Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.You have an Azure subscription that has Microsoft Defender for Cloud enabled.You are evaluating the Azure Security Benchmark V3 report.In the Secure management ports controls, you discover that you have 0 out of a potential 8 points.You need to recommend configurations to increase the score of the Secure management ports controls.Solution: You recommend enabling the VMAccess extension on all virtual machines.Does this meet the goal?
Answer(s): B
Instead: You recommend enabling just-in-time (JIT) VM access on all virtual machines.Note:Secure management ports - Brute force attacks often target management ports. Use these recommendations to reduce your exposure with tools like just-in-time VM access and network security groups.Recommendations:- Internet-facing virtual machines should be protected with network security groups- Management ports of virtual machines should be protected with just-in-time network access control- Management ports should be closed on your virtual machines
https://docs.microsoft.com/en-us/azure/defender-for-cloud/secure-score-security-controls
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.You have an Azure subscription that has Microsoft Defender for Cloud enabled.You are evaluating the Azure Security Benchmark V3 report.In the Secure management ports controls, you discover that you have 0 out of a potential 8 points.You need to recommend configurations to increase the score of the Secure management ports controls.Solution: You recommend enabling adaptive network hardening.Does this meet the goal?
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.You have an Azure subscription that has Microsoft Defender for Cloud enabled.You are evaluating the Azure Security Benchmark V3 report.In the Secure management ports controls, you discover that you have 0 out of a potential 8 points.You need to recommend configurations to increase the score of the Secure management ports controls.Solution: You recommend enabling just-in-time (JIT) VM access on all virtual machines.Does this meet the goal?
Answer(s): A
Secure management ports - Brute force attacks often target management ports. Use these recommendations to reduce your exposure with tools like just-in-time VM access and network security groups.Recommendations:- Internet-facing virtual machines should be protected with network security groups- Management ports of virtual machines should be protected with just-in-time network access control- Management ports should be closed on your virtual machines
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.Your on-premises network contains an e-commerce web app that was developed in Angular and Node.js. The web app uses a MongoDB database.You plan to migrate the web app to Azure. The solution architecture team proposes the following architecture as an Azure landing zone.You need to provide recommendations to secure the connection between the web app and the database. The solution must follow the Zero Trust model.Solution: You recommend creating private endpoints for the web app and the database layer.Does this meet the goal?
How to Use Azure Private Endpoints to Restrict Public Access to WebApps.As an Azure administrator or architect, you are sometimes asked the question: "How can we safely deploy internal business applications to Azure App Services?"These applications characteristically are:Not accessible from the public internet.Accessible from within the on-premises corporate networkAccessible via an authorized VPN client from outside the corporate network.For such scenarios, we can use Azure Private Links, which enables private and secure access to Azure PaaS services over Azure Private Endpoints, along with the Site-to-Site VPN, Point-to-Site VPN, or the Express Route. Azure Private Endpoint is a read-only network interface service associated with the Azure PAAS Services. It allows you to bring deployed sites into your virtual network, limiting access to them at the network level.It uses one of the private IP addresses from your Azure VNet and associates it with the Azure App Services.These services are called Private Link resources. They can be Azure Storage, Azure Cosmos DB, SQL, App Services Web App, your own / partner owned services, Azure Backups, Event Grids, Azure Service Bus, or Azure Automations.
https://www.varonis.com/blog/securing-access-azure-webapps
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.Your on-premises network contains an e-commerce web app that was developed in Angular and Node.js. The web app uses a MongoDB database.You plan to migrate the web app to Azure. The solution architecture team proposes the following architecture as an Azure landing zone.You need to provide recommendations to secure the connection between the web app and the database. The solution must follow the Zero Trust model.Solution: You recommend implementing Azure Key Vault to store credentials.Does this meet the goal?
Instead use solution: You recommend creating private endpoints for the web app and the database layer.Note:How to Use Azure Private Endpoints to Restrict Public Access to WebApps.As an Azure administrator or architect, you are sometimes asked the question: "How can we safely deploy internal business applications to Azure App Services?"These applications characteristically are:Not accessible from the public internet.Accessible from within the on-premises corporate networkAccessible via an authorized VPN client from outside the corporate network.For such scenarios, we can use Azure Private Links, which enables private and secure access to Azure PaaS services over Azure Private Endpoints, along with the Site-to-Site VPN, Point-to-Site VPN, or the Express Route. Azure Private Endpoint is a read-only network interface service associated with the Azure PAAS Services. It allows you to bring deployed sites into your virtual network, limiting access to them at the network level.It uses one of the private IP addresses from your Azure VNet and associates it with the Azure App Services.These services are called Private Link resources. They can be Azure Storage, Azure Cosmos DB, SQL, App Services Web App, your own / partner owned services, Azure Backups, Event Grids, Azure Service Bus, or Azure Automations.
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.Your on-premises network contains an e-commerce web app that was developed in Angular and Node.js. The web app uses a MongoDB database.You plan to migrate the web app to Azure. The solution architecture team proposes the following architecture as an Azure landing zone.You need to provide recommendations to secure the connection between the web app and the database. The solution must follow the Zero Trust model.Solution: You recommend implementing Azure Application Gateway with Azure Web Application Firewall (WAF).Does this meet the goal?
You have a Microsoft 365 subscription and an Azure subscription. Microsoft Defender XDR and Microsoft Defender for Cloud are enabled.The Azure subscription contains 50 virtual machines. Each virtual machine runs different applications on Windows Server 2019.You need to recommend a solution to ensure that only authorized applications can run on the virtual machines. If an unauthorized application attempts to run or be installed, the application must be blocked automatically until an administrator authorizes the application.Which security control should you recommend?
For this question these are the correct answers:* adaptive application controls in Defender for Cloud* application control policies in Microsoft Defender for Endpoint For this question these are the incorrect answers:* app discovery anomaly detection policies in Microsoft Defender for Cloud Apps* app protection policies in Microsoft Endpoint Manager* app registrations in Microsoft Entra tenant* Azure Security Benchmark compliance controls in Defender for Cloud* Microsoft Entra Conditional Access App Control policies* OAuth app policies in Microsoft Defender for Cloud AppsExplanations for correct answers:* adaptive application controls in Defender for CloudAdaptive application controls are an intelligent and automated solution for defining allowlists of known-safe applications for your machines.Often, organizations have collections of machines that routinely run the same processes. Microsoft Defender for Cloud uses machine learning to analyze the applications running on your machines and create a list of the known-safe software. Allowlists are based on your specific Azure workloads, and you can further customize the recommendations using the instructions below.When you've enabled and configured adaptive application controls, you'll get security alerts if any application runs other than the ones you've defined as safe.* application control policies in Microsoft Defender for Endpoint Windows Defender Application Control is designed to protect devices against malware and other untrusted software. It prevents malicious code from running by ensuring that only approved code, that you know, can be run.Application Control is a software-based security layer that enforces an explicit list of software that is allowed to run on a PC.Explanations for incorrect answers:* app discovery anomaly detection policies in Microsoft Defender for Cloud Apps Cloud Discovery anomaly detection policy reference. A Cloud Discovery anomaly detection policy enables you to set up and configure continuous monitoring of unusual increases in cloud application usage. Increases in downloaded data, uploaded data, transactions, and users are considered for each cloud application.* app protection policies in Microsoft Endpoint ManagerApp protection policies (APP) are rules that ensure an organization's data remains safe or contained in a managed app. A policy can be a rule that is enforced when the user attempts to access or move "corporate" data, or a set of actions that are prohibited or monitored when the user is inside the app. A managed app is an app that has app protection policies applied to it, and can be managed by Intune.* Azure Security Benchmark compliance controls in Defender for Cloud The Azure Security Benchmark (ASB) provides prescriptive best practices and recommendations to help improve the security of workloads, data, and services on Azure. This benchmark is part of a set of holistic security guidance.* OAuth app policies in Microsoft Defender for Cloud AppsMicrosoft Defender for Cloud Apps OAuth app policies.OAuth app policies enable you to investigate which permissions each app requested and which users authorized them for Office 365, Google Workspace, and Salesforce. You're also able to mark these permissions as approved or banned. Marking them as banned will revoke permissions for each app for each user who authorized it.Note: In addition to the existing investigation of OAuth apps connected to your environment, you can set permission policies so that you get automated notifications when an OAuth app meets certain criteria. For example, you can automatically be alerted when there are apps that require a high permission level and were authorized by more than 50 users.
https://docs.microsoft.com/en-us/azure/defender-for-cloud/adaptive-application-controls https://learn.microsoft.com/en-us/mem/configmgr/protect/deploy-use/use-device-guard-with-configuration- manager https://docs.microsoft.com/en-us/defender-cloud-apps/app-permission-policy
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.Your on-premises network contains an e-commerce web app that was developed in Angular and Node.js. The web app uses a MongoDB database.You plan to migrate the web app to Azure. The solution architecture team proposes the following architecture as an Azure landing zone.You need to provide recommendations to secure the connection between the web app and the database. The solution must follow the Zero Trust model.Solution: You recommend implementing Azure Front Door with Azure Web Application Firewall (WAF).Does this meet the goal?
Post your Comments and Discuss Microsoft SC-100 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the SC-100 content, but please register or login to continue.