QUESTION: 25 Exam Topic: Design a Zero Trust strategy and architecture questions

Your company plans to apply the Zero Trust Rapid Modernization Plan (RaMP) to its IT environment.

You need to recommend the top three modernization areas to prioritize as part of the plan.

Which three areas should you recommend based on RaMP? Each correct answer presents part of the solution.

Note: Each correct selection is worth one point.

data, compliance, and governance
infrastructure and development
user access and productivity
operational technology (OT) and IoT
modern security operations

Answer(s): A,C,E

Explanation:

RaMP initiatives for Zero Trust
To rapidly adopt Zero Trust in your organization, RaMP offers technical deployment guidance organized in these initiatives.

Critical security modernization initiatives:
(C) User access and productivity
1. Explicitly validate trust for all access requests
Identities
Endpoints (devices)
Apps
Network

(A) Data, compliance, and governance
2. Ransomware recovery readiness
3. Data

(E) Modernize security operations
4. Streamline response
5. Unify visibility
6. reduce manual effort

Incorrect:
As needed
Additional initiatives based on Operational Technology (OT) or IoT usage, on-premises and cloud adoption, and security for in-house app development:

* (not D) OT and Industrial IoT
Discover
Protect
Monitor
* Datacenter & DevOps Security
Security Hygiene
Reduce Legacy Risk
DevOps Integration
Microsegmentation

Reference:

https://learn.microsoft.com/en-us/security/zero-trust/zero-trust-ramp-overview

Reveal Solution Next Question

QUESTION: 26 Exam Topic: Design a Zero Trust strategy and architecture questions

HOTSPOT (Drag and Drop is not supported)
For a Microsoft cloud environment, you are designing a security architecture based on the Microsoft Cybersecurity Reference Architectures (MCRA).

You need to protect against the following external threats of an attack chain:

-An attacker attempts to exfiltrate data to external websites.
-An attacker attempts lateral movement across domain-joined computers.

What should you include in the recommendation for each threat? To answer, select the appropriate options in the answer area.

Note: Each correct selection is worth one point.

See Explanation section for answer.

Answer(s): A

Explanation:

Box 1: Microsoft Defender for Identity
An attacker attempts to exfiltrate data to external websites.

Exfiltration alerts
Typically, cyberattacks are launched against any accessible entity, such as a low-privileged user, and then quickly move laterally until the attacker gains access to valuable assets. Valuable assets can be sensitive accounts, domain administrators, or highly sensitive data. Microsoft Defender for Identity identifies these advanced threats at the source throughout the entire attack kill chain and classifies them into the following phases:

Reconnaissance
Compromised credentials
Lateral Movements
Domain dominance
Exfiltration

Box 2: Microsoft Defender for Identity
An attacker attempts lateral movement across domain-joined computers.

Microsoft Defender for Identity Lateral Movement Paths (LMPs)
Lateral movement is when an attacker uses non-sensitive accounts to gain access to sensitive accounts throughout your network. Lateral movement is used by attackers to identify and gain access to the sensitive accounts and machines in your network that share stored sign-in credentials in accounts, groups and machines. Once an attacker makes successful lateral moves towards your key targets, the attacker can also take advantage and gain access to your domain controllers. Lateral movement attacks are carried out using many of the methods described in Microsoft Defender for Identity Security Alerts.

A key component of Microsoft Defender for Identity's security insights are Lateral Movement Paths or LMPs. Defender for Identity LMPs are visual guides that help you quickly understand and identify exactly how attackers can move laterally inside your network.

Reference:

https://learn.microsoft.com/en-us/defender-for-identity/exfiltration-alerts

Reveal Solution Next Question

QUESTION: 27 Exam Topic: Design a Zero Trust strategy and architecture questions

For an Azure deployment, you are designing a security architecture based on the Microsoft Cloud Security Benchmark.

You need to recommend a best practice for implementing service accounts for Azure API management.

What should you include in the recommendation?

application registrations in Azure AD
managed identities in Azure
Azure service principals with usernames and passwords
device registrations in Azure AD
Azure service principals with certificate credentials

Answer(s): B

Explanation:

IM-3: Manage application identities securely and automatically
Features
Managed Identities
Description: Data plane actions support authentication using managed identities.

Configuration Guidance: Use a Managed Service Identity generated by Azure Active Directory (Azure AD) to allow your API Management instance to easily and securely access other Azure AD-protected resources, such as Azure Key Vault instead of using service principals. Managed identity credentials are fully managed, rotated, and protected by the platform, avoiding hard-coded credentials in source code or configuration files.

Reference:

https://learn.microsoft.com/en-us/security/benchmark/azure/baselines/api-management-security-baseline

Reveal Solution Next Question

QUESTION: 28 Exam Topic: Design a Zero Trust strategy and architecture questions

You have an Azure AD tenant that syncs with an Active Directory Domain Services (AD DS) domain. Client computers run Windows and are hybrid-joined to Azure AD.

You are designing a strategy to protect endpoints against ransomware. The strategy follows Microsoft Security Best Practices.

You plan to remove all the domain accounts from the Administrators groups on the Windows computers.

You need to recommend a solution that will provide users with administrative access to the Windows computers only when access is required. The solution must minimize the lateral movement of ransomware attacks if an administrator account on a computer is compromised.

What should you include in the recommendation?

Local Administrator Password Solution (LAPS)
Azure AD Identity Protection
Azure AD Privileged Identity Management (PIM)
Privileged Access Workstations (PAWs)

Answer(s): A

Explanation:

Microsoft's "Local Administrator Password Solution" (LAPS) provides management of local administrator account passwords for domain-joined computers. Passwords are randomized and stored in Active Directory (AD), protected by ACLs, so only eligible users can read it or request its reset.

Microsoft LAPS is short for Microsoft Local Administrator Password Solution.
When installed and enabled on domain-joined computers it takes over the management of passwords of local accounts. Passwords are automatically changed to random characters that meet the domain’s password policy requirements at a frequency that you define through Group Policy.

The passwords are stored in a protected “confidential” attribute on the Computer object in AD. Unlike most other attributes which can be read by all domain users by default, the confidential attributes require extra privileges to be granted in order to read them, thus securing the managed passwords.

Incorrect:
Not B: Integrate on-premises Active Directory domains with Azure Active Directory
Validate security configuration and policy, Actively monitor Azure AD for signs of suspicious activity

Consider using Azure AD Premium P2 edition, which includes Azure AD Identity Protection. Identity Protection uses adaptive machine learning algorithms and heuristics to detect anomalies and risk events that may indicate that an identity has been compromised. For example, it can detect potentially unusual activity such as irregular sign-in activities, sign-ins from unknown sources or from IP addresses with suspicious activity, or sign-ins from devices that may be infected. Identity Protection uses this data to generate reports and alerts that enable you to investigate these risk events and take appropriate action.

Not C: Azure AD PIM is a service in Azure AD that enables you to manage, control, and monitor access to resources in Azure AD, Azure, and other Microsoft Online Services such as Microsoft 365 or Microsoft Intune.

Not D: Privileged Access Workstations (PAWs) provide a dedicated operating system for sensitive tasks that is protected from Internet attacks and threat vectors. Separating these sensitive tasks and accounts from the daily use workstations and devices provides very strong protection from phishing attacks, application and OS vulnerabilities, various impersonation attacks, and credential theft attacks such as keystroke logging, Pass-the-Hash, and Pass-The-Ticket.

Reference:

https://craighays.com/microsoft-laps/
https://learn.microsoft.com/en-us/azure/architecture/reference-architectures/identity/azure-ad

Reveal Solution Next Question

Free SC-100 Exam Braindumps (page: 7)

QUESTION: 25 Exam Topic: Design a Zero Trust strategy and architecture questions

Explanation:

Reference:

QUESTION: 26 Exam Topic: Design a Zero Trust strategy and architecture questions

Explanation:

Reference:

QUESTION: 27 Exam Topic: Design a Zero Trust strategy and architecture questions

Explanation:

Reference:

QUESTION: 28 Exam Topic: Design a Zero Trust strategy and architecture questions

Explanation:

Reference: