DRAG DROP (Drag and Drop is not supported)You have an Azure environment that contains multiple workloads deployed across multiple subscriptions.You need to recommend a solution to assess and improve the security posture of the workloads. The solution must meet the following requirements:Use the Microsoft Cloud Adoption Framework for Azure to evaluate compliance with cloud governance policies.Use the Azure Well-Architected Framework to secure individual workloads.What should you include in the recommendation for each requirement? To answer, drag the appropriate recommendations to the correct requirements. Each recommendation may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.Note: Each correct selection is worth one point.Select and Place:
Answer(s): A
Box 1: Microsoft Defender for CloudUse the Microsoft Cloud Adoption Framework for Azure to evaluate compliance with cloud governance policies.Microsoft Cloud Adoption Framework for AzureTo evaluate compliance with cloud governance policies in Azure when using the Microsoft Cloud Adoption Framework (CAF), you should use Azure Policy and Microsoft Defender for Cloud. Azure Policy enforces your defined rules on resources and provides a compliance dashboard, while Defender for Cloud offers a unified view of security and security recommendations to help meet compliance standards.Enhance with Microsoft Defender for Cloud:Use Defender for Cloud to gain a unified view of security posture across your workloads. It provides actionable recommendations to fix security issues, helping to improve your compliance with security standards and regulations.Box 2: Microsoft Defender VulnerabilityUse the Azure Well-Architected Framework to secure individual workloads.Microsoft Defender Vulnerability Management (a component of Microsoft Defender for Cloud) is used to secure workloads on Azure by identifying, prioritizing, and helping to remediate vulnerabilities, directly aligning with the Security pillar of the Azure Well-Architected Framework. The framework provides a holistic guidance structure, and Defender Vulnerability Management provides a practical tool for implementing security best practices to protect individual workloads and critical assets.
https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ready/azure-setup-guide/govern-org- compliance
You are designing a ransomware mitigation strategy.You perform a ransomware risk assessment and identify business-critical assets.You need to recommend a solution to mitigate ransomware threats. The solution must follow Microsoft security best practices.Which two actions should you include in the recommendation? Each correct answer presents a complete solution.Note: Each correct answer is worth one point.
Answer(s): C,D
[C]Prepare for a RecoveryAssume that a breach can happen and plan how to restore your operations without paying a ransom.- Implement a robust backup strategy: Use Azure Backup to automatically back up critical data and systems (VMs, SQL databases, file shares) on a regular schedule- *-> Protect your backups: Ensure backups are isolated from production environments and protected from deletion or tampering using:*-> Immutable storage: Store business-critical data using Write Once, Read Many (WORM) storage, which cannot be modified or deleted until its expiry date.Soft delete: Enable soft delete to retain deleted backup data for an additional 14-180 days, allowing recovery even if a malicious actor deletes the primary backup.Multi-user authorization (MUA): Enforce MUA using a separate Resource Guard to require multiple approvals for critical operations like disabling soft delete, adding an extra layer of security against a compromised single account.*-> Offline copies: Follow the 3-2-1 rule: keep three copies of important files, on two different media types, with one copy stored offsite or offline.[D]Limit the Scope of Damage (Zero Trust Principles)Minimize the attacker's ability to move laterally and access critical systems if they gain initial access by adopting a Zero Trust strategy.Enforce strong identity and access controls:Multi-factor authentication (MFA): Mandate MFA for all users, especially administrators, as it can prevent 99.9% of attacks on accounts.Principle of Least Privilege: Use Azure Role-Based Access Control (RBAC) to grant users and applications only the permissions they need for specific tasks.*-> Privileged Identity Management (PIM): Implement PIM to provide time-bound, approval-based "Just-In- Time" (JIT) access for privileged roles, minimizing the window of opportunity for an attacker to misuse high- level credentials.Segment the network: Isolate critical resources in separate virtual networks and use Network Security Groups (NSGs) or Azure Firewall to restrict inbound and outbound traffic to only what is necessary for operations.Secure management access: Avoid public RDP/SSH access. Use Azure Bastion to securely connect to VMs over SSL without exposing public IP addresses.
https://www.microsoft.com/en-us/security/blog/2021/09/07/3-steps-to-prevent-and-recover-from-ransomware/
HOTSPOTYou are designing new Azure applications based on security best practices from the Microsoft Cloud Adoption Framework for Azure. Each application will be deployed to a dedicated and secure environment that will contain isolated instances of the following key Azure security resources:Azure Key VaultVirtual networksAn Azure subscriptionAzure Policy assignmentsNetwork security groups (NSGs)Role-based access control (RBAC) assignmentsYou need to recommend which type of environment and which module to use to deploy the applications. The solution must use infrastructure as code (IaC) to deploy each application environment.What should you recommend? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one point.Hot Area:
Box 1: Landing zoneEnvironment typeA landing zone in the Microsoft Cloud Adoption Framework (CAF) for Azure is a dedicated environment that includes foundational infrastructure components to host applications and resources. It is designed to be secure, compliant, and scalable. The resources listed are core components and best practices for establishing an Azure landing zone:Azure Key Vault: Used for secure storage and management of cryptographic keys, secrets, and certificates, a key aspect of secure landing zones.Virtual networks: Provide the fundamental network infrastructure, allowing for secure and isolated connectivity within the Azure environment, often connected to a central hub network via peering in a landing zone architecture.An Azure subscription: Landing zones are provisioned within one or more Azure subscriptions, which act as the primary boundary for governance and billing.Azure Policy assignments: Used to enforce organizational standards and assess compliance at scale across the landing zone and its resources.Network security groups (NSGs): Act as a virtual firewall to filter network traffic to and from Azure resources within the virtual networks of the landing zone.Role-based access control (RBAC): Provides granular access management, ensuring users have only the necessary permissions within the landing zone environment.Box 2: Azure Resource Manager (ARM) or BicepModuleAzure Bicep and Azure Resource Manager (ARM) are often preferred over Terraform for organizations exclusively using Microsoft Azure due to their native integration and lower operational overhead.While Terraform remains a leading choice for multi-cloud environments, Bicep provides specific advantages for managing resources like Key Vault, Virtual Networks, and RBAC:Key Reasons for Preferring Bicep/ARMZero State Management: Unlike Terraform, which requires securing and managing a .tfstate file, Bicep is stateless. It relies on Azure's backend to track resource states, eliminating risks of state corruption or the need for remote state locking.Day-Zero Support: As a native Microsoft tool, Bicep supports new Azure features and API versions immediately upon release. Terraform's AzureRM provider may experience slight delays before new resource types or properties are supported.Deep Portal Integration: Bicep allows you to export existing resources directly from the Azure portal into templates, a feature not natively available for Terraform.Native Security & Governance: Bicep integrates seamlessly with Azure Policy for "preflight" checks, validating that resources (like NSGs or RBAC assignments) comply with organizational policies before deployment. Terraform typically identifies these violations only after a deployment fails.
https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ready/landing-zone/design-area/identity- access-landing-zones https://learn.microsoft.com/en-us/azure/developer/terraform/comparing-terraform-and-bicep
HOTSPOTYou plan to implement an Azure environment based on Microsoft Cloud Adoption Framework for enterprise- scale landing zone architecture principles. The environment will host three apps that have the following characteristics:Each app will have a development environment, a test environment, and a production environment.Each environment will be managed by a separate team.Each app will store its secrets in Azure Key Vault.You need to recommend how many Azure subscriptions and key vaults to deploy to the application landing zones.What should you recommend? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one point.Hot Area:
Box 1: 9SubscriptionsBased on the Microsoft Cloud Adoption Framework (CAF) and its enterprise-scale landing zone architecture principles (specifically Subscription Democratization), the following subscription count is requiredApplication Landing Zones (9 Subscriptions):According to CAF principles, a workload should have a dedicated application landing zone for each environment (Development, Test, and Production) to provide security, policy, and management isolation. 3 Apps × 3 Environments (Dev, Test, Prod) = 9 Subscriptions. This ensures each team has a clear management boundary and that Azure Key Vault secrets for each app/ environment are isolated at the subscription level.Box 2: 9Key vaultsBased on the Microsoft Cloud Adoption Framework (CAF) and enterprise-scale landing zone design principles, you require 9 Azure Key Vaults.Architecture Calculation3 Apps * 3 Environments (Development, Test, Production) = 9 Total Key Vaults.Justification and Design Principles The enterprise-scale architecture emphasizes specific design principles for security and resource organization:Environmental Isolation: CAF principles recommend using one Key Vault per application, per region, and per environment. This ensures that secrets are not shared across development, testing, and production, drastically reducing the "blast radius" in the event of a security breach.SubscriptionDemocratization: In an enterprise-scale landing zone, subscriptions are the unit of management and isolation. Each environment (Dev, Test, Prod) should ideally reside in its own subscription to segregate the software development lifecycle (SDLC).Separation of Duties: Since each environment is managed by a separate team, having distinct Key Vaults allows you to implement granular Role-Based Access Control (RBAC). This ensures the Dev team cannot access Production secrets, adhering to the principle of least privilege.Security Boundaries: Key Vaults define hard security boundaries. Grouping secrets for multiple apps or environments into a single vault increases risk, as an attacker with access to one vault could potentially compromise all associated applications.
https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ready/landing-zone https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ready/landing-zone/design-principles
You have a Microsoft 365 subscription that contains a group named Group1. The subscription contains 1,000 Windows devices that are joined to a Microsoft Entra tenant and managed by using Microsoft Intune. All users sign in to the devices by using standard user accounts.You plan to deploy a new app named App1 to the members of Group1. The Group1 members must have administrative rights to install new versions of App1.You need to ensure that the Group1 members can install new versions of App1. The solution must follow the principles of Zero Trust.What should you implement?
Answer(s): B
To best ensure that members of the group can install new versions of the app while following Zero Trust principles, you should implement Microsoft Intune Endpoint Privilege Management (EPM).Why EPM is the Best Solution:*-> Principle of Least Privilege: EPM allows users to continue signing in as standard users while granting them elevated privileges only for specific, approved tasks or applications.Just-in-Time (JIT) Elevation: It provides temporary administrative rights precisely when needed for the application installation, rather than granting permanent local admin rights.Granular Control: You can create elevation rules based on file hashes, publisher certificates, or file names to ensure only the specific app and its versions can be installed with elevated rights.*-> Zero Trust Alignment: By using EPM, you verify every elevation request explicitly and maintain a strong security posture by minimizing the attack surface associated with excessive local permissions.Incorrect:[Not A]Microsoft Entra PIM: Primarily used for managing elevated cloud roles (e.g., Global Administrator) rather than local device permissions.[Not C]Microsoft LAPS: Manages the password for a local administrator account but does not allow standard users to perform elevations within their own session.[Not D]Microsoft Entra Entitlement Management: Focused on managing access to groups, applications, and SharePoint sites via access packages, not local device privilege elevation.
https://learn.microsoft.com/en-us/intune/intune-service/protect/epm-overview
HOTSPOTYou need to recommend a solution to meet the AWS requirements.What should you include in the recommendation? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one point.Hot Area:
Box 1: Defender for CloudFor the AWS EC2 instances:Scenario:Requirements. AWS RequirementsFabrikam identifies the following security requirements for the data hosted in ContosoAWS1:*-> Notify security administrators at Fabrikam if any AWS EC2 instances are noncompliant with secure score recommendations.* Ensure that the security administrators can query AWS service logs directly from the Azure environment.Note: Secure score in Defender for CloudThe secure score in Microsoft Defender for Cloud can help you to improve your cloud security posture. The secure score aggregates security findings into a single score so that you can assess, at a glance, your current security situation. The higher the score, the lower the identified risk level is.View the secure scoreWhen you view the Defender for Cloud Overview dashboard, you can view the secure score for all of your environments. The dashboard shows the secure score as a percentage value and includes the underlying values.Box 2: Microsoft SentinelFor the AWS service logs:Scenario:Requirements. AWS RequirementsFabrikam identifies the following security requirements for the data hosted in ContosoAWS1:* Notify security administrators at Fabrikam if any AWS EC2 instances are noncompliant with secure score recommendations.*-> Ensure that the security administrators can query AWS service logs directly from the Azure environment.Use the Amazon Web Services (AWS) connectors to pull AWS service logs into Microsoft Sentinel.Note: These connectors work by granting Microsoft Sentinel access to your AWS resource logs. Setting up the connector establishes a trust relationship between Amazon Web Services and Microsoft Sentinel. This is accomplished on AWS by creating a role that gives permission to Microsoft Sentinel to access your AWS logs.Note:Existing Environment. PartnersFabrikam has contracted a company named Contoso, Ltd. to develop applications. Contoso has the following infrastructure:A Microsoft Entra tenant named contoso.onmicrosoft.comAn Amazon Web Services (AWS) implementation named ContosoAWS1 that contains AWS EC2 instances used to host test workloads for the applications of Fabrikam
https://learn.microsoft.com/en-us/azure/defender-for-cloud/secure-score-security-controls https://docs.microsoft.com/en-us/azure/defender-for-cloud/recommendations-reference-aws https://docs.microsoft.com/en-us/azure/sentinel/connect-aws
HOTSPOTYou need to recommend a solution to meet the compliance requirements.What should you recommend? To answer, select the appropriate options in the answer area.Note: Each correct selection is worth one point.Hot Area:
Box 1: Workflow automationTo enforce compliance to the regulatory standard, create:Scenario: Requirements. Compliance RequirementsFabrikam wants to automatically remediate the virtual machines in Sub1 to be compliant with the HIPAA HITRUST standard.Note: Run a HIPAA HITRUST 9.2 Regulatory Compliance Report for Azure In Azure, the HIPAA HITRUST 9.2 framework offers a comprehensive set of predefined compliance and security checks for the Health Insurance Portability and Accountability Act. These checks encompass various domains and controls, including administrator and operator logs, audit logging, privilege management, and more.With the pre-built workflow below, you can generate 20 reports simultaneously, and have the results conveniently delivered via email.Box 2: Modify an Azure policy definitionTo exclude TestRG from the compliance assessment:Scenario: The virtual machines in TestRG must be excluded from the compliance assessment.Use a Policy definition to include the TestRG virtual machines from the Blueprint.Note: Azure Policy establishes conventions for resources. Policy definitions describe resource compliance conditions and the effect to take if a condition is met. A condition compares a resource property field or a value to a required value. Resource property fields are accessed by using aliases. When a resource property field is an array, a special array alias can be used to select values from all array members and apply a condition to each one.By defining conventions, you can control costs and more easily manage your resources. For example, you can specify that only certain types of virtual machines are allowed. Or, you can require that resources have a particular tag. Policy assignments are inherited by child resources. If a policy assignment is applied to a resource group, it's applicable to all the resources in that resource group.Incorrect:* Not Update a policy assignmentA policy assignment assigns a Blueprint to a subscription. The scope is at the subscription level.Note: Policy Assignments provide a means for applying policy to a subscription to which a blueprint is assigned. That said, the policy must be within the scope of the blueprint containing the policy. Parameters defined with a policy are assigned during blueprint creation or during blueprint assignment.
https://www.blinkops.com/blog/azure-workflow-automation https://k21academy.com/microsoft-azure/azure-rbac-vs-azure-policies-vs-azure-blueprints/
Box 1: Microsoft Defender for serversScenario: Notify security administrators at Fabrikam if any AWS EC2 instances are noncompliant with secure score recommendations.Defender for Servers is one of the enhanced security features available in Microsoft Defender for Cloud. You can use it to add threat detection and advanced defenses to your Windows and Linux machines that exist in hybrid and multicloud environments.Available Defender for Server plansDefender for Servers offers you a choice between two paid plans. Both include automatic onboarding for resources in Azure, AWS, GCP.Plan 1 includes the following benefits:Automatic onboarding for resources in Azure, AWS, GCPMicrosoft threat and vulnerability managementFlexibility to use Microsoft Defender for Cloud or Microsoft 365 Defender portal A Microsoft Defender for Endpoint subscription that includes access to alerts, software inventory, Vulnerability Assessment and an automatic integration with Microsoft Defender for Cloud.Plan 2 includes everything in Plan 1 plus some additional benefits.Box 2: Microsoft SentinelScenario: AWS RequirementsFabrikam identifies the following security requirements for the data hosted in ContosoAWS1:Ensure that the security administrators can query AWS service logs directly from the Azure environment.Use the Amazon Web Services (AWS) connectors to pull AWS service logs into Microsoft Sentinel.Note: These connectors work by granting Microsoft Sentinel access to your AWS resource logs. Setting up the connector establishes a trust relationship between Amazon Web Services and Microsoft Sentinel. This is accomplished on AWS by creating a role that gives permission to Microsoft Sentinel to access your AWS logs.
https://docs.microsoft.com/en-us/azure/defender-for-cloud/defender-for-servers-introduction https://docs.microsoft.com/en-us/azure/defender-for-cloud/recommendations-reference-aws https://docs.microsoft.com/en-us/azure/sentinel/connect-aws
Post your Comments and Discuss Microsoft SC-100 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the SC-100 content, but please register or login to continue.