You have a customer that has a Microsoft 365 subscription and an Azure subscription.The customer has devices that run either Windows, iOS, Android, or macOS. The Windows devices are deployed on-premises and in Azure.You need to design a security solution to assess whether all the devices meet the customer's compliance rules.What should you include in the solution?
Answer(s): B
Microsoft Endpoint Manager includes Microsoft Intune.Device compliance policies are a key feature when using Intune to protect your organization's resources. In Intune, you can create rules and settings that devices must meet to be considered compliant, such as a minimum OS version.Microsoft Endpoint Manager helps deliver the modern workplace and modern management to keep your data secure, in the cloud and on-premises. Endpoint Manager includes the services and tools you use to manage and monitor mobile devices, desktop computers, virtual machines, embedded devices, and servers.Endpoint Manager combines services you may know and already be using, including Microsoft Intune,Configuration Manager, Desktop Analytics, co-management, and Windows Autopilot. These services are part of the Microsoft 365 stack to help secure access, protect data, respond to risk, and manage risk.Note: Microsoft Defender for Endpoint Plan 2 protects your Windows and Linux machines whether they're hosted in Azure, hybrid clouds (on-premises), or multicloud.Microsoft Defender for Endpoint on iOS offers protection against phishing and unsafe network connections from websites, emails, and apps.Microsoft Defender for Endpoint on Android supports installation on both modes of enrolled devices - the legacy Device Administrator and Android Enterprise modes. Currently, Personally-owned devices with work profile and Corporate-owned fully managed user device enrollments are supported in Android Enterprise.
https://docs.microsoft.com/en-us/mem/endpoint-manager-overview https://docs.microsoft.com/en-us/azure/defender-for-cloud/integration-defender-for-endpoint
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.You have an Azure subscription that has Microsoft Defender for Cloud enabled.You are evaluating the Azure Security Benchmark V3 report.In the Secure management ports controls, you discover that you have 0 out of a potential 8 points.You need to recommend configurations to increase the score of the Secure management ports controls.Solution: You recommend onboarding all virtual machines to Microsoft Defender for Endpoint.Does this meet the goal?
Note: Secure management ports - Brute force attacks often target management ports. Use these recommendations to reduce your exposure with tools like just-in-time VM access and network security groups.Recommendations:- Internet-facing virtual machines should be protected with network security groups- Management ports of virtual machines should be protected with just-in-time network access control- Management ports should be closed on your virtual machines
https://docs.microsoft.com/en-us/azure/defender-for-cloud/secure-score-security-controls
Your company has an Azure subscription that uses Microsoft Defender for Cloud.The company signs a contract with the United States government.You need to review the current subscription for NIST 800-53 compliance.What should you do first?
Answer(s): D
For this question these are the correct answers:* From Azure Policy, assign a built-in initiative that has a scope of the subscription.* From Defender for Cloud, add a regulatory compliance standard.For this question these are the incorrect answers:* From Azure Policy, assign a built-in policy definition that has a scope of the subscription.* From Defender for Cloud, enable Defender for Cloud plans.* From Defender for Cloud, review the Azure security baseline for audit report.* From Defender for Cloud, review the secure score recommendations.* From Microsoft Defender for Cloud Apps, create an access policy for cloud applications.* From Microsoft Sentinel, configure the Microsoft Defender for Cloud data connector.Explanations for correct answers:* From Azure Policy, assign a built-in initiative that has a scope of the subscription.How are regulatory compliance standards represented in Defender for Cloud? Industry standards, regulatory standards, and benchmarks are represented in Defender for Cloud's regulatory compliance dashboard. Each standard is an initiative defined in Azure Policy.The Azure Policy Regulatory Compliance built-in initiative definition maps to compliance domains and controls in NIST SP 800-53 Rev. 5.The following mappings are to the NIST SP 800-53 Rev. 5 controls. Use the navigation on the right to jump directly to a specific compliance domain. Many of the controls are implemented with an Azure Policy initiative definition. To review the complete initiative definition, open Policy in the Azure portal and select the Definitions page. Then, find and select the NIST SP 800-53 Rev. 5 Regulatory Compliance built-in initiative definition.* From Defender for Cloud, add a regulatory compliance standard.Add a regulatory standard to your dashboardThe following steps explain how to add a package to monitor your compliance with one of the supported regulatory standards.Add a standard to your Azure resources1. From Defender for Cloud's menu, select Regulatory compliance to open the regulatory compliance dashboard. Here you can see the compliance standards currently assigned to the currently selected subscriptions.2. From the top of the page, select Manage compliance policies. The Policy Management page appears.3. Select the subscription or management group for which you want to manage the regulatory compliance posture.4. To add the standards relevant to your organization, expand the Industry & regulatory standards section and select Add more standards.5. From the Add regulatory compliance standards page, you can search for any of the available standards:6. Select Add and enter all the necessary details for the specific initiative such as scope, parameters, and remediation.7. From Defender for Cloud's menu, select Regulatory compliance again to go back to the regulatory compliance dashboard.Your new standard appears in your list of Industry & regulatory standards.Note: Customize the set of standards in your regulatory compliance dashboard.Microsoft Defender for Cloud continually compares the configuration of your resources with requirements in industry standards, regulations, and benchmarks. The regulatory compliance dashboard provides insights into your compliance posture based on how you're meeting specific compliance requirements.
https://docs.microsoft.com/en-us/azure/governance/policy/samples/gov-nist-sp-800-53-r5 https://docs.microsoft.com/en-us/azure/defender-for-cloud/update-regulatory-compliance-packages
Your company has devices that run either Windows 10, Windows 11, or Windows Server.You are in the process of improving the security posture of the devices.You plan to use security baselines from the Microsoft Security Compliance Toolkit.What should you recommend using to compare the baselines to the current device configurations?
Microsoft Security Compliance Toolkit 1.0, Policy Analyzer.The Policy Analyzer is a utility for analyzing and comparing sets of Group Policy Objects (GPOs). Its main features include:Highlight when a set of Group Policies has redundant settings or internal inconsistencies.Highlight the differences between versions or sets of Group Policies.Compare GPOs against current local policy and local registry settings Export results to a Microsoft Excel spreadsheetPolicy Analyzer lets you treat a set of GPOs as a single unit. This treatment makes it easy to determine whether particular settings are duplicated across the GPOs or are set to conflicting values. Policy Analyzer also lets you capture a baseline and then compare it to a snapshot taken at a later time to identify changes anywhere across the set.Note: The Security Compliance Toolkit (SCT) is a set of tools that allows enterprise security administrators to download, analyze, test, edit, and store Microsoft-recommended security configuration baselines for Windows and other Microsoft products.The SCT enables administrators to effectively manage their enterprise's Group Policy Objects (GPOs). Using the toolkit, administrators can compare their current GPOs with Microsoft-recommended GPO baselines or other baselines, edit them, store them in GPO backup file format, and apply them broadly through Active Directory or individually through local policy.Security Compliance Toolkit Tools:Policy AnalyzerLocal Group Policy Object (LGPO)Set Object SecurityGPO to Policy RulesIncorrect:Not B: Local Group Policy Object (LGPO)What is the Local Group Policy Object (LGPO) tool?LGPO.exe is a command-line utility that is designed to help automate management of Local Group Policy.Using local policy gives administrators a simple way to verify the effects of Group Policy settings, and is also useful for managing non-domain-joined systems. LGPO.exe can import and apply settings from Registry Policy (Registry.pol) files, security templates, Advanced Auditing backup files, as well as from formatted "LGPO text" files. It can export local policy to a GPO backup. It can export the contents of a Registry Policy file to the "LGPO text" format that can then be edited, and can build a Registry Policy file from an LGPO text file.
https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-security- configuration-framework/security-compliance-toolkit-10
You are evaluating an Azure environment for compliance.You need to design an Azure Policy implementation that can be used to evaluate compliance without changing any resources.Which effect should you use in Azure Policy?
This effect is useful for testing situations or for when the policy definition has parameterized the effect. This flexibility makes it possible to disable a single assignment instead of disabling all of that policy's assignments.An alternative to the Disabled effect is enforcementMode, which is set on the policy assignment. When enforcementMode is Disabled, resources are still evaluated.Incorrect:Not A: Deny is used to prevent a resource request that doesn't match defined standards through a policy definition and fails the request.Not B: Modify evaluates before the request gets processed by a Resource Provider during the creation or updating of a resource. The Modify operations are applied to the request content when the if condition of the policy rule is met. Each Modify operation can specify a condition that determines when it's applied. Operations with conditions that are evaluated to false are skipped.Not C: Append is used to add additional fields to the requested resource during creation or update.
https://docs.microsoft.com/en-us/azure/governance/policy/concepts/effects
You have an Azure subscription that is used as an Azure landing zone for an application.You need to evaluate the security posture of all the workloads in the landing zone.What should you do first?
You can evaluate security postures by using Microsoft Defender for Cloud.Defender for Cloud continually assesses your resources, subscriptions, and organization for security issues. It then aggregates all the findings into a single score so that you can tell, at a glance, your current security situation: the higher the score, the lower the identified risk level.Note: Security in the Azure landing zone acceleratorSecurity is at the core of the Azure landing zone accelerator. As part of the implementation, many tools and controls are deployed to help organizations quickly achieve a security baseline.For example, the following are included:Tools:Microsoft Defender for Cloud, standard or free tierMicrosoft SentinelAzure DDoS standard protection plan (optional)Azure FirewallWeb Application Firewall (WAF)Privileged Identity Management (PIM)Incorrect:Not C: Microsoft Sentinel uses data from Microsoft Defender for Cloud, so would need setup Defender for Cloud first.
https://learn.microsoft.com/en-us/training/modules/evaluate-security-posture-recommend-technical-strategies- to-manage-risk/3-postures-use-microsoft-defender-for-cloud https://learn.microsoft.com/en-us/training/modules/evaluate-security-posture-recommend-technical-strategies- to-manage-risk/5-design-security-for-azure-landing-zone
Answer(s): A
For this question these are the correct answers:* From Azure Policy, assign a built-in initiative that has a scope of the subscription.* From Defender for Cloud, add a regulatory compliance standard.For this question these are the incorrect answers:* From Azure Policy, assign a built-in policy definition that has a scope of the subscription.* From Defender for Cloud, enable Defender for Cloud plans.* From Defender for Cloud, review the Azure security baseline for audit report.* From Defender for Cloud, review the secure score recommendations.* From Microsoft Defender for Cloud Apps, create an access policy for cloud applications.* From Microsoft Sentinel, configure the Microsoft Defender for Cloud data connector.Explanations for correct answers:* From Azure Policy, assign a built-in initiative that has a scope of the subscription.How are regulatory compliance standards represented in Defender for Cloud?Industry standards, regulatory standards, and benchmarks are represented in Defender for Cloud's regulatory compliance dashboard. Each standard is an initiative defined in Azure Policy.The Azure Policy Regulatory Compliance built-in initiative definition maps to compliance domains and controls in NIST SP 800-53 Rev. 5.The following mappings are to the NIST SP 800-53 Rev. 5 controls. Use the navigation on the right to jump directly to a specific compliance domain. Many of the controls are implemented with an Azure Policy initiative definition. To review the complete initiative definition, open Policy in the Azure portal and select the Definitions page. Then, find and select the NIST SP 800-53 Rev. 5 Regulatory Compliance built-in initiative definition.* From Defender for Cloud, add a regulatory compliance standard.Add a regulatory standard to your dashboardThe following steps explain how to add a package to monitor your compliance with one of the supported regulatory standards.Add a standard to your Azure resources1. From Defender for Cloud's menu, select Regulatory compliance to open the regulatory compliance dashboard. Here you can see the compliance standards currently assigned to the currently selected subscriptions.2. From the top of the page, select Manage compliance policies. The Policy Management page appears.3. Select the subscription or management group for which you want to manage the regulatory compliance posture.4. To add the standards relevant to your organization, expand the Industry & regulatory standards section and select Add more standards.5. From the Add regulatory compliance standards page, you can search for any of the available standards:6. Select Add and enter all the necessary details for the specific initiative such as scope, parameters, and remediation.7. From Defender for Cloud's menu, select Regulatory compliance again to go back to the regulatory compliance dashboard.Your new standard appears in your list of Industry & regulatory standards.Note: Customize the set of standards in your regulatory compliance dashboard.Microsoft Defender for Cloud continually compares the configuration of your resources with requirements in industry standards, regulations, and benchmarks. The regulatory compliance dashboard provides insights into your compliance posture based on how you're meeting specific compliance requirements.
Post your Comments and Discuss Microsoft SC-100 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the SC-100 content, but please register or login to continue.