SC-100 Free Practice Questions — Page 12

Question 115

HOTSPOT - You have an Azure subscription. The subscription contains an Azure application gateway that use Azure Web Application Firewall (WAF). You deploy new Azure App Services web apps. Each app is registered automatically in the DNS domain of your company and accessible from the Internet. You need to recommend a security solution that meets the following requirements: • Detects vulnerability scans of the apps • Detects whether newly deployed apps are vulnerable to attack What should you recommend using? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Question 117

DRAG DROP - You have an Azure subscription that contains a resources group named RG1. RG1 contains multiple Azure Files shares. You need to recommend a solution to deploy a backup solution for the shares. The solution must meet the following requirements: • Prevent the deletion of backups and the vault used to store the backups. • Prevent privilege escalation attacks against the backup solution. • Prevent the modification of the backup retention period. Which three actions should you recommend be performed in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

Question 118

You have an Azure subscription. You plan to deploy multiple containerized microservice-based apps to Azure Kubernetes Service (AKS). You need to recommend a solution that meets the following requirements: • Manages secrets • Provides encryption • Secures service-to-service communication by using mTLS encryption • Minimizes administrative effort What should you include in the recommendation?

Question 119

HOTSPOT - You have two on-premises servers named Server1 and Server2 that run Windows Server. Server1 contains an app named App1 and is isolated from the internet. You have a Microsoft Entra tenant. You plan to deploy Global Secure Access to provide remote access to App1. You need to configure the tenant and Server2 to support the planned deployment. The solution must ensure that when users attempt to access App1, they must authenticate by using their Microsoft Entra credentials. What should you create in the tenant, and what should you install on Server2? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Question 120

HOTSPOT - Your on-premises network contains an Active Directory Domain Services (AD DS) domain. The domain contains a group named Group1 and five servers that run Windows Server. Each server contains a standalone app. Each app is used by the members of Group1. You have a Microsoft Entra tenant that syncs with the domain. You plan to manage access to the apps by deploying Global Secure Access. You will use a Conditional Access policy to enforce security controls for all connections to the apps. You need to recommend a Global Secure Access app and Microsoft Entra private network connector configuration for the planned deployment. The solution must minimize administrative effort and be highly available. What is the minimum number of Global Secure Access apps and private network connectors you should recommend? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Question 121

You have a Microsoft 365 tenant that contains 5,000 users and 5,000 Windows 11 devices. All users are assigned Microsoft 365 E5 licenses and the Microsoft Defender Vulnerability Management add-on. The Windows 11 devices are managed by using Microsoft Intune and Microsoft Defender for Endpoint. The Windows 11 devices are configured during deployment to comply with Center for Internet Security (CIS) benchmarks for Windows 11. You need to recommend a compliance solution for the Windows 11 devices. The solution must identify devices that were modified and no longer comply with the CIS benchmarks. What should you include in the recommendation?

Question 122

Your company has a main office and a branch office. The main office contains 20 on-premises servers that run Windows Server and host apps that are published by using Microsoft Entra application proxy. The main office contains 500 on-premises computers that run Windows 11. The branch office contains 100 on-premises computers that run Windows 11. All the main office computers are enrolled in Microsoft Intune. The branch office computers are NOT enrolled in Intune. You have a Microsoft 365 ES subscription. You have a Microsoft Entra tenant. You have a third-party software as a service (SaaS) app that is registered in the Microsoft Entra tenant. You plan to implement Global Secure Access. You are evaluating the use of compliant network check and Conditional Access. Which two scenarios are supported by compliant network check? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point

Question 123

HOTSPOT - You have an Azure subscription that contains a virtual network named VNet1. VNet1 contains a 10-node virtual machine scale set that hosts a web search app named App1. Customers access App1 from the internet. The nodes establish outbound HTTP and HTTPS connections to the internet. You need to recommend a network security solution for App1. The solution must meet the following requirements: • Inbound connections to App1 that contain security threats specified in the Core Rule Set (CRS) from the Open Web Application Security Project (OWASP) must be blocked. • Outbound HTTP and HTTPS connections from the virtual machine scale set that contain security threats identified by the Microsoft Defender Threat Intelligence (Defender TI) feed must be blocked. What should you include in the recommendation? To answer, select the options in the answer area. NOTE: Each correct answer is worth one point.

Question 124

HOTSPOT - You have three Microsoft Entra tenants named Tenant1, Tenant2, and Tenant3. You have three Azure subscriptions named Sub1, Sub2, and Sub3. Each tenant is associated with multiple Azure subscriptions. Each subscription contains a single Microsoft Sentinel workspace as shown in the following table. You need to recommend a solution that meets the following requirements: • Ensures that the users in Tenant1 can manage the resources in Sub2 and Sub3 without having to switch subscriptions or sign in to a different tenant. • Implements multiple workspace view for Sentinel2 and Sentinel3. What should you use to delegate permissions, and which Microsoft Sentinel feature will users be able to manage in multiple workspace view? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Question 125

HOTSPOT - Your network contains an Active Directory Domain Services (AD DS) domain named Domain1. You have a Microsoft Entra tenant. Domain1 syncs with the tenant by using Microsoft Entra Connect. You need to evaluate Microsoft Entra smart lockout by testing the following account lockout considerations: • The number of failed sign-in attempts that trigger a lockout • The duration of the lockout What should you use to test each consideration? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.