You have a Microsoft 365 E5 subscription and an Azure subscription.You need to recommend a solution to enforce the Zero Trust principle of explicit verification for the subscriptions. The solution must be based on Zero Trust guidance in the Microsoft Cybersecurity Reference Architectures (MCRA).What should you include in the recommendation?
Answer(s): A
To enforce Zero Trust explicit subscription verification in Microsoft 365, focus on verifying users and devices before granting access, using Microsoft Entra ID for identity and access management and leveraging Conditional Access policies. This involves configuring authentication methods, managing device compliance, and enforcing access based on user roles and device health.In steps:1. Establish a strong identity foundation with Microsoft Entra ID:* Authentication and Authorization: Use strong authentication methods like Multi-Factor Authentication (MFA) and leverage Microsoft Entra ID as the policy decision point for access requests.*-> Conditional Access Policies: Implement Conditional Access policies that enforce device compliance (e.g., device encryption, password complexity), user roles, and other factors.* Least Privilege: Assign users the minimum necessary permissions to access resources.2. Manage and protect user devices3. Secure access to Microsoft 365 apps:*-> Conditional Access Policies for Cloud Apps: Configure Conditional Access policies for Microsoft 365 apps like Exchange, Teams, and SharePoint, and configure Microsoft Defender for Cloud Apps policies.* Just-in-Time and Just-Enough-Access4. Verify end-to-end encryption and use analytic
https://www.microsoft.com/insidetrack/blog/implementing-a-zero-trust-security-model-at-microsoft/
Your network contains an Active Directory Domain Services (AD DS) domain.You need to ensure that the built-in administrator account for the domain can be used only for interactive sign- ins to domain controllers.What should you configure?
Answer(s): C
To restrict the built-in domain administrator account to interactive sign-ins on domain controllers, you should configure a Group Policy Object (GPO) that modifies the "Deny access to this computer from the network" and "Deny log on through Remote Desktop Services" rights for the domain administrator account.1. Create a new Group Policy Object (GPO)2. Configure User Rights Assignments:Edit the newly created GPO.Navigate to: Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > User Rights Assignment.Deny access to this computer from the network:Double-click on this policy.Select "Define these policy settings" and click "Add User or Group".Add the domain administrator account (e.g., "DOMAIN\Administrator").Deny log on through Remote Desktop Services:Double-click on this policy.Select "Define these policy settings" and click "Add User or Group".Add the domain administrator account (e.g., "DOMAIN\Administrator"
https://www.google.com/url?sa=t&source=web&rct=j&opi=89978449&url=https://learn.microsoft.com/en-us/ windows-server/identity/ad-ds/plan/security-best-practices/appendix-d--securing-built-in-administrator- accounts-in-active-directory
HOTSPOTYou have a Microsoft 365 subscription that is protected by using Microsoft 365 Defender.You are designing a security operations strategy that will use Microsoft Sentinel to monitor events from Microsoft 365 and Microsoft 365 Defender.You need to recommend a solution to meet the following requirements:Integrate Microsoft Sentinel with a third-party security vendor to access information about known malware.Automatically generate incidents when the IP address of a command-and-control server is detected in the events.What should you configure in Microsoft Sentinel to meet each requirement? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one point.Hot Area:
Box 1: A threat Intelligence connectorIntegrate Microsoft Sentinel with a third-party security vendor to access information about known malware.To best integrate a third-party security vendor with Microsoft Sentinel and access information about known malware, utilize the built-in data connectors or APIs provided by the vendor within Microsoft Sentinel.* Identify and Choose a Data Connector or API:Microsoft Sentinel's Content Hub:Explore the Content hub within Microsoft Sentinel to find pre-built data connectors for various third-party security vendors. These connectors handle the complexities of data ingestion and parsing.Vendor Documentation:Refer to the documentation of your chosen third-party vendor for information on available APIs or data connectors that integrate with Microsoft Sentinel.* Connect your threat intelligence platform to Microsoft Sentinel Many organizations use threat intelligence platform (TIP) solutions to aggregate threat indicator feeds from various sources. From the aggregated feed, the data is curated to apply to security solutions such as network devices, EDR/XDR solutions, or SIEMs such as Microsoft Sentinel. The Threat Intelligence Platforms data connector allows you to use these solutions to import threat indicators into Microsoft Sentinel.Because the TIP data connector works with the Microsoft Graph Security tiIndicators API to accomplish this, you can use the connector to send indicators to Microsoft Sentinel (and to other Microsoft security solutions like Microsoft 365 Defender) from any other custom threat intelligence platform that can communicate with that API.Box 2: A playbookAutomatically generate incidents when the IP address of a command-and-control server is detected in the events.Sentinel, automatically check and record IP address reputation information in incidentsYou can use Microsoft Sentinel automation rules and playbooks to automatically check IP addresses in your incidents.
https://learn.microsoft.com/en-us/azure/sentinel/connect-threat-intelligence-tip https://learn.microsoft.com/en-us/azure/sentinel/tutorial-enrich-ip-information
HOTSPOTYou have a Microsoft 365 E5 subscription. The subscription contains 1,000 devices that run Windows 11 Pro and are enrolled in Microsoft Intune.You need to recommend a Microsoft Defender for Cloud Apps solution that meets the following requirements:When a user downloads a file from Microsoft SharePoint Online, a label must be applied to the file in real time based on the file's contents.Only users that use Intune-compliant devices must be able to sign in to Dropbox.Which type of policy should you recommend for each requirement? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one point.Hot Area:
Box 1: File policyWhen a user downloads a file from Microsoft SharePoint Online, a label must be applied to the file in real time based on the file's contents.It is possible to apply a sensitivity label to a file in real-time when it's downloaded from Microsoft SharePoint Online, based on the file's content. This can be achieved by using a combination of file policies in Microsoft Defender for Cloud Apps (formerly Cloud App Security) and sensitivity labels configured within Microsoft Purview Information Protection.Box 2: Access policyOnly users that use Intune-compliant devices must be able to sign in to Dropbox.It is possible to restrict Dropbox sign-ins to Intune-compliant devices using a combination of Intune and Microsoft Entra ID Conditional Access policies. This is achieved by configuring a Conditional Access policy that requires devices to be marked as compliant by Intune before granting access to Dropbox.
https://learn.microsoft.com/en-us/purview/sensitivity-labels-sharepoint-onedrive-files https://learn.microsoft.com/en-us/answers/questions/2115107/restricting-access-to-a-web-application-based- on-d
HOTSPOTYou have a Microsoft Entra tenant and an Azure subscription.You are evaluating the use of a risk-based Conditional Access policy to control the access of workload identities to resources.To which type of identity should you apply the policy, and which signal source can you use as part of the policy? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one point.Hot Area:
Box 1: Service principalIdentity typeFor controlling access of workload identities to resources with a risk-based Conditional Access policy in Microsoft Entra, the service principal identity type is the most suitable.Box 2: Microsoft Entra ID ProtectionSignal sourceFor risk-based Conditional Access policies in Microsoft Entra ID that control access for workload identities, the best signal source is Microsoft Entra ID Protection, specifically the service principal risk signals. This allows you to identify and respond to potentially risky service principals based on their behavior and activities.
https://learn.microsoft.com/en-us/entra/id-protection/howto-identity-protection-configure-risk-policies
HOTSPOTYou have a Microsoft Entra tenant. The tenant contains a security group named Group1. Group1 contains the members of your company's IT support team.You have an Azure subscription. The subscription contains 800 Windows devices that are Microsoft Entra joined and 200 Windows devices that are Microsoft Entra registered.You have 200 standalone macOS devices.You deploy 10 Windows devices that are Microsoft Entra joined and have the Microsoft Entra ExtensionAttribute1 value set to SecureWorkstation.You need to recommend a Conditional Access solution that meets the following requirements:Only allows access to Microsoft Entra resources from devices that run Windows 10 or Windows 11Restricts Windows Azure Service Management API access to the following users:- The members of Group1- Users that authenticate by using multifactor authentication (MFA)- Users that connect from a device that has the SecureWorkstation ExtensionAttribute1The solution must minimize the number of required policies and maximize security.What should include in the recommendation? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one point.Hot Area:
Box 1: 2Conditional Access policies* Only allows access to Microsoft Entra resources from devices that run Windows 10 or Windows 11Create one Conditional Access policy that uses one include device filter which includes only Windows 10 and Windows 11.* Restricts Windows Azure Service Management API access to the following users:The members of Group1Users that authenticate by using multifactor authentication (MFA) Users that connect from a device that has the SecureWorkstation ExtensionAttribute1Create a second Conditional Access policy that includes Group1, requires MFA, and one include device for devices that has the SecureWorkstation ExtensionAttribute1. Grant access to Windows Azure Service Management API.Box 2: Two include device filtersDevice filters
https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-condition-filters-for-devices
HOTSPOTYou have a Microsoft Entra tenant named contoso.com that syncs with an Active Directory Domain Services (AD DS) domain named corp.contoso.com The domain contains 100 devices that have the following configurations:Hybrid joinedEnrolled in Microsoft IntuneDisabled built-in local administrator accountContain a local user account named User1 that is a member of the local administrators groupYou need to recommend a solution that meets the following requirements:Ensures that the Directory Services Restore Mode (DSRM) credentials of each domain controller are backed up to the AD DS databaseEnsures that the password of User1 changes automatically every 60 daysEnsures that the credentials of User1 are stored in an encrypted storePrevents the User1 password from being changed manuallyWhenever possible, stores all credentials in contoso.comMinimizes administrative effortWhat should you include in the recommendation? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one point.Hot Area:
Box 1: Local Administrator Password Solution (Windows LAPS)For the User1 credentialsWindows Local Administrator Password Solution (Windows LAPS) is a Windows feature that automatically manages and backs up the password of a local administrator account on your Microsoft Entra-joined or Windows Server Active Directory-joined devices. You also can use Windows LAPS to automatically manage and back up the Directory Services Restore Mode (DSRM) account password on your Windows Server Active Directory domain controllers. An authorized administrator can retrieve the DSRM password and use it.Devices that are hybrid-joined (joined to both Microsoft Entra ID and Windows Server Active Directory) can back up their passwords either to Microsoft Entra ID or to Windows Server Active Directory.Box 2: Local Administrator Password Solution (Windows LAPS)For the DSRM credentialsKey Windows LAPS scenariosYou can use Windows LAPS for several primary scenarios:Back up local administrator account passwords to Microsoft Entra ID (for Microsoft Entra-joined devices)Back up local administrator account passwords to Windows Server Active Directory (for Windows Server Active Directory-joined clients and servers)*-> Back up DSRM account passwords to Windows Server Active Directory (for Windows Server Active Directory domain controllers) [Box 2]Back up local administrator account passwords to Windows Server Active Directory by using legacy Microsoft LAPSIn each scenario, you can apply different policy settings.Note: Directory Services Restore Mode (DSRM) is a special boot mode for Windows Server domain controllers, used primarily for emergency maintenance and recovery of the Active Directory database. It's similar to Safe Mode but specifically designed for Active Directory issues. In DSRM, Active Directory services don't run, allowing administrators to perform tasks like restoring backups, repairing the database, or recovering from corruption without interference from the normal AD processes.Incorrect:* Microsoft Entra Password ProtectionMicrosoft Entra Password Protection is a security feature designed to prevent users from setting weak or easily guessed passwords. It achieves this by using global and custom banned password lists to block passwords that are known to be vulnerable to attacks. This helps organizations enhance their security posture by reducing the risk of compromised accounts.* Microsoft Local Administrator Password Solution (Microsoft LAPS) The primary difference is that Windows LAPS is the built-in, modern successor to the legacy Microsoft LAPS, which was a separate download and installation. Windows LAPS is integrated into Windows and offers enhanced features and security, including password backup to both Active Directory and Microsoft Entra ID, password encryption, and password history.Here's a more detailed breakdown:Microsoft LAPS (Legacy):A separate download and installation package.Limited features and functionality compared to Windows LAPS.Deprecated on newer Windows versions.Managed passwords only in Active Directory.Windows LAPS:Built-in Windows feature, no separate installation required. Enhanced security features like password encryption and password history. Supports password backups to both Active Directory and Microsoft Entra ID. Emulation mode for easier migration from legacy Microsoft LAPS.Offers more granular control and management options.In essence, Windows LAPS provides a more modern, secure, and feature-rich solution for managing local administrator passwords compared to its predecessor. Organizations using legacy Microsoft LAPS are encouraged to migrate to Windows LAPS for better long-term support and enhanced capabilities.
https://learn.microsoft.com/en-us/windows-server/identity/laps/laps-overview
You have an Azure subscription that is linked to a Microsoft Entra tenant.You plan deploy an enterprise application named App1. App1 requires LDAP to look up attributes related to Microsoft Entra users.You need to recommend a solution to support the LDAP requirement.What should you recommend?
If an enterprise application in Microsoft Entra needs to use LDAP to look up user attributes, Microsoft Entra Domain Services (Microsoft Entra DS) is typically required. Microsoft Entra DS provides a managed domain with LDAP functionality, allowing applications to query for user attributes within the Microsoft Entra environment.Microsoft Entra ID (formerly Azure AD) does not natively support LDAP lookups for user attributes.It primarily focuses on cloud-based authentication and authorization using protocols like OAuth 2.0 and OpenID Connect.Microsoft Entra Domain Services bridges the gap.It's a managed service that provides a Windows Server Active Directory-compatible environment, including LDAP, Kerberos, and NTLM authentication.This allows legacy applications that rely on LDAP to integrate with Microsoft Entra.Organizations can migrate their applications and infrastructure to the cloud without needing to refactor them to use modern authentication protocols.
https://learn.microsoft.com/en-us/entra/architecture/auth-ldap
Post your Comments and Discuss Microsoft SC-100 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the SC-100 content, but please register or login to continue.