Your company is preparing for cloud adoption.You are designing security for Azure landing zones.Which two solutions should you include in the design to ensure that preventative controls are implemented to increase the secure score? Each correct answer presents a complete solution.Note: Each correct selection is worth one point.
Answer(s): A,D
You are designing security for an Azure landing zone.Your company identifies the following compliance and privacy requirements:Encrypt cardholder data by using encryption keys managed by the company.Encrypt insurance claim files by using encryption keys hosted on-premises.Which two configurations meet the compliance and privacy requirements? Each correct answer presents part of the solution.Note: Each correct selection is worth one point.
Answer(s): B,C
You have an Azure subscription that has Microsoft Defender for Cloud enabled.You need to enforce ISO 27001:2013 standards for the subscription. The solution must ensure that noncompliant resources are remediated automatically.What should you use?
Answer(s): A
Control mapping of the ISO 27001 Shared Services blueprint sample The following mappings are to the ISO 27001:2013 controls. Use the navigation on the right to jump directly to a specific control mapping. Many of the mapped controls are implemented with an Azure Policy initiative.Open Policy in the Azure portal and select the Definitions page. Then, find and select the [Preview] Audit ISO 27001:2013 controls and deploy specific VM Extensions to support audit requirements built-in policy initiative.Note: Security Center can now auto provision the Azure Policy's Guest Configuration extension (in preview) Azure Policy can audit settings inside a machine, both for machines running in Azure and Arc connected machines. The validation is performed by the Guest Configuration extension and client.With this update, you can now set Security Center to automatically provision this extension to all supported machines.Enforcing a secure configuration, based on a specific recommendation, is offered in two modes:Using the Deny effect of Azure Policy, you can stop unhealthy resources from being created Using the Enforce option, you can take advantage of Azure Policy's DeployIfNotExist effect and automatically remediate non-compliant resources upon creation
https://docs.microsoft.com/en-us/azure/governance/blueprints/samples/iso27001-shared/control- mapping https://docs.microsoft.com/en-us/azure/defender-for-cloud/release-notes-archive https://docs.microsoft.com/en-us/azure/defender-for-cloud/prevent-misconfigurations
DRAG DROP (Drag and Drop is not supported)You have a Microsoft 365 subscription.You need to recommend a security solution to monitor the following activities:User accounts that were potentially compromisedUsers performing bulk file downloads from Microsoft SharePoint OnlineWhat should you include in the recommendation for each activity? To answer, drag the appropriate components to the correct activities. Each component may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.Note: Each correct selection is worth one point.Select and Place:
Box 1: Microsoft Entra ID ProtectionRisk detections in Microsoft Entra ID Protection include any identified suspicious actions related to user accounts in the directory. Risk detections (both user and sign-in linked) contribute to the overall user risk score that is found in the Risky Users report.Identity Protection provides organizations access to powerful resources to see and respond quickly to these suspicious actions.Note:Premium sign-in risk detections include:* Token Issuer Anomaly - This risk detection indicates the SAML token issuer for the associated SAML token is potentially compromised. The claims included in the token are unusual or match known attacker patterns.* Suspicious inbox manipulation rules - This detection is discovered by Microsoft Defender for Cloud Apps. This detection profiles your environment and triggers alerts when suspicious rules that delete or move messages or folders are set on a user's inbox. This detection may indicate that the user's account is compromised, that messages are being intentionally hidden, and that the mailbox is being used to distribute spam or malware in your organization.* Etc.Incorrect:Not: Microsoft 365 Defender for CloudPart of your incident investigation can include user accounts. You can see the details of user accounts identified in the alerts of an incident in the Microsoft 365 Defender portal from Incidents & alerts > incident > Users.Box 2: Microsoft 365 Defender for AppDefender for Cloud apps detect mass download (data exfiltration) policy Detect when a certain user accesses or downloads a massive number of files in a short period of time.
https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/concept-identity- protection-risks https://docs.microsoft.com/en-us/defender-cloud-apps/policies-threat-protection#detect-mass-download-data- exfiltration https://docs.microsoft.com/en-us/microsoft-365/security/defender/investigate-users
Your company finalizes the adoption of Azure and is implementing Microsoft Defender for Cloud.You receive the following recommendations in Defender for CloudAccess to storage accounts with firewall and virtual network configurations should be restricted.Storage accounts should restrict network access using virtual network rules.Storage account should use a private link connection.Storage account public access should be disallowed.You need to recommend a service to mitigate identified risks that relate to the recommendations.What should you recommend?
An Azure Policy definition, created in Azure Policy, is a rule about specific security conditions that you want controlled. Built in definitions include things like controlling what type of resources can be deployed or enforcing the use of tags on all resources. You can also create your own custom policy definitions.Note: Azure security baseline for Azure StorageThis security baseline applies guidance from the Azure Security Benchmark version 1.0 to Azure Storage. The Azure Security Benchmark provides recommendations on how you can secure your cloud solutions on Azure.The content is grouped by the security controls defined by the Azure Security Benchmark and the related guidance applicable to Azure Storage.You can monitor this security baseline and its recommendations using Microsoft Defender for Cloud. Azure Policy definitions will be listed in the Regulatory Compliance section of the Microsoft Defender for Cloud dashboard.For example:* 1.1: Protect Azure resources within virtual networksGuidance: Configure your storage account's firewall by restricting access to clients from specific public IP address ranges, select virtual networks, or specific Azure resources. You can also configure Private Endpoints so traffic to the storage service from your enterprise travels exclusively over private networks.* 1.8: Minimize complexity and administrative overhead of network security rules Guidance: For resource in Virtual Networks that need access to your Storage account, use Virtual Network Service tags for the configured Virtual Network to define network access controls on network security groups or Azure Firewall. You can use service tags in place of specific IP addresses when creating security rules.
https://docs.microsoft.com/en-us/azure/defender-for-cloud/security-policy-concept https://docs.microsoft.com/en-us/security/benchmark/azure/baselines/storage-security-baseline
You receive a security alert in Microsoft Defender for Cloud as shown in the exhibit. (Click the Exhibit tab.)After remediating the threat, which policy definition should you assign to prevent the threat from reoccurring?
Answer(s): C
You have 50 Azure subscriptions.You need to monitor the resource in the subscriptions for compliance with the ISO 27001:2013 standards. The solution must minimize the effort required to modify the list of monitored policy definitions for the subscriptions.What are two ways to achieve the goal? Each correct answer presents a complete solution.Note: Each correct selection is worth one point.
Answer(s): A,F
An Azure Management group is logical containers that allow Azure Administrators to manage access, policy, and compliance across multiple Azure Subscriptions en masse.If your organization has many Azure subscriptions, you may need a way to efficiently manage access, policies, and compliance for those subscriptions. Management groups provide a governance scope above subscriptions. You organize subscriptions into management groups the governance conditions you apply cascade by inheritance to all associated subscriptions.F: Blueprint definition locationsWhen creating a blueprint definition, you'll define where the blueprint is saved. Blueprints can be saved to a management group or subscription that you have Contributor access to. If the location is a management group, the blueprint is available to assign to any child subscription of that management group.A: Create and assign an initiative definitionWith an initiative definition, you can group several policy definitions to achieve one overarching goal. An initiative evaluates resources within scope of the assignment for compliance to the included policies.Note: The Azure Policy Regulatory Compliance built-in initiative definition maps to compliance domains and controls in ISO 27001:2013.The Azure Policy control mapping provides details on policy definitions included within this blueprint and how these policy definitions map to the compliance domains and controls in ISO 27001. When assigned to an architecture, resources are evaluated by Azure Policy for non-compliance with assigned policy definitions.Incorrect:Not B, D, E: If you plan to apply this policy definition to multiple subscriptions, the location must be a management group that contains the subscriptions you assign the policy to. The same is true for an initiative definition.
https://docs.microsoft.com/en-us/azure/governance/management-groups/overview https://docs.microsoft.com/en-us/azure/governance/blueprints/overview https://docs.microsoft.com/en-us/azure/governance/policy/samples/iso-27001 https://docs.microsoft.com/en-us/azure/governance/policy/tutorials/create-and-manage
HOTSPOTYou open Microsoft Defender for Cloud as shown in the following exhibit.Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.Note: Each correct selection is worth one point.Hot Area:
Box 1: Azure Web Application Firewall (WAF)Restrict unauthorized network access control: 1 resource out of 11 needs to be addresses.Restrict unauthorized network access - Azure offers a suite of tools designed to ensure accesses across your network meet the highest security standards.Use these recommendations to manage Defender for Cloud's adaptive network hardening settings, ensure you've configured Azure Private Link for all relevant PaaS services, enable Azure Firewall on your virtual networks, and more.Note: Azure Web Application Firewall (WAF) is an optional addition to Azure Application Gateway.Azure WAF protects inbound traffic to the web workloads, and the Azure Firewall inspects inbound traffic for the other applications. The Azure Firewall will cover outbound flows from both workload types.Incorrect:Not network security groups (NSGs).Box 2: Microsoft Defender for serversEnable endpoint protection - Defender for Cloud checks your organization's endpoints for active threat detection and response solutions such as Microsoft Defender for Endpoint or any of the major solutions shown in this list.When an Endpoint Detection and Response (EDR) solution isn't found, you can use these recommendations to deploy Microsoft Defender for Endpoint (included as part of Microsoft Defender for servers).Incorrect:Not Microsoft Defender for Resource Manager:Microsoft Defender for Resource Manager does not handle endpoint protection.Microsoft Defender for Resource Manager automatically monitors the resource management operations in your organization, whether they're performed through the Azure portal, Azure REST APIs, Azure CLI, or other Azure programmatic clients. Defender for Cloud runs advanced security analytics to detect threats and alerts you about suspicious activity.
https://docs.microsoft.com/en-us/azure/defender-for-cloud/secure-score-security-controls
Post your Comments and Discuss Microsoft SC-100 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the SC-100 content, but please register or login to continue.