You have an Azure subscription.Your company has a governance requirement that resources must be created in the West Europe or North Europe Azure regions.What should you recommend using to enforce the governance requirement?
Answer(s): C
Azure Policy helps to enforce organizational standards and to assess compliance at-scale.Common use cases for Azure Policy include implementing governance for resource consistency, regulatory compliance, security, cost, and management. Policy definitions for these common use cases are already available in your Azure environment as built-ins to help you get started.Specifically, some useful governance actions you can enforce with Azure Policy include:Ensuring your team deploys Azure resources only to allowed regions Enforcing the consistent application of taxonomic tagsRequiring resources to send diagnostic logs to a Log Analytics workspaceNote: Once your business rules have been formed, the policy definition or initiative is assigned to any scope of resources that Azure supports, such as management groups, subscriptions, resource groups, or individual resources. The assignment applies to all resources within the Resource Manager scope of that assignment.
https://learn.microsoft.com/en-us/azure/governance/policy/overview
HOTSPOTYou have a Microsoft 365 subscription that is protected by using Microsoft 365 Defender.You are designing a security operations strategy that will use Microsoft Sentinel to monitor events from Microsoft 365 and Microsoft 365 Defender.You need to recommend a solution to meet the following requirements:Integrate Microsoft Sentinel with a third-party security vendor to access information about known malware.Automatically generate incidents when the IP address of a command-and-control server is detected in the events.What should you configure in Microsoft Sentinel to meet each requirement? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one point.Hot Area:
Answer(s): A
Box 1: A threat Intelligence connectorIntegrate Microsoft Sentinel with a third-party security vendor to access information about known malware.Connect your threat intelligence platform to Microsoft Sentinel Many organizations use threat intelligence platform (TIP) solutions to aggregate threat indicator feeds from various sources. From the aggregated feed, the data is curated to apply to security solutions such as network devices, EDR/XDR solutions, or SIEMs such as Microsoft Sentinel. The Threat Intelligence Platforms data connector allows you to use these solutions to import threat indicators into Microsoft Sentinel.Because the TIP data connector works with the Microsoft Graph Security tiIndicators API to accomplish this, you can use the connector to send indicators to Microsoft Sentinel (and to other Microsoft security solutions like Microsoft 365 Defender) from any other custom threat intelligence platform that can communicate with that API.Box 2: A playbookAutomatically generate incidents when the IP address of a command-and-control server is detected in the events.Sentinel, automatically check and record IP address reputation information in incidentsYou can use Microsoft Sentinel automation rules and playbooks to automatically check IP addresses in your incidents.Incorrect:* Threat IndicatorFor SIEM solutions like Microsoft Sentinel, the most common forms of CTI are threat indicators, also known as Indicators of Compromise (IoC) or Indicators of Attack (IoA). Threat indicators are data that associate observed artifacts such as URLs, file hashes, or IP addresses with known threat activity such as phishing, botnets, or malware. This form of threat intelligence is often called tactical threat intelligence because it's applied to security products and automation in large scale to detect potential threats to an organization and protect against them. Use threat indicators in Microsoft Sentinel, to detect malicious activity observed in your environment and provide context to security investigators to inform response decisions.
https://learn.microsoft.com/en-us/azure/sentinel/connect-threat-intelligence-tip https://learn.microsoft.com/en-us/azure/sentinel/tutorial-enrich-ip-information
You have an Azure subscription that has Microsoft Defender for Cloud enabled.You need to enforce ISO 27001:2013 standards for new resources deployed to the subscription. The solution must ensure that noncompliant resources are automatically detected.What should you use?
How are regulatory compliance standards represented in Defender for Cloud? Industry standards, regulatory standards, and benchmarks are represented in Defender for Cloud's regulatory compliance dashboard. Each standard is an initiative defined in Azure Policy.What regulatory compliance standards are available in Defender for Cloud? By default, every Azure subscription has the Microsoft cloud security benchmark assigned. This is the Microsoft-authored, cloud specific guidelines for security and compliance best practices based on common compliance frameworksAvailable regulatory standards:PCI-DSS v3.2.1 (deprecated)PCI DSS v4SOC TSPSOC 2 Type 2ISO 27001:2013Etc.
https://learn.microsoft.com/en-us/azure/defender-for-cloud/update-regulatory-compliance-packages
DRAG DROP (Drag and Drop is not supported)You have a hybrid Microsoft Entra tenant that has pass-through authentication enabled.You are designing an identity security strategy.You need to minimize the impact of brute force password attacks and leaked credentials of hybrid identities.What should you include in the design? To answer, drag the appropriate features to the correct requirements. Each feature may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.Note: Each correct selection is worth one point.Select and Place:
Box 1: Microsoft Entra Password ProtectionFor brute force password attacksPassword protection for Microsoft Entra ID detects and blocks known weak passwords and their variants, and other common terms specific to your organization. It also includes custom banned password lists and self- service password reset capabilities.Box 2: Password hash synchronizationFor leaked credentialsPassword hash synchronization helps by reducing the number of passwords, your users need to maintain to just one. Password hash synchronization can:Improve the productivity of your users.Reduce your helpdesk costs.Password Hash Sync also enables leaked credential detection for your hybrid accounts. Microsoft works alongside dark web researchers and law enforcement agencies to find publicly available username/password pairs. If any of these pairs match those of our users, the associated account is moved to high risk.Note: Password hash synchronization is one of the sign-in methods used to accomplish hybrid identity. Microsoft Entra Connect synchronizes a hash of a user's password from an on-premises Active Directory instance to a cloud-based Microsoft Entra instance.Password hash synchronization is an extension to the directory synchronization feature implemented by Microsoft Entra Connect sync. You can use this feature to sign in to Microsoft Entra services like Microsoft 365. You sign in to the service by using the same password you use to sign in to your on-premises Active Directory instance.
https://www.microsoft.com/en-us/security/business/identity-access/azure-active-directory-password-protection https://learn.microsoft.com/en-us/azure/active-directory/hybrid/connect/whatis-phs
HOTSPOTYou are designing the security architecture for a cloud-only environment.You are reviewing the integration point between Microsoft Defender XDR and other Microsoft cloud services based on Microsoft Cybersecurity Reference Architectures (MCRA).You need to recommend which Microsoft cloud services integrate directly with Microsoft Defender XDR and meet the following requirements:Enforce data loss prevention (DLP) policies that can be managed directly from the Microsoft Defender portal.Detect and respond to security threats based on User and Entity Behavior Analytics (UEBA) with unified alerting.What should you include in the recommendation for each requirement? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one point.Hot Area:
Box 1: Microsoft PurviewEnforce data loss prevention (DLP) policies that can be managed directly from the Microsoft 365 Defender portal.Investigate data loss prevention alerts with Microsoft 365 Defender You can manage Microsoft Purview Data Loss Prevention (DLP) alerts in the Microsoft 365 Defender portal. Open Incidents & alerts > Incidents on the quick launch of the Microsoft 365 Defender portal. From this page, you can:View all your DLP alerts grouped under incidents in the Microsoft 365 Defender incident queue. View intelligent inter-solution (DLP-MDE, DLP-MDO) and intra-solution (DLP-DLP) correlated alerts under a single incident.Hunt for compliance logs along with security under Advanced Hunting. In-place admin remediation actions on user, file, and device.Associate custom tags to DLP incidents and filter by them.Filter by DLP policy name, tag, Date, service source, incident status, and user on the unified incident queueBox 2: Microsoft Entra ID ProtectionDetect and respond to security threats based on User and Entity Behavior Analytics (UEBA) with unified alerting.Implement Microsoft Sentinel and Microsoft 365 Defender for Zero Trust Microsoft Sentinel can detect anomalous activity through its User Entity Behavioral Analytics (UEBA) engine.Microsoft 365 Defender has Microsoft Entra ID Protection, which can block users based on the level of risk with identity. Data can be fed into Microsoft Sentinel for further analysis and automation.Incorrect:* Microsoft Defender for IdentityNo mention of a hybrid scenario with Microsoft Entra ID in the question.Note: Microsoft Defender for Identity is a cloud-based security solution that uses your on-premises Active Directory signals to identify, detect, and investigate advanced threats, compromised identities, and malicious insider actions directed at your organization.Defender for Identity enables SecOp analysts and security professionals struggling to detect advanced attacks in hybrid environments to:Monitor users, entity behavior, and activities with learning-based analytics Protect user identities and credentials stored in Microsoft Entra ID Identify and investigate suspicious user activities and advanced attacks throughout the kill chain Provide clear incident information on a simple timeline for fast triageDefender for Identity was formerly known as Azure Advanced Threat Protection (Azure ATP).
https://learn.microsoft.com/en-us/microsoft-365/security/defender/dlp-investigate-alerts-defender https://learn.microsoft.com/en-us/security/operations/siem-xdr-overview https://learn.microsoft.com/en-us/defender-for-identity/what-is
HOTSPOTYou have a Microsoft 365 E5 subscription that uses Microsoft Exchange Online.You need to recommend a solution to prevent malicious actors from impersonating the email addresses of internal senders.What should you include in the recommendation? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one point.Hot Area:
Box 1: Microsoft Defender for Office 365ServiceThere are Anti-phishing policies in Defender for Office 365Anti-phishing policies in Microsoft 365Policies to configure anti-phishing protection settings are available in Microsoft 365 organizations with Exchange Online mailboxes, standalone Exchange Online Protection (EOP) organizations without Exchange Online mailboxes, and Microsoft Defender for Office 365 organizations.The high-level differences between anti-phishing policies in EOP and anti-phishing policies in Defender for Office 365 are described in the following table:Box 2: Anti-phishingPolicy type
https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/anti-phishing-policies-about? view=o365-worldwide
HOTSPOTYour network contains an on-premises Active Directory Domain Services (AD DS) domain. The domain contains a server that runs Windows Server and hosts shared folders. The domain syncs with Microsoft Entra tenant by using Microsoft Entra Connect. Microsoft Entra Connect has group writeback enabled.You have a Microsoft 365 subscription that uses Microsoft SharePoint Online.You have multiple project teams. Each team has an AD DS group that syncs with Microsoft Entra tenant. Each group has permissions to a unique SharePoint Online site and a Windows Server shared folder for its project.Users routinely move between project teams.You need to recommend a Microsoft Entra ID Governance solution that meets the following requirements:Project managers must verify that their project group contains only the current members of their project team.The members of each project team must only have access to the resources of the project to which they are assigned.Users must be removed from a project group automatically if the project manager has NOT verified the group's membership for 30 days.Administrative effort must be minimized.What should you include in the recommendation? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one point.Hot Area:
Box 1: Lifecycle workflowsIdentity Governance feature:Lifecycle workflows are a new identity governance feature that enables organizations to manage Microsoft Entra ID users by automating these three basic lifecycle processes:Joiner: When an individual enters the scope of needing access. An example is a new employee joining a company or organization.Mover: When an individual moves between boundaries within an organization. This movement might require more access or authorization. An example is a user who was in marketing and is now a member of the sales organization.Leaver: When an individual leaves the scope of needing access. This movement might require the removal of access. Examples are an employee who's retiring or an employee who's terminated.Workflows contain specific processes that run automatically against users as they move through their lifecycle.Workflows consist of tasks and execution conditions.Tasks are specific actions that run automatically when a workflow is triggered. An execution condition defines the scope of who's affected and the trigger of when a workflow will be performed.Box 2: From the Microsoft Entra tenant, create a security group for each group and enable writeback for each group.Project team configuration:We need security groups for each project. We also need to enable group writeback.Note: Plan for Microsoft Entra Connect group writebackGroup writeback allows you to write cloud groups back to your on-premises Microsoft Entra instance by using Microsoft Entra Connect sync. You can use this feature to manage groups in the cloud, while controlling access to on-premises applications and resources.
https://learn.microsoft.com/en-us/azure/active-directory/governance/what-are-lifecycle-workflows
HOTSPOTYou are designing a privileged access strategy for a company named Contoso, Ltd. and its partner company named Fabrikam, Inc. Contoso has a Microsoft Entra tenant named contoso.com. Fabrikam has a Microsoft Entra tenant named fabrikam.com. Users at Fabrikam must access the resources in contoso.com.You need to provide the Fabrikam users with access to the Contoso resources by using access packages. The solution must meet the following requirements:Ensure that the Fabrikam users can use the Contoso access packages without explicitly creating guest accounts in contoso.com.Allow non-administrative users in contoso.com to create the access packages.What should you use for each requirement? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one point.Hot Area:
Box 1: A connected organizationEnsure that the Fabrikam users can use the Contoso access packages without explicitly creating guest accounts in contoso.com.How access works for external usersThe following diagram and steps provide an overview of how external users are granted access to an access package.1. You add a connected organization for the Microsoft Entra directory or domain you want to collaborate with. You can also configure a connected organization for a social identity provider.2. You check the catalog setting Enabled for external users in the catalog to contain the access package is Yes.3. Etc.Box 2: CatalogsAllow non-administrative users in contoso.com to create the access packages.Note: Govern access for external users in entitlement management Entitlement management uses Microsoft Entra business-to-business (B2B) to share access so you can collaborate with people outside your organization. With Microsoft Entra B2B, external users authenticate to their home directory, but have a representation in your directory. The representation in your directory enables the user to be assigned access to your resources.
https://learn.microsoft.com/en-us/azure/active-directory/governance/entitlement-management-external-users
Post your Comments and Discuss Microsoft SC-100 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the SC-100 content, but please register or login to continue.