SC-100 Free Practice Questions — Page 13

Question 126

You have an on-premises server that runs Windows Server and contains a Microsoft SQL Server database named DB1. You plan to migrate DB1 to Azure. You need to recommend an encrypted Azure database solution that meets the following requirements: • Minimizes the risks of malware that uses elevated privileges to access sensitive data • Prevents database administrators from accessing sensitive data • Enables pattern matching for server-side database operations • Supports Microsoft Azure Attestation • Uses hardware-based encryption What should you include in the recommendation?

Question 127

You have a Microsoft 365 tenant that contains two groups named Group1 and Group2. You use Microsoft Defender XDR to manage the tenants of your company’s customers. You need to ensure that the users in Group1 can perform security tasks in the tenant of each customer. The solution must meet the following requirements: • The Group1 users must only be assigned the Security Operator role for the customer tenants. • The users in Group2 must be able to assign the Security Operators role to the Group1 users for the customer tenants. • The use of quest accounts must be minimized. • Administrative effort must be minimized. What should you include in the solution?

Question 128

HOTSPOT - You have a Microsoft Entra tenant that is linked to a Microsoft 365 subscription and an Azure subscription. The tenant contains service principals that are used to access applications in the Azure subscription. You need to recommend a solution to detect risky sign-ins and other risky activities performed by the service principals in the tenant. The solution must minimize costs. What should you include in the recommendation? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Question 129

You have an on-premises network that has several legacy applications. The applications perform LDAP queries against an existing directory service. You are migrating the on-premises infrastructure to a cloud-only infrastructure. You need to recommend an identity solution for the infrastructure that supports the legacy applications. The solution must minimize the administrative effort to maintain the infrastructure. Which identity service should you include in the recommendation?

Question 130

You have an Azure subscription that contains 100 virtual machines, a virtual network named VNet1, and 20 users. The virtual machines run Windows Server and are connected to VNet1. The users work remotely and access Azure resources from Linux workstations. You need to ensure that the users can connect to the virtual machines from the workstations by using Secure Shell (SSH). The solution must meet the following requirements: • Ensure that the users authenticate by using their Microsoft Entra credentials. • Prevent the users from transferring files from the virtual machines by using SSH. • Prevent the users from directly accessing the virtual machines by using the public IP address of the virtual machines. What should you include in the solution?

Question 131

You have an on-premises app named App1. Remote users access App1 by using VPN connections. You have a third-party software as a service (SaaS) app named App2. You need to deploy Global Secure Access to manage access to App1 and App2. What should you use for each app?

Question 132

You have a Microsoft 365 tenant that uses Microsoft SharePoint Online and Microsoft Purview. Microsoft Purview has a sensitivity label named Label1 that is applied to the files stored on SharePoint Online sites. You need to recommend a Microsoft Purview Data Loss Prevention (DLP) policy that meets the following requirements: • Prevents users from uploading the files to third-party external websites • Allows users to upload the files to Microsoft OneDrive for Business To which location should you apply the DLP policy?

Question 133

You have a Microsoft Entra tenant named contoso.com and use Microsoft Intune. Each user in contoso.com has a Microsoft Entra ID P1 license and a Windows 11 device that has the Global Secure Access client deployed. You plan to deploy the following configuration of Microsoft Entra Internet Access: • Enable a baseline profile. • Create a security profile named Profile1 that has a priority of 300 and contains a single web content filtering policy named WCFPolicy1. Configure WCFPolicy1 as follows: o Set Action to allow. o Include a single rule that has a fully qualified domain name (FQDN) destination of *.adatum.com. • Link Profile1 to a Conditional Access policy named CAPolicy1, apply CAPolicy1 to all users, and grant access unless a user's device is noncompliant. You need to evaluate the impact of the planned deployment on traffic to the following resources: • https://www.adatum.com:8433 • https://www.fabrikam.com Which two traffic scenarios will occur? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.

Question 134

You have a Microsoft 365 subscription that contains 1,000 Microsoft Exchange Online mailboxes. Incoming email from the internet is scanned for security threats by using a third-party cloud service. You are evaluating whether to replace the third-party service with Microsoft Defender for Office 365. What should you modify to ensure that all the incoming email is scanned by Defender for Office 365 only?

Question 135

You have an Azure subscription that contains multiple network security groups (NSGs), multiple virtual machines, and an Azure Bastion host named bastion1. Several NSGs contain rules that allow direct RDP access to the virtual machines by bypassing bastion1. You need to ensure that the virtual machines can be accessed only by using bastion1. The solution must prevent the use of NSG rules to bypass bastion1. What should you include in the solution?