Your on-premises network contains an Active Directory Domain Services (AD DS) domain. The domain contains 500 Windows 11 devices.You have a Microsoft 365 subscription and an Azure subscription.You have a Microsoft Entra tenant that syncs with the domain and is linked to the subscriptions. The devices are Microsoft Entra hybrid joined.You plan to deploy a solution to mitigate attacks against privileged accounts. The solution will include Microsoft Sentinel rules that will detect attempts to use fake cached credentials.You need to recommend a solution to create the fake cached credentials on client computers.What should you recommend?
Answer(s): D
In your Microsoft Entra hybrid environment, you can create fake cached credentials on Windows 11 client computers by leveraging Microsoft Sentinel Deception capabilities and Microsoft Defender for Identity. These decoys, or "honeytokens," are designed to trigger high-fidelity alerts when attackers attempt to harvest or use them.Steps to Implement Fake Cached CredentialsCreate Honeytoken Accounts: First, create standard user accounts in your on-premises Active Directory Domain Services (AD DS). Give them enticing names like svc-backup-admin or sql-admin-dev.*-> Tag as Honeytokens: Use Microsoft Defender for Identity to tag these accounts as Honeytokens. This ensures that any authentication attempt against these accounts triggers an immediate alert.Inject Fake Credentials via GPO or Script: To place these "cached" credentials on the Windows 11 devices, use a Group Policy Object (GPO) or an endpoint management tool like Microsoft Intune to run a script on client computers.
https://danielchronlund.com/2023/08/01/microsoft-entra-id-honeypot-accounts-with-microsoft-sentinel/
You have an Azure subscription and a Microsoft 365 subscription. All users are assigned Microsoft 365 E5 licenses. All computers run Windows 11 and are Microsoft Entra joined.You need to recommend a solution to prevent computers that run early builds of Windows 11 from connecting to Microsoft 365 services.Which two types of policies should you include in the recommendation? Each correct answer presents part of the solution.Note: Each correct selection is worth one point.
Answer(s): C,E
Using a Microsoft Intune compliance policy combined with a Microsoft Entra Conditional access policy is the correct for this scenario, a standard approach for this requirement. The compliance policy defines the minimum OS version allowed, while the Conditional Access (CA) policy restricts access to M365 services for non- compliant devices.Actionable Steps:Intune Compliance Policy: Create a Windows compliance policy in Intune, setting the "Minimum OS version" to the desired build number.Assign Policy: Assign this policy to all Windows 11 devices.Entra CA Policy: Create a Conditional Access policy targeting cloud apps (Microsoft 365) and require that devices be marked as compliant.Result: Devices on earlier builds will fail compliance, and the CA policy will block their access to M365.Given the E5 licenses, you have full access to these features.
https://learn.microsoft.com/en-ie/answers/questions/1863509/our-organization-has-e5-licenses-and-intune- instal
HOTSPOTYou have a Microsoft 365 E5 subscription that uses Microsoft Defender XDR and Microsoft Purview.You need to recommend a data protection solution. The solution must ensure that you can identify users that download atypical amounts of data from Microsoft SharePoint Online.Which service should you include in the recommendation, and which policy should be configured? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one point.Hot Area:
Answer(s): A
Box 1: Microsoft Defender for Cloud AppsServiceTo identify users downloading atypical amounts of data from Microsoft SharePoint Online, you should use Microsoft Defender for Cloud Apps (a component of Microsoft Defender XDR). 1.1.1Box 2: An anomaly detection policyPolicyTo identify users who download atypical amounts of data from Microsoft SharePoint Online, the best service to use is Microsoft Defender for Cloud Apps (MDCA), specifically by leveraging its anomaly detection policies.
https://learn.microsoft.com/en-us/defender-cloud-apps/anomaly-detection-policy
You need to recommend a strategy for routing internet-bound traffic from the landing zones. The solution must meet the landing zone requirements.What should you recommend as part of the landing zone deployment?
Answer(s): C
Service chaining.Service chaining enables you to direct traffic from one virtual network to a virtual appliance or gateway in a peered network through user-defined routes.You can deploy hub-and-spoke networks, where the hub virtual network hosts infrastructure components such as a network virtual appliance or VPN gateway. All the spoke virtual networks can then peer with the hub virtual network. Traffic flows through network virtual appliances or VPN gateways in the hub virtual network.Virtual network peering enables the next hop in a user-defined route to be the IP address of a virtual machine in the peered virtual network, or a VPN gateway. You can't route between virtual networks with a user-defined route that specifies an Azure ExpressRoute gateway as the next hop type.Incorrect:Not B: Forced tunneling lets you redirect or "force" all Internet-bound traffic back to your on-premises location via a Site-to-Site VPN tunnel for inspection and auditing. This is a critical security requirement for most enterprise IT policies. If you don't configure forced tunneling, Internet-bound traffic from your VMs in Azure always traverses from the Azure network infrastructure directly out to the Internet, without the option to allow you to inspect or audit the traffic. Unauthorized Internet access can potentially lead to information disclosure or other types of security breaches.ExpressRoute forced tunneling is not configured via this mechanism, but instead, is enabled by advertising a default route via the ExpressRoute BGP peering sessions.Note:Requirements. Planned ChangesLitware plans to implement the following changes:Design a landing zone strategy to refactor the existing Azure environment of Litware and deploy all future Azure workloads.Requirements. Azure Landing Zone RequirementsLitware identifies the following landing zone requirements:· Route all internet-bound traffic from landing zones through Azure Firewall in a dedicated Azure subscription.· Provide a secure score scoped to the landing zone.· Ensure that the Azure virtual machines in each landing zone communicate with Azure App Service web apps in the same zone over the Microsoft backbone network, rather than over public endpoints.· Minimize the possibility of data exfiltration.· Maximize network bandwidth.The landing zone architecture will include the dedicated subscription, which will serve as the hub for internet and hybrid connectivity. Each landing zone will have the following characteristics:· Be created in a dedicated subscription.· Use a DNS namespace of litware.com.
https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-peering-overview#service- chaining https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-forced-tunneling-rm
HOTSPOTYou need to recommend a strategy for App Service web app connectivity. The solution must meet the landing zone requirements.What should you recommend? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one point.Hot Area:
Box 1: Virtual network integrationIntegrate your app with an Azure virtual network.With Azure virtual networks, you can place many of your Azure resources in a non-internet-routable network. The App Service virtual network integration feature enables your apps to access resources in or through a virtual network.Box 2: Private endpointsEnsure that the Azure virtual machines in each landing zone communicate with Azure App Service web apps in the same zone over the Microsoft backbone network, rather than over public endpoints.A virtual machine can connect to the web app across the private endpoint.
https://docs.microsoft.com/en-us/azure/app-service/overview-vnet-integration https://docs.microsoft.com/en-us/azure/private-link/tutorial-private-endpoint-webapp-portal
HOTSPOTYou need to recommend an identity security solution for the Microsoft Entra tenant of Litware. The solution must meet the identity requirements and the regulatory compliance requirements.What should you recommend? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one point.Hot Area:
Box 1: Microsoft Entra administrative unitsImplement delegated management of users and groups in the Microsoft Entra tenant of Litware, including support for:* The delegation of user management based on business unitsWithout Microsoft Entra administrative units, assigning a user to the User Administrator role in Microsoft Entra ID gives them rights to manage all Microsoft Entra users. With administrative units, the user is delegated the same role, User Administrator, but that role only applies to the specified administrative unit. The administrative unit contains the users and groups that are under the scope of management.Box 2: Enable password hash synchronization in the Microsoft Entra Connect deploymentExisting environment: Microsoft Entra Connect is used to implement pass-through authentication.
https://4sysops.com/archives/an-introduction-to-azure-ad-administrative-units/ https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/concept-identity-protection- risks#password-hash-synchronization
HOTSPOTYou are evaluating the security of ClaimsApp.For each of the following statements, select Yes if the statement is true. Otherwise, select No.Note: Each correct selection is worth one point.Hot Area:
Box 1: NoBox 2: YesUsers will connect to ClaimsApp by using a URL of https://claims.fabrikam.com.Need certificate for HTTPS.TLS/SSL certificatesTo enable the HTTPS protocol for securely delivering content on a Front Door custom domain, you must use a TLS/SSL certificate. You can choose to use a certificate that is managed by Azure Front Door or use your own certificate.Box 3: YesBy default, Azure Front Door will respond to all user requests regardless of the location where the request is coming from. In some scenarios, you may want to restrict the access to your web application by countries/ regions. The Web application firewall (WAF) service in Front Door enables you to define a policy using custom access rules for a specific path on your endpoint to either allow or block access from specified countries/ regions.Note: Requirements. Security RequirementsFabrikam identifies the following security requirements:· Internet-accessible applications must prevent connections that originate in North Korea.
https://techcommunity.microsoft.com/t5/azure-architecture-blog/permit-access-only-from-azure- front-door-to-azure-app-service-as/ba-p/2000173https://docs.microsoft.com/en-us/azure/frontdoor/front-door-custom-domain-https#tlsssl-certificates
You need to recommend a solution to scan the application code. The solution must meet the application development requirements.What should you include in the recommendation?
Requirements. Application Development RequirementsFabrikam identifies the following requirements for application development:* All the application code must be stored in GitHub Enterprise.* All application code changes must be scanned for security vulnerabilities, including application code or configuration files that contain secrets in clear text. Scanning must be done at the time the code is pushed to a repository.A GitHub Advanced Security license provides the following additional features:Code scanning - Search for potential security vulnerabilities and coding errors in your code.Secret scanning - Detect secrets, for example keys and tokens, that have been checked into the repository. If push protection is enabled, also detects secrets when they are pushed to your repository.Dependency review - Show the full impact of changes to dependencies and see details of any vulnerable versions before you merge a pull request.Security overview - Review the security configuration and alerts for an organization and identify the repositories at greatest risk.Incorrect:Not C:Scenario: Azure DevTest labs will be used by developers for testing.Azure DevTest Labs is a service for easily creating, using, and managing infrastructure-as-a-service (IaaS) virtual machines (VMs) and platform-as-a-service (PaaS) environments in labs. Labs offer preconfigured bases and artifacts for creating VMs, and Azure Resource Manager (ARM) templates for creating environments like Azure Web Apps or SharePoint farms.Lab owners can create preconfigured VMs that have tools and software lab users need. Lab users can claim preconfigured VMs, or create and configure their own VMs and environments. Lab policies and other methods track and control lab usage and costs.
https://docs.github.com/en/enterprise-cloud@latest/get-started/learning-about-github/about-github- advanced-securityDesign security for infrastructureQuestion Set 3
Post your Comments and Discuss Microsoft SC-100 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the SC-100 content, but please register or login to continue.