You have a Microsoft 365 subscription.You have a Conditional Access policy that has the following settings:Name: Policy 1Assignments- Users:-- Include: All users- Target resources-- Include: Select apps; Office 365- Network-- Include: Any network or location-- Exclude: Selected networks and locations; Site1- Access controls-- Grant: Require multifactor authentication, Require Hybrid Microsoft Entra joined deviceYou plan to implement Zero Trust Rapid Modernization Plan (RaMP).You need to ensure that Policy1 aligns with best practice recommendations in RaMP.Which setting should you change?
Answer(s): B
Site1 should not be excluded.Incorrect:[Not A]The Include: Any network or location setting is fine. The access policy should be applied to all resources.[Not D]The Grant: Require multifactor authentication setting is fine. MFA should be required.Note:According to Microsoft's Zero Trust RaMP, Conditional Access best practices focus on Verify Explicitly, Least Privilege, and Assume Breach, requiring policies like MFA for all users, blocking legacy auth, enforcing device health, using risk-based rules, and testing in Report-Only mode before full enforcement to secure access to sensitive resources. Key actions include applying policies to All resources, minimizing policy count, using exclusions for emergency accounts (break-glass), and gradually implementing controls while communicating with users.
https://cyberhusky.io/blog/conditional-access-policy-best-practices/
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.You are designing the encryption standards for data at rest for an Azure resource.You need to provide recommendations to ensure that the data at rest is encrypted by using AES-256 keys. The solution must support rotating the encryption keys monthly.Solution: For blob containers in Azure Storage, you recommend encryption that uses customer-managed keys (CMKs).Does this meet the goal?
Answer(s): A
We need to use customer-managed keys.Azure Storage encryption for data at rest.Azure Storage uses service-side encryption (SSE) to automatically encrypt your data when it is persisted to the cloud. Azure Storage encryption protects your data and to help you to meet your organizational security and compliance commitments.Data in Azure Storage is encrypted and decrypted transparently using 256-bit AES encryption.Data in a new storage account is encrypted with Microsoft-managed keys by default. You can continue to rely on Microsoft-managed keys for the encryption of your data, or you can manage encryption with your own keys.If you choose to manage encryption with your own keys, you have two options. You can use either type of key management, or both:* You can specify a customer-managed key to use for encrypting and decrypting data in Blob Storage and in Azure Files.* You can specify a customer-provided key on Blob Storage operations. A client making a read or write request against Blob Storage can include an encryption key on the request for granular control over how blob data is encrypted and decrypted.Note: Automated key rotation in Key Vault allows users to configure Key Vault to automatically generate a new key version at a specified frequency. You can use rotation policy to configure rotation for each individual key.Our recommendation is to rotate encryption keys at least every two years to meet cryptographic best practices.This feature enables end-to-end zero-touch rotation for encryption at rest for Azure services with customer- managed key (CMK) stored in Azure Key Vault. Please refer to specific Azure service documentation to see if the service covers end-to-end rotation.
https://docs.microsoft.com/en-us/azure/storage/common/storage-service-encryption https://docs.microsoft.com/en-us/azure/key-vault/keys/how-to-configure-key-rotation
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.You are designing a security strategy for providing access to Azure App Service web apps through an Azure Front Door instance.You need to recommend a solution to ensure that the web apps only allow access through the Front Door instance.Solution: You recommend access restrictions to allow traffic from the backend IP address of the Front Door instance.Does this meet the goal?
Correct Solution: You recommend access restrictions based on HTTP headers that have the Front Door ID.Restrict access to a specific Azure Front Door instance.Traffic from Azure Front Door to your application originates from a well-known set of IP ranges defined in the AzureFrontDoor.Backend service tag. Using a service tag restriction rule, you can restrict traffic to only originate from Azure Front Door. To ensure traffic only originates from your specific instance, you will need to further filter the incoming requests based on the unique http header that Azure Front Door sends.
https://docs.microsoft.com/en-us/azure/app-service/app-service-ip-restrictions#managing-access-restriction-rules
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.You are designing a security strategy for providing access to Azure App Service web apps through an Azure Front Door instance.You need to recommend a solution to ensure that the web apps only allow access through the Front Door instance.Solution: You recommend access restrictions that allow traffic from the Front Door service tags.Does this meet the goal?
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.You are designing a security strategy for providing access to Azure App Service web apps through an Azure Front Door instance.You need to recommend a solution to ensure that the web apps only allow access through the Front Door instance.Solution: You recommend access restrictions based on HTTP headers that have the Front Door ID.Does this meet the goal?
Restrict access to a specific Azure Front Door instance.Traffic from Azure Front Door to your application originates from a well-known set of IP ranges defined in the AzureFrontDoor.Backend service tag. Using a service tag restriction rule, you can restrict traffic to only originate from Azure Front Door. To ensure traffic only originates from your specific instance, you will need to further filter the incoming requests based on the unique http header that Azure Front Door sends.
Your company is designing an application architecture for Azure App Service Environment (ASE) web apps as shown in the exhibit. (Click the Exhibit tab.)Communication between the on-premises network and Azure uses an ExpressRoute connection.You need to recommend a solution to ensure that the web apps can communicate with the on-premises application server. The solution must minimize the number of public IP addresses that are allowed to access the on-premises network.What should you include in the recommendation?
You are planning the security requirements for Azure Cosmos DB for NoSQL accounts.You need to recommend a solution to audit all users that access the data in the Azure Cosmos DB accounts.Which two configurations should you include in the recommendation? Each correct answer presents part of the solution.Note: Each correct selection is worth one point.
Answer(s): A,C
You have an Azure subscription that contains several storage accounts. The storage accounts are accessed by legacy applications that are authenticated by using access keys.You need to recommend a solution to prevent new applications from obtaining the access keys of the storage accounts. The solution must minimize the impact on the legacy applications.What should you include in the recommendation?
A read-only lock on a storage account prevents users from listing the account keys. A POST request handles the Azure Storage List Keys operation to protect access to the account keys. The account keys provide complete access to data in the storage account.Incorrect:Not A:If any clients are currently accessing data in your storage account with Shared Key, then Microsoft recommends that you migrate those clients to Microsoft Entra ID before disallowing Shared Key access to the storage account.However, in this scenario we cannot migrate to Microsoft Entra ID due to the legacy applications.Note: Shared KeyA shared key is a very long string. You can simply access Azure storage by using this long string. It's almost like a password. Actually, it's worse: this is a master password. It gives you all sorts of rights on the Azure storage account. You can imagine why this isn't my favorite mechanism of accessing Azure storage. What happens when this key is compromised? You don't get an alert. Perhaps you can set up monitoring to see misuse of your Azure storage account. But it's still less than an ideal situation. Alerts will tell you of damage after it has already occurred.Not C: Data breaches caused by cloud misconfiguration have been seen for the past few years. One of the most common misconfigurations is granting public access to cloud storage service. Such a data is often unprotected, making them to be accessed without any authentication method. Microsoft recently introduced a new protection feature to help avoid public access on storage account. The feature introduces a new property named allowBlobPublicAccess.Not D: Key rotation would improve security.Automated key rotation in Key Vault allows users to configure Key Vault to automatically generate a new key version at a specified frequency.You can use rotation policy to configure rotation for each individual key. Our recommendation is to rotate encryption keys at least every two years to meet cryptographic best practices.This feature enables end-to-end zero-touch rotation for encryption at rest for Azure services with customer- managed key (CMK) stored in Azure Key Vault.
https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/lock-resources https://docs.microsoft.com/en-us/azure/storage/common/shared-key-authorization-prevent https://docs.microsoft.com/en-us/azure/key-vault/keys/how-to-configure-key-rotation
Post your Comments and Discuss Microsoft SC-100 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the SC-100 content, but please register or login to continue.