You need to recommend a solution to resolve the virtual machine issue.What should you include in the recommendation? Each correct answer presents a complete solution.
Answer(s): A,B
(A) Enable vulnerability scanning with the integrated Qualys scanner A core component of every cyber risk and security program is the identification and analysis of vulnerabilities.Defender for Cloud regularly checks your connected machines to ensure they're running vulnerability assessment tools.When a machine is found that doesn't have a vulnerability assessment solution deployed, Defender for Cloud generates the security recommendation: Machines should have a vulnerability assessment solution. Use this recommendation to deploy the vulnerability assessment solution to your Azure virtual machines and your Azure Arc-enabled hybrid machines.Deploying Microsoft Defender for Endpoint is a two-step process.(B) Onboard devices to the serviceConfigure capabilities of the serviceScenario: 20 virtual machines (B, not D) that are configured as application servers and are NOT onboarded to Microsoft Defender for Cloud.Existing Environment. Problem StatementsThe secure score in Defender for Cloud shows that all the virtual machines generate the following recommendation: Machines should have a vulnerability assessment solution.All the virtual machines must be compliant in Defender for Cloud.
https://docs.microsoft.com/en-us/azure/defender-for-cloud/deploy-vulnerability-assessment-vm
You need to recommend a solution to meet the security requirements for the virtual machines.What should you include in the recommendation?
Answer(s): C
HOTSPOTYou need to recommend a solution to meet the compliance requirements.What should you recommend? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one point.Hot Area:
Answer(s): A
Box 1: A blueprintScenario: Requirements. Compliance RequirementsFabrikam wants to automatically remediate the virtual machines in Sub1 to be compliant with the HIPAA HITRUST standard.Microsoft releases automation for HIPAA/HITRUST complianceI am excited to share our new Azure Security and Compliance Blueprint for HIPAA/HITRUST Health Data & AI. Microsoft's Azure Blueprints are resources to help build and launch cloud-powered applications that comply with stringent regulations and standards. Included in the blueprints are reference architectures, compliance guidance and deployment scripts.An Azure Blueprint is a package for creating specific sets of standards and requirements that govern the implementation of Azure services, security, and design. Such packages are reusable so that consistency and compliance among resources can be maintained.Incorrect:* not Workflow automationWorkflow automation is an approach to making the flow of tasks, documents and information across work- related activities perform independently in accordance with defined business rules.Box 2: Modify an Azure policy definitionScenario: The virtual machines in TestRG must be excluded from the compliance assessment.Use a Policy definition to include the TestRG virtual machines from the Blueprint.Note: Azure Policy establishes conventions for resources. Policy definitions describe resource compliance conditions and the effect to take if a condition is met. A condition compares a resource property field or a value to a required value. Resource property fields are accessed by using aliases. When a resource property field is an array, a special array alias can be used to select values from all array members and apply a condition to each one.By defining conventions, you can control costs and more easily manage your resources. For example, you can specify that only certain types of virtual machines are allowed. Or, you can require that resources have a particular tag. Policy assignments are inherited by child resources. If a policy assignment is applied to a resource group, it's applicable to all the resources in that resource group.Incorrect:* Not Update a policy assignmentA policy assignment assigns a Blueprint to a subscription. The scope is at the subscription level.Note: Policy Assignments provide a means for applying policy to a subscription to which a blueprint is assigned. That said, the policy must be within the scope of the blueprint containing the policy. Parameters defined with a policy are assigned during blueprint creation or during blueprint assignment.
https://azure.microsoft.com/en-us/blog/microsoft-releases-automation-for-hipaa-hitrust-compliance/ https://cloudacademy.com/blog/what-are-azure-blueprints/https://k21academy.com/microsoft-azure/azure-rbac-vs-azure-policies-vs-azure-blueprints/
HOTSPOTYou need to recommend a solution to evaluate regulatory compliance across the entire managed environment. The solution must meet the regulatory compliance requirements and the business requirements.What should you recommend? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one point.Hot Area:
Box 1: Azure Policy initiatives to management groupsIf your organization has many Azure subscriptions, you may need a way to efficiently manage access, policies, and compliance for those subscriptions. Management groups provide a governance scope above subscriptions. You organize subscriptions into management groups the governance conditions you apply cascade by inheritance to all associated subscriptions.If you plan to apply a policy definition to multiple subscriptions, the location must be a management group that contains the subscriptions you assign the policy to. The same is true for an initiative definition.With an initiative definition, you can group several policy definitions to achieve one overarching goal. An initiative evaluates resources within scope of the assignment for compliance to the included policies.Incorrect:Not: Azure Policy initiatives to subscriptionsMust use a management group as we have multiple subscriptions.Scenario:Requirements. Business RequirementsLitware identifies the following business requirements:· Minimize any additional on-premises infrastructure.· Minimize the operational costs associated with administrative overhead.Box 2: Azure ArcWith Azure Arc:Meet governance and compliance standards for apps, infrastructure, and data with Azure Policy.Take advantage of elastic scale, consistent on-premises and multicloud management, and cloud-style billing models.Note: Azure Arc is a bridge that extends the Azure platform to help you build applications and services with the flexibility to run across datacenters, at the edge, and in multicloud environments. Develop cloud-native applications with a consistent development, operations, and security model. Azure Arc runs on both new and existing hardware, virtualization and Kubernetes platforms, IoT devices, and integrated systems.
https://docs.microsoft.com/en-us/azure/governance/management-groups/overview https://azure.microsoft.com/en-us/services/azure-arc/#product-overviewDesign security operations, identity, and compliance capabilitiesQuestion Set 3
You have an Azure subscription that has Microsoft Defender for Cloud enabled.You have an Amazon Web Services (AWS) implementation.You plan to extend the Azure security strategy to the AWS implementation. The solution will NOT use Azure Arc.Which three services can you use to provide security for the AWS resources? Each correct answer presents a complete solution.Note: Each correct selection is worth one point.
Answer(s): A,C,D
Your company has on-premises network in Seattle and an Azure subscription. The on-premises network contains a Remote Desktop server.The company contracts a third-party development firm from France to develop and deploy resources to the virtual machines hosted in the Azure subscription.Currently, the firm establishes an RDP connection to the Remote Desktop server. From the Remote Desktop connection, the firm can access the virtual machines hosted in Azure by using custom administrative tools installed on the Remote Desktop server. All the traffic to the Remote Desktop server is captured by a firewall, and the firewall only allows specific connections from France to the server.You need to recommend a modern security solution based on the Zero Trust model. The solution must minimize latency for developers.Which three actions should you recommend? Each correct answer presents part of the solution.Note: Each correct selection is worth one point.
Answer(s): C,D,E
E: Organizations can use this location for common tasks like:Requiring multi-factor authentication for users accessing a service when they're off the corporate network.Blocking access for users accessing a service from specific countries or regions.The location is determined by the public IP address a client provides to Microsoft Entra ID or GPS coordinates provided by the Microsoft Authenticator app. Conditional Access policies by default apply to all IPv4 and IPv6 addresses.CD: Use Azure Firewall to protect Azure Virtual Desktop deployments.Azure Virtual Desktop is a desktop and app virtualization service that runs on Azure. When an end user connects to an Azure Virtual Desktop environment, their session is run by a host pool. A host pool is a collection of Azure virtual machines that register to Azure Virtual Desktop as session hosts. These virtual machines run in your virtual network and are subject to the virtual network security controls. They need outbound Internet access to the Azure Virtual Desktop service to operate properly and might also need outbound Internet access for end users. Azure Firewall can help you lock down your environment and filter outbound traffic.
https://docs.microsoft.com/en-us/azure/firewall/protect-azure-virtual-desktop
HOTSPOTYour company has a multi-cloud environment that contains a Microsoft 365 subscription, an Azure subscription, and Amazon Web Services (AWS) implementation.You need to recommend a security posture management solution for the following components:Azure IoT Edge devicesAWS EC2 instancesWhich services should you include in the recommendation? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one point.Hot Area:
Box 1: Microsoft Defender for IoTMicrosoft Defender for IoT is a unified security solution for identifying IoT and OT devices, vulnerabilities, and threats and managing them through a central interface.Azure IoT Edge provides powerful capabilities to manage and perform business workflows at the edge. The key part that IoT Edge plays in IoT environments make it particularly attractive for malicious actors.Defender for IoT azureiotsecurity provides a comprehensive security solution for your IoT Edge devices. Defender for IoT module collects, aggregates and analyzes raw security data from your Operating System and container system into actionable security recommendations and alerts.Box 2: Microsoft Defender for Cloud and Azure ArcMicrosoft Defender for Cloud provides the following features in the CSPM (Cloud Security Posture Management) category in the multi-cloud scenario for AWS. Take into account that some of them require Defender plan to be enabled (such as Regulatory Compliance):* Detection of security misconfigurations* Single view showing Security Center recommendations and AWS Security Hub findings* Incorporation of AWS resources into Security Center's secure score calculations* Regulatory compliance assessments of AWS resourcesSecurity Center uses Azure Arc to deploy the Log Analytics agent to AWS instances.Incorrect:AWS EC2 Microsoft Defender for Cloud AppsAmazon Web Services is an IaaS provider that enables your organization to host and manage their entire workloads in the cloud. Along with the benefits of leveraging infrastructure in the cloud, your organization's most critical assets may be exposed to threats. Exposed assets include storage instances with potentially sensitive information, compute resources that operate some of your most critical applications, ports, and virtual private networks that enable access to your organization.Connecting AWS to Defender for Cloud Apps helps you secure your assets and detect potential threats by monitoring administrative and sign-in activities, notifying on possible brute force attacks, malicious use of a privileged user account, unusual deletions of VMs, and publicly exposed storage buckets.
https://docs.microsoft.com/en-us/azure/defender-for-iot/device-builders/security-edge-architecture https://samilamppu.com/2021/11/04/multi-cloud-security-posture-management-in-microsoft-defender-for-cloud/
Your company has a hybrid cloud infrastructure.The company plans to hire several temporary employees within a brief period. The temporary employees will need to access applications and data on the company's on-premises network.The company's security policy prevents the use of personal devices for accessing company data and applications.You need to recommend a solution to provide the temporary employee with access to company resources. The solution must be able to scale on demand.What should you include in the recommendation?
You can connect an Azure Virtual Desktop to an on-premises network using a virtual private network (VPN), or use Azure ExpressRoute to extend the on-premises network into the Azure cloud over a private connection.* Microsoft Entra ID: Azure Virtual Desktop uses Microsoft Entra ID for identity and access management.Microsoft Entra integration applies Microsoft Entra security features like conditional access, multi-factor authentication, and the Intelligent Security Graph, and helps maintain app compatibility in domain-joined VMs.* Azure Virtual Desktop, enable Microsoft Defender for Cloud.We recommend enabling Microsoft Defender for Cloud's enhanced security features to:Manage vulnerabilities.Assess compliance with common frameworks like PCI.* Microsoft Defender for Cloud Apps, formerly known as Microsoft Cloud App Security, is a comprehensive solution for security and compliance teams enabling users in the organization, local and remote, to safely adopt business applications without compromising productivity.
https://docs.microsoft.com/en-us/azure/architecture/example-scenario/wvd/windows-virtual-desktop https://docs.microsoft.com/en-us/azure/virtual-desktop/security-guide https://techcommunity.microsoft.com/t5/security-compliance-and-identity/announcing-microsoft-defender-for- cloud-apps/ba-p/2835842
Post your Comments and Discuss Microsoft SC-100 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the SC-100 content, but please register or login to continue.