You have a Microsoft 365 subscription and an Azure subscription. Microsoft Defender XDR and Microsoft Defender for Cloud are enabled.The Azure subscription contains 50 virtual machines. Each virtual machine runs different applications on Windows Server 2019.You need to recommend a solution to ensure that only authorized applications can run on the virtual machines. If an unauthorized application attempts to run or be installed, the application must be blocked automatically until an administrator authorizes the application.Which security control should you recommend?
Answer(s): D
For this question these are the correct answers:* adaptive application controls in Defender for Cloud* application control policies in Microsoft Defender for Endpoint For this question these are the incorrect answers:* app discovery anomaly detection policies in Microsoft Defender for Cloud Apps* app protection policies in Microsoft Endpoint Manager* app registrations in Microsoft Entra tenant* Azure Security Benchmark compliance controls in Defender for Cloud* Microsoft Entra Conditional Access App Control policies* OAuth app policies in Microsoft Defender for Cloud AppsExplanations for correct answers:* adaptive application controls in Defender for CloudAdaptive application controls are an intelligent and automated solution for defining allowlists of known-safe applications for your machines.Often, organizations have collections of machines that routinely run the same processes. Microsoft Defender for Cloud uses machine learning to analyze the applications running on your machines and create a list of the known-safe software. Allowlists are based on your specific Azure workloads, and you can further customize the recommendations using the instructions below.When you've enabled and configured adaptive application controls, you'll get security alerts if any application runs other than the ones you've defined as safe.* application control policies in Microsoft Defender for Endpoint Windows Defender Application Control is designed to protect devices against malware and other untrusted software. It prevents malicious code from running by ensuring that only approved code, that you know, can be run.Application Control is a software-based security layer that enforces an explicit list of software that is allowed to run on a PC.Explanations for incorrect answers:* app discovery anomaly detection policies in Microsoft Defender for Cloud Apps Cloud Discovery anomaly detection policy reference. A Cloud Discovery anomaly detection policy enables you to set up and configure continuous monitoring of unusual increases in cloud application usage. Increases in downloaded data, uploaded data, transactions, and users are considered for each cloud application.* app protection policies in Microsoft Endpoint ManagerApp protection policies (APP) are rules that ensure an organization's data remains safe or contained in a managed app. A policy can be a rule that is enforced when the user attempts to access or move "corporate" data, or a set of actions that are prohibited or monitored when the user is inside the app. A managed app is an app that has app protection policies applied to it, and can be managed by Intune.* Azure Security Benchmark compliance controls in Defender for Cloud The Azure Security Benchmark (ASB) provides prescriptive best practices and recommendations to help improve the security of workloads, data, and services on Azure. This benchmark is part of a set of holistic security guidance.* OAuth app policies in Microsoft Defender for Cloud AppsMicrosoft Defender for Cloud Apps OAuth app policies.OAuth app policies enable you to investigate which permissions each app requested and which users authorized them for Office 365, Google Workspace, and Salesforce. You're also able to mark these permissions as approved or banned. Marking them as banned will revoke permissions for each app for each user who authorized it.Note: In addition to the existing investigation of OAuth apps connected to your environment, you can set permission policies so that you get automated notifications when an OAuth app meets certain criteria. For example, you can automatically be alerted when there are apps that require a high permission level and were authorized by more than 50 users.
https://docs.microsoft.com/en-us/azure/defender-for-cloud/adaptive-application-controls https://learn.microsoft.com/en-us/mem/configmgr/protect/deploy-use/use-device-guard-with-configuration- manager https://docs.microsoft.com/en-us/defender-cloud-apps/app-permission-policy
You have a Microsoft 365 subscription.You have an Azure subscription.You need to implement a Microsoft Purview communication compliance solution for Microsoft Teams andYammer. The solution must meet the following requirements:Assign compliance policies to Microsoft 365 groups based on custom Microsoft Exchange Online attributes.Minimize the number of compliance policies.Minimize administrative effort.What should you include in the solution?
Answer(s): B
HOTSPOTYou have an Azure subscription that contains a Microsoft Sentinel workspace named MSW1. MSW11 includes 50 scheduled analytics rules.You need to design a security orchestration automated response (SOAR) solution by using Microsoft Sentinel playbooks. The solution must meet the following requirements:Ensure that expiration dates can be configured when a playbook runs.Minimize the administrative effort required to configure individual analytics rules.What should you use to invoke the playbooks, and which type of Microsoft Sentinel trigger should you use? To answer, select the options in the answer area.Note: Each correct selection is worth one point.Hot Area:
Answer(s): A
Box 1: Automation rulesYou can respond to threats by using playbooks with automation rules in Microsoft SentinelBox 2: IncidentUse triggers and actions in Microsoft Sentinel playbooksFor most use cases, incident-triggered automation is the preferable approach. In Microsoft Sentinel, an incident is a "case file" an aggregation of all the relevant evidence for a specific investigation. It's a container for alerts, entities, comments, collaboration, and other artifacts. Unlike alerts which are single pieces of evidence, incidents are modifiable, have the most updated status, and can be enriched with comments, tags, and bookmarks. The incident allows you to track the attack story which keeps evolving with the addition of new alerts.For these reasons, it makes more sense to build your automation around incidents. So the most appropriate way to create playbooks is to base them on the Microsoft Sentinel incident trigger in Azure Logic Apps.
https://learn.microsoft.com/en-us/azure/sentinel/automate-incident-handling-with-automation-rules https://learn.microsoft.com/en-us/azure/sentinel/tutorial-respond-threats-playbook
HOTSPOTYou have three Microsoft Entra tenants named Tenant1, Tenant2, and Tenant3.You have three Azure subscriptions named Sub1, Sub2, and Sub3. Each tenant is associated with multiple Azure subscriptions.Each subscription contains a single Microsoft Sentinel workspace as shown in the following table.You need to recommend a solution that meets the following requirements:Ensures that the users in Tenant1 can manage the resources in Sub2 and Sub3 without having to switch subscriptions or sign in to a different tenant.Implements multiple workspace view for Sentinel2 and Sentinel3.What should you use to delegate permissions, and which Microsoft Sentinel feature will users be able to manage in multiple workspace view? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one point.Hot Area:
Box 1: Azure LighthouseDelegate permissions by usingYou can manage workspaces across tenants using Azure Lighthouse. In many scenarios, the different Microsoft Sentinel workspaces can be located in different Microsoft Entra tenants. You can use Azure Lighthouse to extend all cross-workspace activities across tenant boundaries, allowing users in your managing tenant to work on Microsoft Sentinel workspaces across all tenants.Once Azure Lighthouse is onboarded, use the directory + subscription selector on the Azure portal to select all the subscriptions containing workspaces you want to manage, in order to ensure that they'll all be available in the different workspace selectors in the portal.When using Azure Lighthouse, it's recommended to create a group for each Microsoft Sentinel role and delegate permissions from each tenant to those groups.Box 2: WorkbooksMicrosoft Sentinel featureUse cross-workspace workbooksWorkbooks provide dashboards and apps to Microsoft Sentinel. When working with multiple workspaces, workbooks provide monitoring and actions across workspaces.Note: Extend Microsoft Sentinel across workspaces and tenants When you onboard Microsoft Sentinel, your first step is to select your Log Analytics workspace. While you can get the full benefit of the Microsoft Sentinel experience with a single workspace, in some cases, you might want to extend your workspace to query and analyze your data across workspaces and tenants.
https://learn.microsoft.com/en-us/azure/sentinel/extend-sentinel-across-workspaces-tenants
HOTSPOTYour company, named Contoso, Ltd., has a Microsoft Entra tenant named contoso.com. Contoso has a partner company named Fabrikam, Inc. that has a Microsoft Entra tenant named fabrikam.com.You need to ensure that helpdesk users at Fabrikam can reset passwords for specific users at Contoso. The solution must meet the following requirements:Follow the principle of least privilege.Minimize administrative effort.What should you do? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one point.Hot Area:
Box 1: Directory ReadersTo enable a service principal or guest user to use a role assignment scoped to an administrative unit, you must assign the Directory Readers role (or another role that includes read permissions) at a tenant scope.Box 2: Administrative unitAssign Microsoft Entra roles with administrative unit scopeIn Microsoft Entra ID, for more granular administrative control, you can assign a Microsoft Entra role with a scope that's limited to one or more administrative units. When a Microsoft Entra role is assigned at the scope of an administrative unit, role permissions apply only when managing members of the administrative unit itself, and don't apply to tenant-wide settings or configurations.For example, an administrator who is assigned the Groups Administrator role at the scope of an administrative unit can manage groups that are members of the administrative unit, but they can't manage other groups in the tenant. They also can't manage tenant-level settings related to groups, such as expiration or group naming policies.Box 3: Password Administrator* Password AdministratorCan reset passwords for non-administrators within the assigned administrative unit only. This is a privileged role. Users with this role have limited ability to manage passwords. This role does not grant the ability to manage service requests or monitor service health. Whether a Password Administrator can reset a user's password depends on the role the user is assigned.Incorrect:* Helpdesk AdministratorCan reset passwords for non-administrators in the assigned administrative unit only.Has more permissions compared to Helpdesk AdministratorThis is a privileged role. Users with this role can change passwords, invalidate refresh tokens, create and manage support requests with Microsoft for Azure and Microsoft 365 services, and monitor service health. Invalidating a refresh token forces the user to sign in again.
https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/admin-units-assign-roles
HOTSPOTYou have multiple on-premises Hyper-V hosts that contain virtual machines. The virtual machines run Windows Server 2022.You have an Azure subscription.You need to recommend a solution to collect Security event logs from the virtual machines by using Microsoft Sentinel. The Solution must meet the following requirements:Leverage the Windows Security Events via AMA data connector.Ensure that only specific events are collected.Minimize costs.What should you recommend? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one port.Hot Area:
Box 1: Azure Monitor data collection rules (DCRs)In Azure, deployWindows Security Events via AMA connector for Microsoft Sentinel You can stream all security events from the Windows machines connected to your Microsoft Sentinel workspace using the Windows agent. This connection enables you to view dashboards, create custom alerts,and improve investigation. This gives you more insight into your organization's network and improves your security operation capabilities.Connector attributesCreate a data collection ruleYou can define a data collection rule to send data from multiple machines to multiple Log Analytics workspaces, including workspaces in a different region or tenant. Create the data collection rule in the same region as your Log Analytics workspace. You can send Windows event and Syslog data to Azure Monitor Logs only. You can send performance counters to both Azure Monitor Metrics and Azure Monitor Logs.Box 2: The Azure Connected Machine agent for Azure Arc-enabled servers On the virtual machines, installThe Azure Connected Machine agent enables you to manage your Windows and Linux machines hosted outside of Azure on your corporate network or other cloud providers.
https://learn.microsoft.com/en-us/azure/azure-monitor/agents/data-collection-rule-azure-monitor-agent https://learn.microsoft.com/en-us/windows-server/administration/azure https://learn.microsoft.com/en-us/azure/azure-arc/servers/agent-overview
HOTSPOTYou have an Azure subscription that contains 100 virtual machines. The virtual machines are accessed by using Azure Bastion.You need to recommend a solution to ensure that only specific users in specific locations can access the virtual machines. The solution must meet the following requirements:Restrict access to the virtual machines based on an originating IP address or a connection request by using just-in-time (JIT) VM access network-based controls.Restrict access to the virtual machines based on role-based access control (RBAC) role assignments by using JIT VM access authorization controls.Which Microsoft cloud services should you include in the recommendation? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one point.Hot Area:
Box 1: Microsoft Defender for CloudRestrict access to the virtual machines based on an originating IP address or a connection request by using just-in-time (JIT) VM access network-based controls.Microsoft Defender for Cloud offers JIT. With JIT, you can lock down the inbound traffic to your VMs, reducing exposure to attacks while providing easy access to connect to VMs when needed.Box 2: Microsoft Entra Privileged Identity Management (PIM)Restrict access to the virtual machines based on role-based access control (RBAC) role assignments by using JIT VM access authorization controls.Multilayered protection for Azure virtual machine accessThis solution offers a multilayered strategy for protecting virtual machines (VMs) in Azure. Users need to connect to VMs for management and administrative purposes. It's crucial to maintain accessibility while minimizing the attack surface.This solution uses many Azure services and features including:*-> Microsoft Entra Privileged Identity Management (PIM).*-> The just-in-time (JIT) VM access feature of Microsoft Defender for Cloud.*-> Azure Bastion.*-> Azure role-based access control (Azure RBAC) custom roles.Microsoft Entra Conditional Access, optionally.Azure Key Vault, optionally.
https://learn.microsoft.com/en-us/azure/defender-for-cloud/just-in-time-access-overview https://learn.microsoft.com/en-us/azure/architecture/solution-ideas/articles/multilayered-protection-azure-vm
Post your Comments and Discuss Microsoft SC-100 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the SC-100 content, but please register or login to continue.