop a privileged access strategy. 
C. Prepare a recovery plan. 
D. Develop a privileged identity strategy. 

Show Answer

Question # 4

You have an on-premises server that runs Windows Server and contains a Microsoft SQL Server database named DB1. You plan to migrate DB1 to Azure. You need to recommend an encrypted Azure database solution that meets the following requirements: • Minimizes the risks of malware that uses elevated privileges to access sensitive data • Prevents database administrators from accessing sensitive data • Enables pattern matching for server-side database operations • Supports Microsoft Azure Attestation • Uses hardware-based encryption What should you include in the recommendation?

A. SQL Server on Azure Virtual Machines with virtualization-based security (VBS) enclaves 
B. Azure SQL Database with virtualization-based security (VBS) enclaves 
C. Azure SQL Managed Instance that has Always Encrypted configured 
D. Azure SQL Database with Intel Software Guard Extensions (Intel SGX) enclaves 

Show Answer

Question # 5

You are designing the encryption standards for data at rest for an Azure resource You need to provide recommendations to ensure that the data at rest is encrypted by using AES-256 keys. The solution must support rotating the encryption keys monthly. Solution: For blob containers in Azure Storage, you recommend encryption that uses customer-managed keys (CMKs). Does this meet the goal?

A. Yes
 B. No 

Show Answer

Question # 6

Your on-premises network contains an Active Directory Domain Services (AD DS) domain. The domain contains 500 Windows 11 devices. You have a Microsoft 365 subscription and an Azure subscription. You have a Microsoft Entra tenant that syncs with the domain and is linked to the subscriptions. The devices are Microsoft Entra hybrid joined. You plan to deploy a solution to mitigate attacks against privileged accounts. The solution will include Microsoft Sentinel rules that will detect attempts to use fake cached credentials. You need to recommend a solution to create the fake cached credentials on client computers. What should you recommend? 

A. User and Entity Behavior Analytics (UEBA) in Microsoft Sentinel 
B. a deception rule in Microsoft Defender for Endpoint 
C. a Honeytoken tag in Microsoft Defender for Identity 
D. a user risk policy in Microsoft Entra ID Protection 

Show Answer

Question # 7

You have an Azure subscription. You have a DNS domain named contoso.com that is hosted by a third-party DNS registrar. Developers use Azure DevOps to deploy web apps to App Service Environments- When a new app is deployed, a CNAME record for the app is registered in contoso.com. You need to recommend a solution to secure the DNS record tor each web app. The solution must meet the following requirements: • Ensure that when an app is deleted, the CNAME record for the app is removed also • Minimize administrative effort. What should you include in the recommendation? 

A. Microsoft Defender for DevOps 
B. Microsoft Defender foe App Service 
C. Microsoft Defender for Cloud Apps 
D. Microsoft Defender for DNS 

Show Answer

Question # 8

You have an Azure subscription. You have a subscription to a third-party cloud provider. The subscription contains 100 virtual machines. You manage cloud security for both subscriptions from the Azure subscription. You need to recommend a solution to validate the security posture of the virtual machines. Which two services should you include in the recommendation? Each correct answer presents part of the solution.

A. Microsoft Defender for Cloud 
B. Microsoft Defender for Endpoint 
C. Azure Lighthouse 
D. Microsoft Sentinel 
E. Azure Arc 

Show Answer

Question # 9

Your on-premises network contains an Active Directory Domain Services (AD DS) domain named corpxontoso.com and an AD DS-integrated application named App1. Your perimeter network contains a server named Server1 that runs Windows Server. You have a Microsoft Entra tenant named contoso.com that syncs with corp.contoso.com. You plan to implement a security solution that will include the following configurations: • Manage access to App1 by using Microsoft Entra Private Access. • Deploy a Microsoft Entra application proxy connector to Server1. • Implement single sign-on (SSO) for App1 by using Kerberos constrained delegation. • For Server1, configure the following rules in Windows Defender Firewall with Advanced Security: o Rule1: Allow TCP 443 inbound from a designated set of Azure URLs. o Rule2: Allow TCP 443 outbound to a designated set of Azure URLs. o Rule3: Allow TCP 80 outbound to a designated set of Azure URLs. o Rule4: Allow TCP 389 outbound to the domain controllers on corp.contoso.com. You need to maximize security for the planned implementation. The solution must minimize the impact on the connector. Which rule should you remove?

A. Rule1 
B. Rule2 
C. Rule3 
D. Rule4 

Show Answer

Question # 10

You have an Azure AD tenant that syncs with an Active Directory Domain Services {AD DS) domain. Client computers run Windows and are hybrid-joined to Azure AD. You are designing a strategy to protect endpoints against ransomware. The strategy follows Microsoft Security Best Practices. You plan to remove all the domain accounts from the Administrators group on the Windows computers. You need to recommend a solution that will provide users with administrative access to the Windows computers only when access is required. The solution must minimize the lateral movement of ransomware attacks if an administrator account on a computer is compromised. What should you include in the recommendation?

A. Local Administrator Password Solution (LAPS) 
B. Privileged Access Workstations (PAWs) 
C. Azure AD Privileged Identity Management (PIM) 
D. Azure AD identity Protection 

Show Answer

Question # 11

For a Microsoft cloud environment, you are designing a security architecture based on the Microsoft Cloud Security Benchmark. What are three best practices for identity management based on the Azure Security Benchmark? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point. 

A. Manage application identities securely and automatically. 
B. Manage the lifecycle of identities and entitlements 
C. Protect identity and authentication systems. 
D. Enable threat detection for identity and access management. 
E. Use a centralized identity and authentication system. 

Show Answer

Question # 12

You have an Azure subscription that contains multiple Azure Data Lake Storage accounts. You need to recommend a solution to encrypt the content of the accounts by using serviceside encryption and customer-managed keys. The solution must ensure that individual encryption keys are applied at the most granular level. At which level should you recommend the encryption be applied? 

A. account 
B. folder 
C. file 
D. container 

Show Answer

Question # 13

A customer has a Microsoft 365 E5 subscription and an Azure subscription. The customer wants to centrally manage security incidents, analyze log, audit activity, and search for potential threats across all deployed services. You need to recommend a solution for the customer. The solution must minimize costs. What should you include in the recommendation?

A. Microsoft 365 Defender
 B. Microsoft Defender for Cloud
 C. Microsoft Defender for Cloud Apps 
D. Microsoft Sentinel 

Show Answer

Question # 14

You have to Azure subscriptions that contain 100 role-based access control (RBAC) role assignments. You plan to consolidate the role assignments. You need to recommend a solution to identify which role assignments were NOT used during the last 90 days. The solution must minimize administrative effort. What should you include in the recommendation?

A. Microsoft Defender for Cloud 
B. Microsoft Entra access reviews 
C. Microsoft Entra Privileged Identity Management (PIM) 
D. Microsoft Entra Permissions Management 

Show Answer

Question # 15

You have an Azure subscription that contains a Microsoft Sentinel workspace. Your on-premises network contains firewalls that support forwarding event logs m the Common Event Format (CEF). There is no built-in Microsoft Sentinel connector for the firewalls You need to recommend a solution to ingest events from the firewalls into Microsoft Sentinel. What should you include m the recommendation?

A. an Azure logic app 
B. an on-premises Syslog server 
C. an on-premises data gateway 
D. Azure Data Factory 

Show Answer

Question # 16

You have a Microsoft Entra tenant named contoso.com. You have an external partner that has a Microsoft Entra tenant named fabrikam.com. You need to recommend an identity governance solution for contoso.com that meets the following requirements: Enables the users in contoso.com and fabrikam.com to communicate by using shared Microsoft Teams channels. Manages access to shared Teams channels in contoso.com by using groups in fabrikam.com. Supports single sign-on (SSO). Minimizes administrative effort. Maximizes security. What should you include in the recommendation?

A. Microsoft Entra B2B collaboration 
B. Microsoft Entra Connect Sync 
C. Cross-tenant synchronization
 D. B2B direct connect

Show Answer

Question # 17

You are designing a new Azure environment based on the security best practices of the Microsoft Cloud Adoption Framework for Azure. The environment will contain one subscription for shared infrastructure components and three separate subscriptions for applications. You need to recommend a deployment solution that includes network security groups (NSGs) Azure Key Vault, and Azure Bastion. The solution must minimize deployment effort and follow security best practices of the Microsoft Cloud Adoption Framework for Azure. What should you include in the recommendation?

A. the Azure landing zone accelerator 
B. the Azure Will-Architected Framework
 C. Azure Security Benchmark v3 
D. Azure Advisor 

Show Answer

Question # 18

You have a Microsoft Entra tenant named contoso.com and use Microsoft Intune. Each user in contoso.com has a Microsoft Entra ID P1 license and a Windows 11 device that has the Global Secure Access client deployed. You plan to deploy the following configuration of Microsoft Entra Internet Access: • Enable a baseline profile. • Create a security profile named Profile` that has a priority of 300 and contains a single web content filtering policy named WCFPolicy configure WCFPolicy1 as follows: o Set Action to allow. o Include a single rule that has a fully qualified domain name (FQDN) destination of ‘. adatum.com. • Link Profile1 to a Conditional Access policy named CAPolicy1, apply CAPolicy1 to all users, and grant access unless a user's device is noncompliant You need to evaluate the impact of the planned deployment on traffic to the following resources: • https://www.adatum.com:8433 • https://www.fabrikam.com Which two traffic scenarios will occur? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point

A. Traffic to https://www.fabrikam.com will be allowed from all the devices. 
B. Traffic to https://www.adatum.com:8433 will be blocked from all the devices. 
C. Traffic to https://www.adatumxom:8433 will be allowed from all the devices. 
D. Traffic to https://www.fabrikam.com will be allowed from compliant devices only. 
E. Traffic to https://www.adatum.com:8433 will be allowed from compliant devices only. 
F. Traffic to https://www.fabrikam.com will be blocked from noncompliant devices only. 

Show Answer

Question # 19

You have an on-premises datacenter and an Azure Kubernetes Service (AKS) cluster named AKS1. You need to restrict internet access to the public endpoint of AKS 1. The solution must ensure that AKS1 can be accessed only from the public IP addresses associated with the on-premises datacenter. What should you use?

A. a network security group (N5G) 
B. a service endpoint 
C. a private endpoint 
D. an authorized IP range 

Show Answer

Question # 20

For of an Azure deployment you are designing a security architecture based on the Microsoft Cloud Security Benchmark. You need to recommend a best practice for implementing service accounts for Azure API management. What should you include in the recommendation?

A. device registrations in Azure AD 
B. application registrations m Azure AD 
C. Azure service principals with certificate credentials 
D. Azure service principals with usernames and passwords 
E. managed identities in Azure 

Show Answer

Question # 21

You have an Azure subscription You plan to deploy multiple containerized microservice-based apps to Azure Kubemetes Service (AKS) You need to recommend a solution that meets the following requirements: • Manages secrets • Provides encryption • Secures service-to-service communication by using mTLS encryption • Minimizes administrative effort What should you include in the recommendation?

A. Flux 
B. Envoy 
C. Dapr 
D. Istio 

Show Answer