HOTSPOTYou have a Microsoft Entra tenant that is linked to a Microsoft 365 subscription and an Azure subscription. The tenant contains service principals that are used to access applications in the Azure subscription.You need to recommend a solution to detect risky sign-ins and other risky activities performed by the service principals in the tenant. The solution must minimize costs.What should you include in the recommendation? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one point.Hot Area:
Answer(s): A
Box 1: Microsoft Entra ID ProtectionServiceMicrosoft Entra ID Protection, Investigate riskMicrosoft Entra ID Protection provides organizations with reporting they can use to investigate identity risks in their environment. These reports includerisky users,risky sign-ins,risky workload identities, andrisk detections.Box 2: Microsoft Entra ID P2License typeMicrosoft Entra ID and Microsoft Entra Suite
https://learn.microsoft.com/en-us/entra/id-protection/howto-identity-protection-investigate-risk https://www.microsoft.com/en-us/security/business/microsoft-entra-pricing
HOTSPOTYou have a multicloud environment that contains an Azure subscription and an Amazon Web Services (AWS) subscription.You need to design a solution that meets the following requirements:Dynamically discovers the permissions granted to and used by each userGenerates an aggregated metric that evaluates the level of risk associated with the number of unused or excessive permissionsAutomatically revokes permissions that have been unused for 90 days Supports granting on-demand permissions for limited periods of time Minimizes administrative effortWhich cloud service should you use for each subscription? To answer, select the options in the answer area.Note: Each correct answer is worth one point.Hot Area:
Box 1: Privileged Identity Management (PIM) in Microsoft Entra ID AzurePrivileged Identity Management provides time-based and approval-based role activation to mitigate the risks of excessive, unnecessary, or misused access permissions on resources that you care about. Here are some of the key features of Privileged Identity Management:Provide just-in-time privileged access to Microsoft Entra ID and Azure resources Assign time-bound access to resources using start and end dates Require approval to activate privileged rolesEnforce multifactor authentication to activate any roleUse justification to understand why users activateGet notifications when privileged roles are activatedConduct access reviews to ensure users still need rolesDownload audit history for internal or external auditPrevents removal of the last active Global Administrator and Privileged Role Administrator role assignmentsBox 2: Microsoft Entra Permissions ManagementAWSMicrosoft Entra Permissions Management is a cloud infrastructure entitlement management (CIEM) solution that provides comprehensive visibility into permissions assigned to all identities (users and workloads), actions, and resources across cloud infrastructures. It detects, right-sizes, and monitors unused and excessive permissions and enables Zero Trust security through least privilege access in Microsoft Azure, Amazon Web Services (AWS), and Google Cloud Platform (GCP).Incorrect:* Microsoft Entra External IDMicrosoft Entra External ID combines powerful solutions for working with people outside of your organization. With External ID capabilities, you can allow external identities to securely access your apps and resources. Whether you're working with external partners, consumers, or business customers, users can bring their own identities. These identities can range from corporate or government-issued accounts to social identity providers like Google or Facebook.
https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-configure https://learn.microsoft.com/en-us/entra/permissions-management/
Your network contains an Active Directory Domain Services (AD DS) domain named Domain1.You have a Microsoft Entra tenant.Domain1 syncs with the tenant by using Microsoft Entra Connect.You need to monitor Domain1 for privilege escalation attacks.What should you use?
Answer(s): C
Defender for Identity is fully integrated with Microsoft Defender XDR, and leverages signals from both on- premises Active Directory and cloud identities to help you better identify, detect, and investigate advanced threats directed at your organization.Note: Detecting and preventing privilege escalation attacks leveraging Kerberos relaying (KrbRelayUp) Microsoft Defender for Identity detects activity from the early stages of the attack chain by monitoring anomalous behavior as seen by the domain controller.
https://learn.microsoft.com/en-us/defender-for-identity/what-is https://www.microsoft.com/en-us/security/blog/2022/05/25/detecting-and-preventing-privilege-escalation- attacks-leveraging-kerberos-relaying-krbrelayup/
You have an Azure subscription and an Azure DevOps organization.You need to recommend a solution for connecting Azure DevOps pipelines to the resources in the subscription by using Azure Resource Manager (ARM) service connections. The solution must align with Microsoft Cloud Adoption Framework for Azure best practices, including the principle of least privilege.What should you include in the recommendation?
An Azure Resource Manager service connection allows you to connect to Azure resources like Azure Key Vault from your pipeline. This connection lets you use a pipeline to deploy to Azure resources, such as an Azure App Service app, without needing to authenticate each time.You have multiple authentication options for connecting to Azure with an Azure Resource Manager service connection. We recommend using workload identity federation with either an app registration or managed identity. Workload identity federation eliminates the need for secrets and secret management.Recommended options:* App registration (automatic) with workload identity federation *-> Managed identity that creates a workload identity federation credential and connects to an existing user- assigned managed identity. Use this option when you don't have permission to create an app registration.* App registration or managed identity (manual) with workload identity federation or a secret. Manual configuration is more time consuming than the automatic configuration and should only be used if you've already tried to automatic option.
https://learn.microsoft.com/en-us/azure/devops/pipelines/library/connect-to-azure
HOTSPOTYou have an Azure subscription.You have a Microsoft 365 subscription.You need to assess regulatory compliance of the subscriptions. The solution must meet the following requirements:Identify whether data stored in Azure and Microsoft 365 complies with General Data Protection Regulation (GDPR) regulations.Identify whether Azure resources comply with National Institute of Standards and Technology (NIST) standards.Provide recommendations on controls to improve compliance.What should you use? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one point.Hot Area:
Box 1: Microsoft SentinelIdentify whether Azure resources comply with National Institute of Standards and Technology (NIST) standards.Announcing the Microsoft Sentinel: NIST SP 800-53 Solution [February 2022] The Microsoft Sentinel: NIST SP 800-53 Solution enables compliance teams, architects, security analysts, and consultants to understand their cloud security posture related to Special Publication (SP) 800-53 guidance issued by the National Institute of Standards and Technology (NIST). This solution is designed to augment staffing through automation, visibility, assessment, monitoring, and remediation. Content features include an intuitive user interface, policy-based assessments, control cards for guiding alignment with control requirements, alerting rules to monitor configuration drift, and playbook automations for response. The power of this solution lies in its ability to aggregate at big data scale across first- and third-party products to provide maximum visibility into cloud, hybrid, and multi-cloud workloads.Incorrect:* Microsoft Defender for Cloud* Microsoft Defender Vulnerability ManagementBox 2: Microsoft Purview Compliance ManagerIdentify whether data stored in Azure and Microsoft 365 complies with General Data Protection Regulation (GDPR) regulations.What is the Compliance Manager General Data Protection Regulation (GDPR) assessment? This is the official Microsoft tool that scans your tenant and compares it to the GDPR. It then provides a report and workflow on how to meet this regulation.Narrowing General Data Protection Regulation (GDPR) to applicable Purview toolsWe narrow the scope of All General Data Protection Regulation (GDPR) Control Families (5x) the Assessment runs to just the Compliance applicable GDPR Control Families (6x). Then we can take those tactical Control Families and leverage the applicable Microsoft Purview tools that, when applied, can help you meet these Control Families.Incorrect:* Microsoft Priva* Microsoft Purview Communication Compliance
https://techcommunity.microsoft.com/blog/microsoftsentinelblog/announcing-the-microsoft-sentinel-nist-sp- 800-53-solution/3381485https://techcommunity.microsoft.com/blog/healthcareandlifesciencesblog/microsoft-purview---compliance- score-part-5---gdpr/3639469
You have a Microsoft 365 subscription.You have an Azure subscription.You need to implement a Microsoft Purview communication compliance solution for Microsoft Teams and Yammer. The solution must meet the following requirements:Assign compliance policies to Microsoft 365 groups based on custom Microsoft Exchange Online attributes.Minimize the number of compliance policies.Minimize administrative effort.What should you include in the solution?
Adaptive scopesWhen you create a communication compliance policy or a policy for retention, you can create or add an adaptive scope for your policy. A single policy can have one or many adaptive scopes.An adaptive scope uses a query that you specify, so you can define the membership of users or groups included in that query. These dynamic queries run daily against the attributes or properties that you specify for the selected scope. You can use one or more adaptive scopes with a single policy.For example, you can assign different policy settings to users according to their department by using existing Microsoft Entra attributes without the administrative overhead of creating and maintaining groups for this purpose.Note: Advantages of using adaptive scopesThe advantages of using adaptive scopes include:No limits on the number of items per policy. Although adaptive policies are still subject to the maximum number of policies per tenant limitations, the more flexible configuration will likely result in far fewer policies.*-> More powerful targeting for your policies. For example, you can assign different settings to users according to their geographical location without the administrative overhead of creating and maintaining groups.* Query-based scopes provide resilience against business changes that might not be reliably reflected in group membership or external processes that rely on cross-department communication.A single policy can include locations for both Microsoft Teams and Viva Engage, whereas when you don't use an adaptive scope, each location requires its own policy.Support for Microsoft Entra administrative units.
https://learn.microsoft.com/en-us/purview/purview-adaptive-scopes
HOTSPOTYou have a Microsoft 365 E5 subscription.You plan to implement Microsoft Priva Subject Rights Requests for Microsoft 365 data.You need to streamline the creation and processing of subject rights requests. The solution must minimize development effort.What should you include in the solution? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one point.Hot Area:
Box 1: The Microsoft Graph APITo streamline creationPrivacy, Integrate and extend through Microsoft Graph API and Power Automate You can integrate Priva Subject Rights Requests for data within Microsoft 365 with your existing business processes and tools by using the Microsoft Graph Subject Rights Request API.Box 2: Microsoft Power AutomateTo streamline processingYou can also extend the automation capabilities of Subject Rights Requests by using built-in Power Automate flows for tasks such as setting calendar reminders and creating cases in ServiceNow.
https://learn.microsoft.com/en-us/privacy/priva/subject-rights-requests-automate
You have a Microsoft 365 subscription that uses Microsoft Defender XDR and Microsoft Purview.On a Microsoft SharePoint Online site, you have a file named File1 that has a sensitivity label applied.You need to recommend a solution that will reevaluate Conditional Access policies when a user downloads Filel from the SharePoint site.What should you include in the recommendation?
Conditional Access app control in Microsoft Defender for Cloud Apps Activities in Conditional Access app controlConditional Access app control uses access policies and session policies to monitor and control user app access and sessions in real time, across your organization.Each policy has conditions to define who (which user or group of users), what (which cloud apps), and where (which locations and networks) the policy is applied to. After you determine the conditions, route your users first to Defender for Cloud Apps. There, you can apply the access and session controls to help protect your data.Access and session policies include the following types of activities:* Require authentication contextReevaluate Microsoft Entra Conditional Access policies when a sensitive action occurs in the session, such as requiring multifactor authentication.* Etc.
https://learn.microsoft.com/en-us/defender-cloud-apps/proxy-intro-aad
Post your Comments and Discuss Microsoft SC-100 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the SC-100 content, but please register or login to continue.