SC-100 Parte 2

You are evaluating an Azure environment for compliance.

You need to design an Azure Policy implementation that can be used to evaluate compliance without changing any resources.

Which effect should you use in Azure Policy?

• Deny

• Modify

• Append

• Disabled

You have an Azure subscription that has Microsoft Defender for Cloud enabled.

You are evaluating the Azure Security Benchmark V3 report as shown in the following exhibit.

You need to verify whether Microsoft Defender for servers is installed on all the virtual machines that run Windows.

Which compliance control should you evaluate?

• Asset Management

• Posture and Vulnerability Management

• Data Protection

• Endpoint Security

• Incident Response

HOTSPOT -

You have a Microsoft 365 E5 subscription and an Azure subscription.

You need to evaluate the existing environment to increase the overall security posture for the following components:

✑ Windows 11 devices managed by Microsoft Intune

✑ Azure Storage accounts

✑ Azure virtual machines

What should you use to evaluate the components? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Hot Area:

• Azure Storage accounts:

  Microsoft 365 compliance center

• Windows 11 devices:

  
  Microsoft 365 Defender

• Azure virual machines:

  Microsoft Defender for Cloud

• Windows 11 devices:

  Microsoft Sentinel

• Azure virual machines:

  Microsoft compliance center

Your company has an Azure subscription that has enhanced security enabled for Microsoft Defender for Cloud.

The company signs a contract with the United States government.

You need to review the current subscription for NIST 800-53 compliance.

What should you do first?

• From Azure Policy, assign a built-in initiative that has a scope of the subscription

• From Microsoft Sentinel, configure the Microsoft Defender for Cloud data connector

• From Defender for Cloud, review the Azure security baseline for audit report

• From Microsoft Defender for Cloud Apps, create an access policy for cloud applications

You have an Azure subscription that has Microsoft Defender for Cloud enabled.

You have an Amazon Web Services (AWS) implementation.

You plan to extend the Azure security strategy to the AWS implementation. The solution will NOT use Azure Arc.

Which three services can you use to provide security for the AWS resources? Each correct answer presents a complete solution.

NOTE: Each correct selection is worth one point.

• Microsoft Defender for Containers

• Microsoft Defender for servers

• Azure Active Directory (Azure AD) Conditional Access

• Azure Active Directory (Azure AD) Privileged Identity Management (PIM)

• Azure Policy

Your company has on-premises network in Seattle and an Azure subscription. The on-premises network contains a Remote Desktop server.

The company contracts a third-party development firm from France to develop and deploy resources to the virtual machines hosted in the Azure

subscription.

Currently, the firm establishes an RDP connection to the Remote Desktop server. From the Remote Desktop connection, the firm can access the

virtual machines hosted in Azure by using custom administrative tools installed on the Remote Desktop server. All the traffic to the Remote

Desktop server is captured by a firewall, and the firewall only allows specific connections from France to the server.

You need to recommend a modern security solution based on the Zero Trust model. The solution must minimize latency for developers.

Which three actions should you recommend? Each correct answer presents part of the solution.

NOTE: Each correct selection is worth one point.

• Configure network security groups (NSGs) to allow access from only specific logical groupings of IP address ranges

• Deploy a Remote Desktop server to an Azure region located in France

• Migrate from the Remote Desktop server to Azure Virtual Desktop

• Implement Azure Firewall to restrict host pool outbound access

• Configure Azure Active Directory (Azure AD) Conditional Access with multi-factor authentication (MFA) and named locations

HOTSPOT -

Your company has a multi-cloud environment that contains a Microsoft 365 subscription, an Azure subscription, and Amazon Web Services (AWS)

implementation.

You need to recommend a security posture management solution for the following components:

✑ Azure IoT Edge devices

AWS EC2 instances -

Which services should you include in the recommendation? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Hot Area:

• For the IoT Edge devices:

  Microsoft Defender for IoT

• For the AWS EC2 instances:

  Microsoft Defender for Cloud and Azure Arc

• For the IoT Edge devices:

  Microsoft Defender for Endpoint

• For the AWS EC2 instances:

  Microsoft Defender for Cloud only

• For the IoT Edge devices:

  Microsoft Defender for Cloud

Your company has a hybrid cloud infrastructure.

The company plans to hire several temporary employees within a brief period. The temporary employees will need to access applications and data

on the company's on-premises network.

The company's secutity policy prevents the use of personal devices for accessing company data and applications.

You need to recommend a solution to provide the temporary employee with access to company resources. The solution must be able to scale on

demand.

What should you include in the recommendation?

• Deploy Azure Virtual Desktop, Azure Active Directory (Azure AD) Conditional Access, and Microsoft Defender for Cloud Apps

• Redesign the VPN infrastructure by adopting a split tunnel configuration

• Deploy Microsoft Endpoint Manager and Azure Active Directory (Azure AD) Conditional Access

• Migrate the on-premises applications to cloud-based applications

Your company is preparing for cloud adoption.

You are designing security for Azure landing zones.

Which two preventative controls can you implement to increase the secure score? Each correct answer presents a complete solution.

NOTE: Each correct selection is worth one point.

• Azure Web Application Firewall (WAF

• Azure Active Directory (Azure AD) Privileged Identity Management (PIM)

• Microsoft Sentinel

• Azure Firewall

• Microsoft Defender for Cloud alerts

You are designing security for an Azure landing zone.

Your company identifies the following compliance and privacy requirements:

✑ Encrypt cardholder data by using encryption keys managed by the company.

✑ Encrypt insurance claim files by using encryption keys hosted on-premises.

Which two configurations meet the compliance and privacy requirements? Each correct answer presents part of the solution.

NOTE: Each correct selection is worth one point.

• Store the cardholder data in an Azure SQL database that is encrypted by using Microsoft-managed keys

• Store the insurance claim data in Azure Blob storage encrypted by using customer-provided keys

• Store the cardholder data in an Azure SQL database that is encrypted by using keys stored in Azure Key Vault Managed HSM

• Store the insurance claim data in Azure Files encrypted by using Azure Key Vault Managed HSM