Online Access Free SC-100 Exam Questions

The SC-100 exam dump contains a good set of questions. I passed my certification with it last month. It proved to be a helpful resource for clearing the SC-100 exam. Thank you so much!

No.# Still Soft Delete is for workloads running in Azure only - not on-prem server backups with MARS agents
https://learn.microsoft.com/en-us/azure/backup/backup-azure-security-feature
For Deleted Backups:
A Security PIN for Critical Operations

Why?
For on-premises workloads backed up with the MARS agent, the Security PIN adds an additional layer of protection for critical operations, including deleting backup data.
Even if an administrator account is compromised, a Security PIN must be entered before backups can be deleted, reducing the risk of ransomware attacks deleting the backups.
For Disabled Backups:
Multi-user Authorization by Using Resource Guard

Why?
Resource Guard ensures that disabling backups or modifying critical backup settings requires multi-user authorization (MUA).
This prevents a single compromised administrator account from disabling backups on the MARS agent, ensuring backups remain operational.

No.# Microsoft Cloud Adoption Framework and Threat Modeling:

The Microsoft Cloud Adoption Framework for Azure emphasizes secure development practices, which include threat modeling as an integral part of DevSecOps.
Threat modeling identifies potential threats early in the development process, allowing teams to address them proactively.
Why STRIDE?

The STRIDE model is recommended by Microsoft for threat modeling because it provides a top-down approach to identifying threats. STRIDE stands for:
Spoofing
Tampering
Repudiation
Information Disclosure
Denial of Service
Elevation of Privilege
STRIDE is particularly effective in cloud environments for identifying and mitigating risks at various levels of the architecture.
Why Not the Others?

B. DREAD model:

The DREAD model is a risk-ranking framework used to prioritize threats based on Damage, Reproducibility, Exploitability, Affected users, and Discoverability.
While useful for ranking risks, it is not used for initiating threat modeling in a top-down approach.
C. OWASP threat modeling:

OWASP provides excellent resources and frameworks for secure development, but Microsoft's recommendation for threat modeling in Azure environments specifically emphasizes the STRIDE model as a starting point....

No.# B. the STRIDE model

No.# D. Azure Firewall with policy rule sets

No.# Establish Visibility
Enable Automation
Enable additional protection and detection controls
first chars. of last words "V-A-C"

No.# You recommend access restrictions that allow traffic from the Front Door service tags.

No.# Conditional Access Policy

No.# Azure Active Directory (Azure AD) Conditional Access
Azure Active Directory (Azure AD) Privileged Identity Management (PIM)
Microsoft Defender for Containers

No.# Rapid Modernization Plan (RaMP) checklist helps you establish a security perimeter for cloud applications and mobile devices that uses identity as the control plane and explicitly validates trust for user accounts and devices before allowing access, for both public and private networks -

No.# . Machine Isolation

This is a crucial step in containing the breach. Isolating the compromised machines from the network prevents the spread of ransomware and other malicious activities.

No.# D confirmed

Tried the below steps
Note: Turn on web content filtering
From the left-hand navigation in Microsoft 365 Defender portal, select Settings > Endpoints > General > Advanced Features. Scroll down until you see the entry for Web content filtering. Switch the toggle to On and Save preferences.

No.# To ensure that only authorized applications can run on the virtual machines and to block unauthorized applications automatically until an administrator authorizes them, you should recommend:

D. Application control policies in Microsoft Defender for Endpoint

Microsoft Defender for Endpoint provides application control policies that allow you to define which applications are allowed or blocked on your Windows machines. You can create rules specifying which applications are authorized to run, and any application that doesn't match these rules can be automatically blocked. This provides a strong layer of security and control over the applications running on your virtual machines.

No.# 1. Azure Policy initiatives to MG
2. Azure Arc

https://learn.microsoft.com/en-us/azure/governance/policy/concepts/initiative-definition-structure
Initiatives enable you to group several related policy definitions to simplify assignments and management because you work with a group as a single item. For example, you can group related tagging policy definitions into a single initiative. Rather than assigning each policy individually, you apply the initiative.

https://learn.microsoft.com/en-us/azure/azure-arc/overview
Azure Arc simplifies governance and management by delivering a consistent multicloud and on-premises management platform.

No.# Purview and Defender for Cloud; "The integration with Microsoft Purview expands visibility into the data layer, enabling security teams to prioritize resources that contain sensitive data.

Classifications and labels applied to data resources in Microsoft Purview are ingested into Microsoft Defender for Cloud, which provides valuable context for protecting resources. Microsoft Defender for Cloud uses the resource classifications and labels to identify potential attack paths and security risks related to sensitive data. The resources in the Defender for Cloud's Inventory and Alerts pages are also enriched with the classifications and labels discovered by Microsoft Purview, so your security teams can filter and focus to prioritize protecting your most sensitive assets."

Defender for Cloud collects, analyzes, and integrates log data from your Azure, hybrid, and multicloud resources, the network, and connected partner solutions, such as firewalls and endpoint agents. Defender for Cloud uses the log data to detect real threats and reduce false positives. A list of prioritized security alerts is shown in Defender for Cloud along with the information you need to quickly investigate the problem and the steps to take to remediate an attack....

No.# Role to assign the Fabrikam helpdesk users for contoso.com:
Password Administrator

This role allows users to reset passwords for non-administrative accounts in the directory, aligning with the principle of least privilege.
To restrict the scope of the role assignments for the Fabrikam helpdesk users, use:
An administrative unit

Administrative units allow you to scope role assignments to specific subsets of users or resources, ensuring access is limited to only the required accounts at Contoso.
Role to assign to the Fabrikam helpdesk users to reset the Contoso user passwords:
Password Administrator

The Password Administrator role is specifically designed for resetting passwords for non-administrative users.

No.# B. Azure AD Privileged Identity Management (PIM)

No.# I recommend configuring Azure AD Conditional Access and using smart account lockout in Azure AD B2C.

Azure AD Conditional Access allows you to set policies that determine when and how users can access your application. By integrating Azure AD Conditional Access with user flows and custom policies, you can define rules that ensure only authenticated users can access the application, and you can also set up multifactor authentication for additional security.

Smart account lockout in Azure AD B2C is a feature that helps protect against brute-force attacks by temporarily locking out accounts after a certain number of failed login attempts. This can help prevent unauthorized access to the application by preventing attackers from guessing login credentials.

No.# Selection 1: Microsoft 365 Defender (Microsoft Defender for Endpoint is part of it).
Selection 2: Microsoft Defender for Cloud.
Selection 3: Microsoft Defender for Cloud.

Microsoft 365 Defender includes both of those and quite a bit else.

https://learn.microsoft.com/en-us/microsoft-365/security/defender/microsoft-365-defender?view=o365-worldwide
"Here's a list of the different Microsoft 365 Defender products and solutions:
Microsoft Defender for Endpoint
Microsoft Defender for Office 365
Microsoft Defender for Identity
Microsoft Defender for Cloud Apps
Microsoft Defender Vulnerability Management
Azure Active Directory Identity Protection
Microsoft Data Loss Prevention
App Governance
Microsoft Defender for Cloud"

No.# Exfiltration of data - Defender for Cloud Apps
Data across domains - Defender for Identity
Reference: MCRA Slide 15