You have an on-premises server named Server1. Server1 is an FTP server that can be accessed by only the users at your company.You have an Azure subscription.You need to recommend a Zero Trust Network Access (ZTNA) solution to enforce Conditional Access policies when users access Server1 from the internet.What should you include in the recommendation?
Answer(s): C
To enforce Conditional Access for an on-premises FTP server accessed from the internet, you should integrate it with Microsoft Entra Private Access, install a Private Network Connector on your network, define the FTP server as an "Enterprise Application," and then create Conditional Access policies that target this application.This setup allows Microsoft Entra ID to enforce multi-factor authentication, device compliance, and other access controls before users can connect to your FTP server, providing a consistent security layer for your on- premises resources.
https://learn.microsoft.com/en-us/windows-server/identity/ad-fs/operations/configure-device-based-conditional- access-on-premises
Your network contains an on-premises Active Directory Domain Services (AD DS) domain named Domain1.Domain1 contains 10 domain controllers.You have an Azure subscription named Sub1 that contains a Microsoft Sentinel workspace named WS1.You have a Microsoft 365 subscription that contains 5,000 users. Each user is assigned a Microsoft 365 E3 license.You need to recommend a solution to ingest security logs from all the domain controllers into WS1. The solution must meet the following requirements:The cost of ingesting data into WS1 must be minimized.WS1 must ingest all the Windows Security event logs generated by the domain controllers.The solution must support the generation of approximately 350 MB of logs per day from each domain controller.What should you recommend?
Answer(s): A
Upgrading the user licenses to Microsoft 365 E5 is correct, as this action allows for cost-effective ingestion of the specified data.Microsoft 365 E5 licenses (and A5, F5, G5, or the equivalent Security add-ons) provide a data ingestion benefit for Microsoft Sentinel, which covers the cost of up to 5 MB of data ingestion per user per day for eligible Microsoft 365 data sources.Key Considerations:Eligible Data: The data grant applies to specific data sources, including Office 365 Audit Logs and alerts from Microsoft Defender products.On-premises AD Logs: While the E5 benefit covers some identity-related logs, ingesting raw security event logs directly from on-premises Active Directory Domain Controllers into a Log Analytics workspace for Microsoft Sentinel typically incurs standard Log Analytics and Sentinel ingestion charges.Minimizing Cost: Upgrading to E5 helps minimize costs for Microsoft 365-related data. For the on-premises AD logs, the cost of ingestion needs to be managed separately, potentially by leveraging the 500 MB per server, per day free ingestion if those domain controllers are covered by Microsoft Defender for Servers Plan 2, or by optimizing log collection and usingBasic Logs in Sentinel.Data Volume: The scenario specifies supporting 350 MB of daily logs. For thousands of users with E5 licenses, the collective 5MB/user/day grant might cover the 350MB requirement if the logs qualify under the E5 benefit and the data isn't from the raw on-premises source directly.Therefore, upgrading the licenses is a key part of the cost minimization strategy for eligible data sources within the Microsoft ecosystem when using Microsoft Sentinel.Incorrect:[Not B]onboarding each domain controller to Microsoft Defender for Servers Plan 2 is not the most cost-effective solution and is likely unnecessary given the specific requirements. The primary goal is to ingest all security logs into Microsoft Sentinel while minimizing cost and supporting 350 MB of daily logs.Here is a breakdown of why and the recommended approach:Cost: Microsoft Defender for Servers Plan 2 is priced per server, per month (approx. $14.60/server/month) and includes a 500 MB/server/day free data ingestion benefit for specific security data types into the Log Analytics workspace. While this benefit would cover the 350 MB daily limit, applying a per-server license to all domain controllers just for log ingestion is an expensive way to achieve this goal, especially as the number of domain controllers grows.[Not C]While Auxiliary logs are cost-effective for high-volume, low-value logs, they are not the appropriate solution for comprehensive, real-time security monitoring of critical Active Directory.Why Auxiliary Logs Are Not SuitablePurpose: Auxiliary logs are designed for verbose, low-touch data used primarily for auditing and long-term compliance, which doesn't require immediate analysis or frequent querying.Query Limitations: Queries on Auxiliary logs are slower and incur additional charges per GB scanned, making them inefficient for the frequent, real-time analysis needed for security operations (alerts, hunting, dashboards).Log Type Support: The standard SecurityEvent table (where Windows security logs are typically ingested) is not natively supported to be stored in the Auxiliary plan; it requires the Analytics plan.[Not D]A daily cap should be used as a safeguard against unexpected spikes in data volume that could lead to unplanned charges, not as a primary cost-control mechanism.Why a Volume Cap is Not the Correct SolutionData Loss: When the daily cap is reached, data collection stops for the rest of the day. This creates gaps in your security monitoring and you lose potentially critical events needed for investigation and threat detection.Operational Blind Spots: Stopping data collection impacts your ability to monitor resources, receive alerts, and maintain the health and functionality of dependent services.Billing for Excess Data: Some data collected beyond the precise cap level is still billed, especially if the workspace is receiving high rates of data.[Not E]You should not only ingest data from one domain controller into the Sentinel workspace. Doing so would create significant gaps in security visibility and analysis, as each DC processes authentication requests independently and does not replicate all security logs to others.To minimize cost while ensuring complete security coverage for your on-premises AD DS environment, you should ingest logs from all domain controllers.
https://azure.microsoft.com/en-us/pricing/offers/sentinel-microsoft-365-offer
Your company has an Azure subscription that uses Microsoft Defender for Cloud.The company signs a contract with the United States government.You need to review the current subscription for NIST 800-53 compliance.What should you do first?
For this question these are the correct answers:* From Azure Policy, assign a built-in initiative that has a scope of the subscription.* From Defender for Cloud, add a regulatory compliance standard.For this question these are the incorrect answers:* From Azure Policy, assign a built-in policy definition that has a scope of the subscription.* From Defender for Cloud, enable Defender for Cloud plans.* From Defender for Cloud, review the Azure security baseline for audit report.* From Defender for Cloud, review the secure score recommendations.* From Microsoft Defender for Cloud Apps, create an access policy for cloud applications.* From Microsoft Sentinel, configure the Microsoft Defender for Cloud data connector.Explanations for correct answers:* From Azure Policy, assign a built-in initiative that has a scope of the subscription.How are regulatory compliance standards represented in Defender for Cloud? Industry standards, regulatory standards, and benchmarks are represented in Defender for Cloud's regulatory compliance dashboard. Each standard is an initiative defined in Azure Policy.The Azure Policy Regulatory Compliance built-in initiative definition maps to compliance domains and controls in NIST SP 800-53 Rev. 5.The following mappings are to the NIST SP 800-53 Rev. 5 controls. Use the navigation on the right to jump directly to a specific compliance domain. Many of the controls are implemented with an Azure Policy initiative definition. To review the complete initiative definition, open Policy in the Azure portal and select the Definitions page. Then, find and select the NIST SP 800-53 Rev. 5 Regulatory Compliance built-in initiative definition.* From Defender for Cloud, add a regulatory compliance standard.Add a regulatory standard to your dashboardThe following steps explain how to add a package to monitor your compliance with one of the supported regulatory standards.Add a standard to your Azure resources1. From Defender for Cloud's menu, select Regulatory compliance to open the regulatory compliance dashboard. Here you can see the compliance standards currently assigned to the currently selected subscriptions.2. From the top of the page, select Manage compliance policies. The Policy Management page appears.3. Select the subscription or management group for which you want to manage the regulatory compliance posture.4. To add the standards relevant to your organization, expand the Industry & regulatory standards section and select Add more standards.5. From the Add regulatory compliance standards page, you can search for any of the available standards:6. Select Add and enter all the necessary details for the specific initiative such as scope, parameters, and remediation.7. From Defender for Cloud's menu, select Regulatory compliance again to go back to the regulatory compliance dashboard.Your new standard appears in your list of Industry & regulatory standards.Note: Customize the set of standards in your regulatory compliance dashboard.Microsoft Defender for Cloud continually compares the configuration of your resources with requirements in industry standards, regulations, and benchmarks. The regulatory compliance dashboard provides insights into your compliance posture based on how you're meeting specific compliance requirements.
https://docs.microsoft.com/en-us/azure/governance/policy/samples/gov-nist-sp-800-53-r5 https://docs.microsoft.com/en-us/azure/defender-for-cloud/update-regulatory-compliance-packages
HOTSPOTYou have a Microsoft Entra tenant named contoso.com that is linked to an Azure subscription named Sub1 and a Microsoft 365 subscription. Sub1 contains a publicly accessible Azure App Service web app named App1.You have an external partner that has a Microsoft Entra tenant named fabrikam.com.You need to recommend a solution that meets the following requirements:Ensures that the users in fabrikam.com can be granted permissions to specific Microsoft Teams channels in contoso.comEnsures that the users of App1 can authenticate by using social media accounts Minimizes administrative effortWhich authentication method should you recommend for each requirement? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one point.Hot Area:
Box 1: B2B Direct ConnectEnsures that the users in fabrikam.com can be granted permissions to specific Microsoft Teams channels in contoso.comTo allow users in an external Microsoft Entra tenant to be granted permissions to specific Microsoft Teams channels in your internal tenant, you should use a combination of Microsoft Entra B2B Direct Connect (for shared channels) or Guest Access (for private/standard channels).Given the goal is to access "specific" channels, B2B Direct Connect for Shared Channels is the modern, seamless approach, allowing external users to access your Teams channels without becoming guests in your directory.Phase 1: Configure Microsoft Entra Cross-Tenant Access (B2B Direct Connect)Phase 2: Set Up Shared Channels in TeamsBox 2: Microsoft Entra External ID for customersEnsures that the users of App1 can authenticate by using social media accountsMicrosoft Entra External ID for customers can be used to enable social media authentication for your Azure App Service web app.While your existing Microsoft Entra tenant (workforce tenant) manages your Azure and Microsoft 365 subscriptions, External ID allows you to create a separate external tenant specifically for consumer-facing or partner-facing applications.How it facilitates social media authentication:Supported Social Identity Providers: In an external tenant, you can enable sign-in with popular social accounts including Facebook, Google, and Apple.Simplified Integration: You can add External ID as an identity provider directly within the Azure App Service Authentication settings. This built-in integration automatically handles the redirect flows between your app and the external identity providers.User Flows: You create self-service sign-up user flows that define which social providers are available and what information to collect from users (e.g., name, country) during their first sign-in.Custom Branding: Even when using social logins, you can customize the look and feel of the sign-in pages to match your organization's branding.
https://learn.microsoft.com/en-us/microsoft-365/solutions/collaborate-teams-direct-connect https://learn.microsoft.com/en-us/entra/external-id/customers/concept-authentication-methods-customers
HOTSPOTYou have a Microsoft 365 subscription.You configure Microsoft Purview Information Protection to apply sensitivity labels automatically.You need to recommend a solution that will prevent users from uploading unlabeled files to Microsoft SharePoint Online if the files contain content defined by Microsoft Purview classifiers as sensitive.What should you include in the recommendation? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one point.Hot Area:
Box 1: Compliance policyPolicy type:Endpoint Data Loss Prevention (DLP) can and should be combined with compliance policies to protect sensitive data on devices (Windows, macOS). This integration allows organizations to enforce regulatory standards (e.g., GDPR, HIPAA) by monitoring and blocking actions--such as copying to USB or uploading to cloud apps--that violate compliance rules.Key Aspects of Combining Endpoint DLP with Compliance Policies:Unified Protection: Microsoft Purview Endpoint DLP enables auditing and management of user activities on devices, ensuring data remains secure even off-network.Policy Enforcement: Policies can be tailored to user groups and device types, restricting access to confidential information to meet compliance needs.Risk Mitigation: By integrating with tools like Endpoint Privilege Manager, organizations can restrict risky software and prevent data leakage.Automatic Protection: DLP policies use built-in templates to identify sensitive information (credit card numbers, health records) and automatically protect it.Endpoint DLP, therefore, acts as an enforcement arm of a broader data governance and compliance strategy.Box 2: Endpoint data loss prevention (Endpoint DLP)Microsoft 365 service:You can use Endpoint data loss prevention (DLP) to prevent users from uploading unlabeled files to Microsoft SharePoint Online if they contain sensitive content identified by Microsoft Purview classifiers. To implement this, you must configure a specific DLP policy targeted at devices and set up Service domains within your Endpoint DLP settings.
https://learn.microsoft.com/en-us/purview/endpoint-dlp-using
HOTSPOTYour company has offices in 10 countries.You have a Microsoft 365 subscription that contains 1,000 users. Each user is assigned a Microsoft 365 E5 license.You plan to deploy a compliance assessment solution. The solution must meet the following requirements:Ensure that compliance is assessed based on the regulations of the country of each office. Provide improvement action guidance to ensure compliance of the subscription.You need to recommend the service that should be used to perform the assessments, and identify additional costs that will be incurred.What should you recommend and what should you identify? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one point.Hot Area:
Box 1: Microsoft Purview Compliance ManagerUse:The Microsoft service to use for this scenario is Microsoft Purview Compliance Manager, which is included with the Microsoft 365 E5 license.Why Microsoft Purview Compliance Manager?Multi-Country/Regulatory Assessment: It provides over 320 pre-built regulatory templates (including GDPR, ISO, etc.) to assess compliance across different geographies and industry standards.Improvement Action Guidance: It provides actionable, step-by-step guidance on how to implement controls, assign tasks to teams, and upload evidence.Compliance Score: It calculates a risk-based score that quantifies your compliance posture, allowing you to prioritize the most impactful actions.Automated Monitoring: The service continuously scans your Microsoft 365 environment to update the status of technical controls.Box 2: Licenses for premium regulatory templatesAdditional costs:With a Microsoft 365 E5 license, there is generally no additional license cost for the base functionality of Microsoft Purview Compliance Manager, as it is included in the E5 suite.However, premium assessment templates for specialized regulations (e.g., GDPR, HIPAA) cost $500 per month (or $6,000 per year) per template, with E5 providing the first three free.Key Considerations for E5 Users:Included Value: E5 covers core compliance features, data loss prevention (DLP), and risk management.Premium Templates: While the Compliance Manager tool itself is included, the premium assessment templates used to automate compliance mapping for specific regulations are charged extra.
https://www.linkedin.com/pulse/microsoft-purview-compliance-manager-complete-guide-chandramohan-4zmic https://www.threatscape.com/cyber-security-blog/the-microsoft-365-e5-licence-explained
HOTSPOTYou have a Microsoft 365 E5 subscription.You need to recommend a security solution that meets the following requirements:Automatically identifies and stops external, brute force attacks against accounts in the subscription Automatically identifies and stops external attacks that use an internal account to exfiltrate data from Microsoft SharePoint Online sites in the subscriptionWhat should you include in the recommendation for each requirement? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one point.Hot Area:
Box 1: Microsoft Entra ID ProtectionAutomatically identifies and stops external, brute force attacks against accounts in the subscriptionTo automatically identify and stop external brute force attacks with a Microsoft 365 E5 subscription, you should leverage the following integrated tools and automated features:1. Enable Microsoft Entra ID Protection (formerly Azure AD)As an E5 subscriber, you have Entra ID Plan 2, which provides high-level automated identity defense. Sign-in Risk Policies: Set these to "High" or "Medium" risk. When an external brute force or password spray attempt is detected, the policy can automatically block access or require a secure Multi-Factor Authentication (MFA) challenge.User Risk Policies: If an account is likely compromised (e.g., credentials found on the dark web), this policy can automatically force a password reset.2. Configure Smart LockoutMicrosoft Entra ID has a built-in Smart Lockout feature that distinguishes between the legitimate user and an attacker.Box 2: Microsoft Defender for Cloud AppsAutomatically identifies and stops external attacks that use an internal account to exfiltrate data from Microsoft SharePoint Online sites in the subscriptionA Microsoft 365 E5 subscription provides the tools to automatically identify and remediate these threats. Specifically, Microsoft Defender for Cloud Apps acts as a Cloud Access Security Broker (CASB) to secure your environment.Key capabilities for protecting SharePoint Online include:Anomaly Detection Policies: These use machine learning to identify unusual behavior, such as a compromised internal account being used by an external attacker for mass data exfiltration.Automated Remediation: You can configure governance actions to automatically suspend the compromised account, require a password reset, or block the session when suspicious exfiltration is detected.Session Policies: Utilizing Conditional Access App Control, you can monitor and control SharePoint sessions in real-time, allowing you to block file downloads if the activity matches an exfiltration pattern.Integrated XDR: Signals from Microsoft Defender for Identity and Defender for Office 365 (both included in E5) correlate with Cloud App data to provide a holistic view of the attack path.
https://learn.microsoft.com/en-us/entra/identity/authentication/howto-password-smart-lockout https://learn.microsoft.com/en-us/defender-cloud-apps/protect-office-365
You have a Microsoft 365 subscription that uses Microsoft Purview.You need to recommend a solution that will provide guidance on how to ensure that Personally Identifiable Information (PII) in the subscription adheres to local privacy regulations. The solution must minimize administrative effort.Which Microsoft Purview solution should you include in the recommendation?
Microsoft Purview Data Loss Prevention (DLP) allows organizations to identify, monitor, and automatically protect sensitive Personally Identifiable Information (PII) across Microsoft 365 services (Teams, Exchange, SharePoint, OneDrive), endpoints, and apps. By creating policies to detect sensitive information types (e.g., social security numbers, credit cards), organizations can enforce compliance with local privacy regulations and prevent unauthorized sharing.To enforce Personally Identifiable Information (PII) compliance using Microsoft Purview Data Loss Prevention (DLP), you can leverage Microsoft Purview's predefined templates which are specifically tailored to meet local privacy regulations like GDPR, HIPAA, or PCI-DSS.
https://learn.microsoft.com/en-us/purview/dlp-create-deploy-policy
Post your Comments and Discuss Microsoft SC-100 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the SC-100 content, but please register or login to continue.