QUESTION: 18

Your company has the virtual machine infrastructure shown in the following table.
The company plans to use Microsoft Azure Backup Server (MABS) to back up the virtual machines to Azure.
You need to provide recommendations to increase the resiliency of the backup strategy to mitigate attacks such as ransomware.
What should you include in the recommendation?

Use geo-redundant storage (GRS).
Maintain multiple copies of the virtual machines.
Encrypt the backups by using customer-managed keys (CMKS).
Require PINs to disable backups.

Answer(s): D

Explanation:

Azure Backup
Checks have been added to make sure only valid users can perform various operations. These include adding an extra layer of authentication. As part of adding an extra layer of authentication for critical operations, you're prompted to enter a security PIN before modifying online backups.
Authentication to perform critical operations
As part of adding an extra layer of authentication for critical operations, you're prompted to enter a security PIN when you perform Stop Protection with Delete data and Change Passphrase operations.

Reference:

https://docs.microsoft.com/en-us/azure/security/fundamentals/backup-plan-to-protect-against-ransomware https://docs.microsoft.com/en-us/azure/backup/backup-azure-security-feature#prevent-attacks

Reveal Solution Next Question

QUESTION: 18

HOTSPOT (Drag and Drop is not supported)
You are planning the security levels for a security access strategy.
You need to identify which job roles to configure at which security levels. The solution must meet security best practices of the Microsoft Cybersecurity Reference Architectures (MCRA).
Which security level should you configure for each job role? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

See Explanation section for answer.

Answer(s): A

Explanation:

Reveal Solution Next Question

QUESTION: 18

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have an Azure subscription that has Microsoft Defender for Cloud enabled.
You are evaluating the Azure Security Benchmark V3 report.
In the Secure management ports controls, you discover that you have 0 out of a potential 8 points.
You need to recommend configurations to increase the score of the Secure management ports controls.
Solution: You recommend enabling adaptive network hardening.
Does this meet the goal?

Yes
No

Answer(s): B

Explanation:

Instead: You recommend enabling just-in-time (JIT) VM access on all virtual machines.
Note:
Secure management ports - Brute force attacks often target management ports. Use these recommendations to reduce your exposure with tools like just-in-time
VM access and network security groups.
Recommendations:
- Internet-facing virtual machines should be protected with network security groups
- Management ports of virtual machines should be protected with just-in-time network access control
- Management ports should be closed on your virtual machines

Reference:

https://docs.microsoft.com/en-us/azure/defender-for-cloud/secure-score-security-controls

Reveal Solution Next Question

QUESTION: 19

Your company has a hybrid cloud infrastructure that contains an on-premises Active Directory Domain Services (AD DS) forest, a Microsoft 365 subscription, and an Azure subscription.
The company's on-premises network contains internal web apps that use Kerberos authentication. Currently, the web apps are accessible only from the network.
You have remote users who have personal devices that run Windows 11.
You need to recommend a solution to provide the remote users with the ability to access the web apps. The solution must meet the following requirements:
-Prevent the remote users from accessing any other resources on the network.
-Support Azure Active Directory (Azure AD) Conditional Access.
-Simplify the end-user experience.
What should you include in the recommendation?

Azure AD Application Proxy
web content filtering in Microsoft Defender for Endpoint
Microsoft Tunnel
Azure Virtual WAN

Answer(s): A

Explanation:

Azure Active Directory's Application Proxy provides secure remote access to on-premises web applications. After a single sign-on to Azure AD, users can access both cloud and on-premises applications through an external URL or an internal application portal.
Azure AD Application Proxy is:
Secure. On-premises applications can use Azure's authorization controls and security analytics. For example, on-premises applications can use Conditional
Access and two-step verification. Application Proxy doesn't require you to open inbound connections through your firewall.
Simple to use. Users can access your on-premises applications the same way they access Microsoft 365 and other SaaS apps integrated with Azure AD. You don't need to change or update your applications to work with Application Proxy.
Incorrect:
Not D: Azure Virtual WAN
Azure Virtual WAN is for end users, not for applications.
Note: Azure Virtual WAN is a networking service that brings many networking, security, and routing functionalities together to provide a single operational interface. Some of the main features include:
Branch connectivity (via connectivity automation from Virtual WAN Partner devices such as SD-WAN or VPN CPE).
Site-to-site VPN connectivity.
Remote user VPN connectivity (point-to-site).
Private connectivity (ExpressRoute).
Intra-cloud connectivity (transitive connectivity for virtual networks).
VPN ExpressRoute inter-connectivity.
Routing, Azure Firewall, and encryption for private connectivity.

Reference:

https://docs.microsoft.com/en-us/azure/active-directory/app-proxy/application-proxy

Reveal Solution Next Question

Free SC-100 Exam Braindumps (page: 27)

QUESTION: 18

Explanation:

Reference:

QUESTION: 18

Explanation:

QUESTION: 18

Explanation:

Reference:

QUESTION: 19

Explanation:

Reference:

SC-100 Discussions & Posts