HOTSPOTYou have the Azure subscriptions shown in the following table.The tenants contain the groups shown in the following table.You perform the flowing actions:Configure multi-user authorization (MUA) for Vault1 by using a resource guard deployed to Sub2.Enable all available MUA controls for Vault1.In contoso.com, create a Privileged Identity Management (PIM) assignment named Assignment1.Configure Assignment1 to enable Group1 to activate the Contributor role for Vault1.For each of the following statements, select Yes if the statements is true. Otherwise, select No.Note: Each correct selection is worth one point.Hot Area:
Answer(s): A
Configure Multi-user authorization using Resource Guard in Azure BackupBox 1: NoNo - To enable MUA for Vault1, a resource guard must be deployed to Sub1.The Backup vault is in Sub1.You create a Resource Guard in a different tenant than the Backup Fault, to get maximum protection.Note: The Security admin creates the Resource Guard. We recommend that you create it in a different subscription or a different tenant as the vault. However, it should be in the same region as the vault.Box 2: YesYes - A user in Group2 must approve changes-made by a user in Group1 to the backup policies of Vault1.Group1 has administrators who manage Backup for Sub1.Group2 has administrators who manage security for Sub1 and Sub2.Note: Select operations to protect using Resource GuardChoose the operations you want to protect using the Resource Guard out of all supported critical operations. By default, all supported critical operations are enabled. However, you (as the security admin) can exempt certain operations from falling under the purview of MUA using Resource Guard.To exempt operations, follow these steps:1. In the Resource Guard, go to Properties > Recovery Services vault tab.2. Select Disable for operations that you want to exclude from being authorized using the Resource Guard.NoteYou can't disable the protected operations - Disable soft delete and Remove MUA protection.3. Optionally, you can also update the description for the Resource Guard using this blade.4. Select Save.Box 3: NoNo - A user in Group1 that activates Assignment1 can disable soft for the backups of Vault1, without the approval of a user in Group2.You can't disable the protected operations - Disable soft delete and Remove MUA protection.
https://learn.microsoft.com/en-us/azure/backup/multi-user-authorization
HOTSPOTYou have an Azure subscription that contains a virtual network named VNet1. VNet1 contains a 10-node virtual machine scale set that hosts a web search app named App1. Customers access App1 from the internet. The nodes establish outbound HTTP and HTTPS connections to the internet.You need to recommend a network security solution for App1. The solution must meet the following requirements:Inbound connections to App1 that contain security threats specified in the Core Rule Set (CRS) from theOpen Web Application Security Project (OWASP) must be blocked. Outbound HTTP and HTTPS connections from the virtual machine scale set that contain security threats identified by the Microsoft Defender Threat Intelligence (Defender TI) feed must be blocked.What should you include in the recommendation? To answer, select the options in the answer area.Note: Each correct answer is worth one point.Hot Area:
Box 1: Azure Web Application Firewall (WAF)Inbound connections to App1 that contain security threats specified in the Core Rule Set (CRS) from the Open Web Application Security Project (OWASP) must be blocked.The Azure Web Application Firewall (WAF) on Azure Application Gateway actively safeguards your web applications against common exploits and vulnerabilities. As web applications become more frequent targets for malicious attacks, these attacks often exploit well-known vulnerabilities such as SQL injection and cross- site scripting.WAF on Application Gateway is based on the Core Rule Set (CRS) from the Open Web Application Security Project (OWASP).Box 2: Azure FirewallOutbound HTTP and HTTPS connections from the virtual machine scale set that contain security threats identified by the Microsoft Defender Threat Intelligence (Defender TI) feed must be blocked.Azure Firewall threat intelligence-based filteringYou can enable Threat intelligence-based filtering for your firewall to alert and deny traffic from/to known malicious IP addresses, FQDNs, and URLs. The IP addresses, domains and URLs are sourced from the Microsoft Threat Intelligence feed, which includes multiple sources including the Microsoft Cyber Security team. Intelligent Security Graph powers Microsoft threat intelligence and uses multiple services including Microsoft Defender for Cloud.
https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/ag-overview https://learn.microsoft.com/en-us/azure/firewall/threat-intel
You have a Microsoft Entra tenant named contoso.com.You have an external partner that has a Microsoft Entra tenant named fabnkam.com.You need to recommend an identity governance solution for contoso.com that meets the following requirements:Enables the users in contoso.com and fabrikam.com to communicate by using shared Microsoft Teams channelsManages access to shared Teams channels in contoso.com by using groups in fabrikam.comSupports single sign-on (SSO)Minimizes administrative effortMaximizes securityWhat should you include in the recommendation?
Answer(s): C
B2B direct connectB2B direct connect is a feature of Microsoft Entra External ID that lets you set up a mutual trust relationship with another Microsoft Entra organization for seamless collaboration. This feature currently works with Microsoft Teams shared channels. With B2B direct connect, users from both organizations can work together using their home credentials and a shared channel in Teams, without having to be added to each other's organizations as guests. Use B2B direct connect to share resources with external Microsoft Entra organizations. Or use it to share resources across multiple Microsoft Entra tenants within your own organization.B2B direct connect requires a mutual trust relationship between two Microsoft Entra organizations to allow access to each other's resources. Both the resource organization and the external organization need to mutually enable B2B direct connect in their cross-tenant access settings. When the trust is established, the B2B direct connect user has single sign-on access to resources outside their organization using credentials from their home Microsoft Entra organization.
https://learn.microsoft.com/en-us/entra/external-id/b2b-direct-connect-overview
You have a multicloud environment that contains Azure, Amazon Web Services (AWS), and Google Cloud Platform (GCP) subscriptions.You need to discover and review role assignments across the subscriptions.What should you use?
Answer(s): D
Microsoft Entra Permissions Management is a cloud infrastructure entitlement management (CIEM) product that provides comprehensive visibility and control over permissions for any identity and any resource in Microsoft Azure, Amazon Web Services (AWS) and Google Cloud Platform (GCP).Incorrect:Not A: Azure Lighthouse enables multitenant management with scalability, higher automation, and enhanced governance across resources.Not C: Microsoft Entra ID Governance is an identity governance solution that enables organizations to improve productivity, strengthen security and more easily meet compliance and regulatory requirements. You can use Microsoft Entra ID Governance to automatically ensure that the right people have the right access to the right resources, with identity and access process automation, delegation to business groups, and increased visibility.
https://www.microsoft.com/en-us/security/business/identity-access/microsoft-entra-permissions-management
HOTSPOTYou have an Azure subscription that contains a Microsoft Sentinel workspace named WS1.You need to configure WS1 to meet the following requirements:Create custom dashboards to visualize the workload of security analysts that use Microsoft Sentinel.Enable automated responses for the security alerts generated by Microsoft Sentinel analytics rules.What should you use for each requirement? To answer, select the options in the answer area.Note: Each correct answer is worth one point.Hot Area:
Box 1: WorkbooksCreate custom dashboards to visualize the workload of security analysts that use Microsoft Sentinel.Visualize and monitor your data by using workbooks in Microsoft Sentinel After you connect your data sources to Microsoft Sentinel, visualize and monitor the data using workbooks in Microsoft Sentinel. Microsoft Sentinel workbooks are based on Azure Monitor workbooks, and add tables and charts with analytics for your logs and queries to the tools already available in Azure.Box 2: PlaybooksEnable automated responses for the security alerts generated by Microsoft Sentinel analytics rules.You can create and use Microsoft Sentinel automation rules to manage responseDesign your automation ruleBefore you create your automation rule, we recommend that you determine its scope and design, including the trigger, conditions, and actions that make up your rule.Add actionsChoose the actions you want this automation rule to take. Available actions include Assign owner, Change status, Change severity, Add tags, and Run playbook. You can add as many actions as you like.NoteOnly the Run playbook action is available in automation rules using the alert trigger.
https://learn.microsoft.com/en-us/azure/sentinel/monitor-your-data
You have multiple Azure subscriptions that each contains multiple resource groups.You need to identify the privileged role assignments in each subscription and any associated security risks.The solution must minimize administrative effort.What should you use?
List role assignments at a scopeImportantAzure role assignment integration with Privileged Identity Management is currently in PREVIEW.Follow these steps:1. In the Azure portal, click All services and then select the scope. For example, you can select Management groups, Subscriptions, Resource groups, or a resource.2. Click the specific resource.3. Click Access control (IAM).4. Click the Role assignments tab to view the role assignments at this scope.If you have a Microsoft Entra ID Free or Microsoft Entra ID P1 license, your Role assignments tab is similar to the following screenshot.
https://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-list-portal
Your on-premises network contains an Active Directory Domain Services (AD DS) domain and a hybrid deployment between a Microsoft Exchange Server 2019 organization and an Exchange Online tenant. The AD DS domain contains a group named Group1. Group1 is a member of the Organization Management role group for the Exchange deployment.You have a Microsoft 365 E5 subscription that uses Microsoft Defender.You have an Azure subscription that uses Microsoft Sentinel.You need to recommend a solution to ensure that Group1 is marked as a sensitive group and that any changes made to Group1 raises an alert in Microsoft Sentinel. The solution must minimize administrative effort.What should you include in the recommendation?
Alert changes to sensitive AD groups using MDI (Microsoft Defender for Identity) Microsoft Defender for Identity is a very powerful tool when it comes to track changes to users and groups in your on-prem Active Directory. When used in combination of the advanced hunting capabilities available in the Microsoft 365 Defender portal and custom detection rules you can very easily automate the change tracking.If you protect any on-prem Active Directory, you should be aware to changes to any privileged groups.Microsoft itself list a few of them in their documentation on Active Directory Domain Services and in the Defender for Identity documentation adds additional ones. In total there are 17 groups marked as sensitive.Account OperatorsAdministratorsBackup OperatorsDomain AdminsDomain ControllersEnterprise AdminsEnterprise Read-only Domain ControllersGroup Policy Creator OwnersIncoming Forest Trust BuildersMicrosoft Exchange ServersNetwork Configuration OperatorsPower UsersPrint OperatorsRead-only Domain ControllersReplicatorsSchema AdminsServer Operators
https://cloudbrothers.info/en/alert-sensitive-ad-groups-mdi/
HOTSPOTYou have four Azure subscriptions named Sub1, Sub2, Sub3, and Sub4. Each subscription has a unique Microsoft Entra tenant that is linked to a Microsoft 365 subscription. Sub1 contains a user named User1.You plan to implement Microsoft Sentinel.You need to ensure that User1 can monitor Microsoft Entra ID events and Microsoft 365 events for Sub2, Sub3, and Sub4 by using Microsoft Sentinel. The solution must minimize administrative effort.What is the minimum number of Microsoft Sentinel workspaces you should create, and which Azure service should you use? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one point.Hot Area:
Box 1: 3Number of workspaceOne for Sub2, one for Sub3, and one for Sub4.Note: Extend Microsoft Sentinel across workspaces and tenants When you onboard Microsoft Sentinel, your first step is to select your Log Analytics workspace. While you can get the full benefit of the Microsoft Sentinel experience with a single workspace, in some cases, you might want to extend your workspace to query and analyze your data across workspaces and tenants.Box 2: Azure LighthouseServiceManage workspaces across tenants using Azure LighthouseAs mentioned above, in many scenarios, the different Log Analytics workspaces enabled for Microsoft Sentinels can be located in different Microsoft Entra tenants. You can use Azure Lighthouse to extend all cross-workspace activities across tenant boundaries, allowing users in your managing tenant to work on workspaces across all tenants.Once Azure Lighthouse is onboarded, use the directory + subscription selector on the Azure portal to select all the subscriptions containing workspaces you want to manage, in order to ensure that they'll all be available in the different workspace selectors in the portal.When using Azure Lighthouse, it's recommended to create a group for each Microsoft Sentinel role and delegate permissions from each tenant to those groups.
https://learn.microsoft.com/en-us/azure/sentinel/extend-sentinel-across-workspaces-tenants https://learn.microsoft.com/en-us/azure/sentinel/multiple-tenants-service-providers
Post your Comments and Discuss Microsoft SC-100 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the SC-100 content, but please register or login to continue.