You have a Microsoft Entra tenant named contoso.onmicrosoft.com and an Azure subscription named Sub1.You need to implement Microsoft Entra Verified ID by using Quick Verified ID setup.What should you create first?
Answer(s): B
Microsoft Entra Verified ID, Quick Microsoft Entra Verified ID setup Prerequisites* You need the Authentication Policy Administrator permission for the directory you want to configure. If you need to perform app registration tasks, you'll also need the Application Administrator permission.*-> Ensure that you have a custom domain registered for the Microsoft Entra tenant. If you don't have one registered, the setup defaults to the advanced setup experience.Note: Managing custom domain names in your Microsoft Entra ID Set the primary domain name for your Microsoft Entra organization When your organization is created, the initial domain name, such as "contoso.onmicrosoft.com," is also the primary domain name. The primary domain is the default domain name for a new user when you create a new user. Setting a primary domain name streamlines the process for an administrator to create new users in the portal.
https://learn.microsoft.com/en-us/entra/verified-id/verifiable-credentials-configure-tenant-quick https://learn.microsoft.com/en-us/entra/identity/users/domains-manage
DRAG DROP (Drag and Drop is not supported)You have a Microsoft 365 subscription that contains a Microsoft SharePoint Online site named Site1.You have a Conditional Access policy named Policy1 that only allows workload identities from trusted locations to access SharePoint Online.You plan to move all business-sensitive information to Site1.You need to ensure that CAPolicy1 applies to Site1 only.Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.Note: More than one order of answer choices is correct. You will receive credit for any of the correct orders you select.Select and Place:
Answer(s): A
Conditional access policy for SharePoint sites and OneDriveWith Microsoft Entra authentication context, you can enforce more stringent access conditions when users access SharePoint sites.You can use authentication contexts to connect an Microsoft Entra Conditional Access policy to a SharePoint site. Policies can be applied directly to the site or via a sensitivity label.Step 1: For the Microsoft Entra tenant, create an authentication context.Setting up an authentication contextSetting up an authentication context for labeled sites requires these basic steps:1. Add an authentication context in Microsoft Entra ID. [Step 1]2. Create a conditional access policy that applies to that authentication context and has the conditions and access controls that you want to use. [Step 2]3. Do one of the following:3a. Set a sensitivity label to apply the authentication context to labeled sites. [Step 3] 3b. Apply the authentication context directly to a siteStep 2: Modify the conditions of Policy1.Step 3: Configure a sensitive label for Site.Set a sensitivity label to apply the authentication context to labeled sites If you want to use a sensitivity label to apply the authentication context, update a sensitivity label (or create a new one) to use the authentication context.
https://learn.microsoft.com/en-us/sharepoint/authentication-context-example
You have an Azure subscription that has Microsoft Defender for Cloud enabled.You are evaluating the Azure Security Benchmark V3 report as shown in the following exhibit.You need to verify whether Microsoft Defender for servers is installed on all the virtual machines that run Windows.Which compliance control should you evaluate?
Answer(s): D
Microsoft Defender for servers compliance control installed on Windows Defender for clout "Endpoint Security" azure security benchmark v3 Endpoint Security covers controls in endpoint detection and response, including use of endpoint detection and response (EDR) and anti-malware service for endpoints in Azure environments.Security Principle: Enable Endpoint Detection and Response (EDR) capabilities for VMs and integrate with SIEM and security operations processes.Azure Guidance: Azure Defender for servers (with Microsoft Defender for Endpoint integrated) provides EDR capability to prevent, detect, investigate, and respond to advanced threats.Use Microsoft Defender for Cloud to deploy Azure Defender for servers for your endpoint and integrate the alerts to your SIEM solution such as Azure Sentinel.Incorrect:Not A: Asset Management covers controls to ensure security visibility and governance over Azure resources, including recommendations on permissions for security personnel, security access to asset inventory, and managing approvals for services and resources (inventory, track, and correct).Not B: Posture and Vulnerability Management focuses on controls for assessing and improving Azure security posture, including vulnerability scanning, penetration testing and remediation, as well as security configuration tracking, reporting, and correction in Azure resources.Not C: Data Protection covers control of data protection at rest, in transit, and via authorized access mechanisms, including discover, classify, protect, and monitor sensitive data assets using access control, encryption, key and certificate management in Azure.Not E: Incident Response covers controls in incident response life cycle - preparation, detection and analysis, containment, and post-incident activities, including using Azure services such as Microsoft Defender for Cloud and Sentinel to automate the incident response process.
https://docs.microsoft.com/en-us/security/benchmark/azure/security-controls-v3-endpoint-security
HOTSPOTYou have a Microsoft 365 E5 subscription and an Azure subscription.You need to evaluate the existing environment to increase the overall security posture for the following components:Windows 11 devices managed by Microsoft IntuneAzure Storage accountsAzure virtual machinesWhat should you use to evaluate the components? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one point.Hot Area:
Box 1: Microsoft 365 DefenderThe Microsoft 365 Defender portal emphasizes quick access to information, simpler layouts, and bringing related information together for easier use. It includes Microsoft Defender for Endpoint.Microsoft Defender for Endpoint is an enterprise endpoint security platform designed to help enterprise networks prevent, detect, investigate, and respond to advanced threats.You can integrate Microsoft Defender for Endpoint with Microsoft Intune as a Mobile Threat Defense solution. Integration can help you prevent security breaches and limit the impact of breaches within an organization.Microsoft Defender for Endpoint works with devices that run:Android iOS/iPadOSWindows 10Windows 11Box 2: Microsoft Defender for CloudMicrosoft Defender for Cloud currently protects Azure Blobs, Azure Files and Azure Data Lake Storage Gen2resources. Microsoft Defender for SQL on Azure price applies to SQL servers on Azure SQL Database, Azure SQL Managed Instance and Azure Virtual Machines.Box 3: Microsoft 365 Compliance CenterAzure Storage Security Assessment: Microsoft 365 Compliance Center monitors and recommends encryption for Azure Storage, and within a few clicks customers can enable built-in encryption for their Azure Storage Accounts.Note: Microsoft 365 compliance is now called Microsoft Purview and the solutions within the compliance area have been rebranded.Microsoft Purview can be setup to manage policies for one or more Azure Storage accounts.
https://docs.microsoft.com/en-us/azure/purview/tutorial-data-owner-policies-storage https://docs.microsoft.com/en-us/microsoft-365/security/defender/microsoft-365-defender? https://docs.microsoft.com/en-us/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint https://azure.microsoft.com/en-gb/pricing/details/defender-for-cloud/
You have a Microsoft 365 subscription that contains a group named Group1. The subscription is linked to a Microsoft Entra ID P1 tenant.You have an external software as a service (SaaS) application named App1. App1 is managed by using a web- based admin portal and supports the use of Microsoft Entra ID credentials.You need to ensure that only the members of Group1 who sign in from Microsoft Entra joined devices can access the admin portal of App1.What should you create first in Microsoft Entra?
Answer(s): C
A Microsoft Entra Conditional Access policy can be configured to meet these requirements by defining conditions for specific user groups, requiring Entra-joined devices, and targeting a specific web-based admin portal. You would include the specific group in the policy's "Users or workload identities" assignment, select "Entra joined device" under device filters, and choose the specific web portal from the "Target resources" list.
https://learn.microsoft.com/en-us/entra/identity/conditional-access/overview
HOTSPOTYou have an Azure subscription.You need to create an Azure policy to ensure that all the resources in the subscription have tags assigned. The solution must ensure that the policy can remediate noncompliant resources automatically.How should you configure the policy? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one point.Hot Area:
Box 1: existenceConditionProperty to add a combination of the Azure Policy modify effect and a remediation task is the correct approach to ensure all resources in a subscription are tagged, and the existenceCondition property is a component of modify or auditIfNotExists policies, not typically for a simple modify policy that just adds a tag to the resource itself. To apply a tag to existing resources, you would assign the policy and then trigger a remediation task to update the non-compliant resources.Incorrect:* ConflictEffectThe ConflictEffect is a property for defining the behavior in case of conflicting policy definitions, not an effect itself, and it's not used for enforcing tags.Box 2: modifyEffect to useAzure Policy definitions modify effectThe modify effect is used to add, update, or remove properties or tags on a subscription or resource during creation or update. Existing non-compliant resources can also be remediated with a remediation task. Policy assignments with effect set as Modify require a managed identity to do remediation. A common example using modify effect is updating tags on resources such as 'costCenter'.A modify effect policy assignment, combined with a remediation task for existing resources, is the standard and effective method to enforce tagging and ensure all resources in your subscription have the required tags.Note: How it works:Policy Definition: You create a policy definition that targets resources and uses the modify effect to add a missing tag.modify effect: This effect automatically changes the resource during deployment or update operations when the specified conditions are met. For example, it can add a tag to a resource that is missing it.Remediation Task: For existing non-compliant resources that were not affected by the initial policy assignment, you can trigger a remediation task. This task runs the policy against the existing resources and applies the modify effect to bring them into compliance by adding the missing tag.existenceCondition: This property is used within the auditIfNotExists or deployIfNotExists effects to evaluate related or child resources to determine compliance, rather than the direct resource being tagged. It allows you to check if a specific related resource (like an extension on a VM) exists and meets certain criteria before deciding to audit or deploy. For simple tag modification of the resource itself, you typically wouldn't use existenceCondition.
https://learn.microsoft.com/en-us/azure/governance/policy/concepts/effect-modify
DRAG DROP (Drag and Drop is not supported)You have an Azure Storage account named storage1.You plan to secure storage1 by using a Bring Your Own Key (BYOK) strategy.You create an Azure key vault named AKV1 and upload a compatible key.You need to configure storage1 to use the key stored in AKV1 for encryption.Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.Select and Place:
Customer-managed keys for Azure Storage encryptionWith an Azure Storage account, an Azure key vault, and Customer-managed keys, how to define access policies?Step 1: Configure Azure Storage encryption with customer-managed keys. Configure customer-managed keys in the same tenant for an existing storage account Configure the key vaultYou can use a new or existing key vault to store customer-managed keys.Using customer-managed keys with Azure Storage encryption requires that both soft delete and purge protection be enabled for the key vault. Soft delete is enabled by default when you create a new key vault and cannot be disabled. You can enable purge protection either when you create the key vault or after it is created.To enable purge protection on an existing key vault, follow these steps:Navigate to your key vault in the Azure portal.Under Settings, choose Properties.In the Purge protection section, choose Enable purge protection.Step 2: Create and assign a Key Vault access policy.Azure Key Vault supports authorization with Azure RBAC via an Azure RBAC permission model. Microsoft recommends using the Azure RBAC permission model over key vault access policies.But here we use an access policy for the Key Vault.Step 3: Create a managed identity and assign it to AKV1.Add a key [Done]After creating a Key Vault [Done], add a key to the key vault. Before you add the key, make sure that you have assigned to yourself the Key Vault Crypto Officer role.Azure Storage encryption supports RSA and RSA-HSM keys of sizes 2048, 3072 and 4096.Choose a managed identity to authorize access to the key vault [Step 1] When you enable customer-managed keys for an existing storage account, you must specify a managed identity to be used to authorize access to the key vault that contains the key. The managed identity must have permissions to access the key in the key vault.Incorrect:* Create a managed identity and assign it to storage1.
https://learn.microsoft.com/en-us/azure/storage/common/customer-managed-keys-configure-existing-account
You have an Azure subscription that contains 15 custom apps. The source files for the apps are stored in Git repositories. The apps are deployed by using Azure DevOps.You need to recommend a DevSecOps solution to implement static application security testing (SAST) of the app code to identify hard-coded secrets.What should you include in the recommendation?
About GitHub Advanced Security productsGitHub has many features that help you improve and maintain the quality of your code. Some of these are included in all plans, such as dependency graph and Dependabot alerts.Other security features require you to purchase one of GitHub's Advanced Security products:*-> GitHub Secret Protection, which includes features that help you detect and prevent secret leaks, such as secret scanning and push protection.GitHub Code Security, which includes features that help you find and fix vulnerabilities, like code scanning, premium Dependabot features, and dependency review.Some of these features, such as code scanning and secret scanning, are enabled for public repositories by default. To run the feature on your private or internal repositories, you must purchase the relevant GitHub Advanced Security product.--Configure GitHub Advanced Security for Azure DevOpsYou can bring the protection of Advanced Security to your enterprise with the flexibility to enable the right level of protection for your repositories. GitHub Advanced Security for Azure DevOps is available as GitHub Secret Protection for Azure DevOps and GitHub Code Security for Azure DevOps.Secret Protection includes the following features:Push protection, to prevent secret leaks before they happen*-> Secret scanning alerts with notifications, to catch existing exposures before they become a problem Security overview, which provides insight into your organization's level of risk and security protection Code Security includes the following features:Dependency alerts, to find vulnerabilities in open-source dependencies CodeQL scanning, to detect vulnerabilities directly in your code Security findings for third-party toolsSecurity overview, which provides insight into your organization's level of risk and security protection GitHub Advanced Security for Azure DevOps is only available for Azure DevOps Services and specifically for code Git repositories.Incorrect:* Microsoft Defender for Cloud DevOps securityMicrosoft Defender for Cloud DevOps security is a component of Microsoft Defender for Cloud that shifts security left by providing unified visibility and management for DevOps environments and applications across multi-cloud platforms. It helps secure the entire software development lifecycle by scanning code for vulnerabilities and secrets, identifying open-source dependency risks, detecting infrastructure-as-code (IaC) misconfigurations, and providing security posture insights for DevOps platforms like GitHub and Azure DevOps. The goal is to help developers and security teams collaborate to identify and fix security flaws early in the development process before they reach production.
https://learn.microsoft.com/en-us/azure/devops/repos/security/configure-github-advanced-security-features https://docs.github.com/en/get-started/learning-about-github/about-github-advanced-security
Post your Comments and Discuss Microsoft SC-100 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the SC-100 content, but please register or login to continue.