SC-100 Practice Exam 62 — 20 Questions

Question 1

Contoso is a large enterprise with a complex Azure environment. They have multiple management groups, subscriptions, and a hub-spoke network topology. The security team wants to implement a consistent security baseline across all subscriptions using Azure Policy. They need to ensure that: 1) All resources must be deployed in approved regions only. 2) Network security groups must have specific rules to block high-risk ports. 3) All storage accounts must enforce HTTPS traffic. 4) The policies must be applied at the management group level to ensure inheritance. 5) Non-compliant resources must be automatically remediated where possible. What should you do?

Accepted Answer

Create custom Azure Policy definitions for the required configurations (allowed locations, NSG rule blocking ports, storage HTTPS). Assign the policies at the root management group. Enable 'deployIfNotExists' effect for automatic remediation of non-compliant resources. Use Azure Policy remediation tasks to fix existing non-compliant resources.. Option B is correct because it uses Azure Policy at the root management group to enforce inheritance across all subscriptions, with custom policy definitions for allowed locations, NSG rules blocking high-risk ports, and storage HTTPS. The 'deployIfNotExists' effect enables automatic remediation of non-compliant resources, and remediation tasks fix existing non-compliant resources, meeting all requirements without manual intervention.

Answer

Use Azure Policy Guest Configuration to enforce region and NSG rules. Assign policies at each subscription. Use Azure Automation runbooks for remediation.

Answer

Use Azure Blueprints to define the environment. Include Azure Policy assignments in the blueprint. Assign blueprint to each management group. Remediate manually.

Answer

Create a custom script using Azure PowerShell to check compliance daily. Use Azure Logic Apps to send alerts for non-compliance. Have IT staff manually fix issues.

Question 2

You are the security architect for a multinational corporation that uses Azure Active Directory (Azure AD) and Microsoft 365. The company has recently experienced a security incident where a compromised user account was used to access sensitive data from a legacy application that does not support modern authentication. To mitigate this risk, you have been asked to recommend a set of security best practices and priorities. The environment includes 50,000 users, 200 applications (many legacy), and a hybrid identity setup with Active Directory Domain Services (AD DS) synchronized to Azure AD via Azure AD Connect. The security team wants to reduce the attack surface, enforce least privilege, and improve identity protection. Current issues include: (1) many users have standing admin privileges on workstations, (2) legacy apps use shared service accounts with weak passwords, (3) Conditional Access policies are not applied consistently, and (4) there is no process for reviewing privileged role assignments. Which course of action should you recommend as the highest priority?

Accepted Answer

Implement Azure AD Privileged Identity Management (PIM) for just-in-time access and role approval workflows. Option B is correct because implementing Azure AD Privileged Identity Management (PIM) directly addresses the highest-priority risk: the lack of oversight and control over privileged role assignments. With 50,000 users and many standing admin privileges on workstations, PIM enables just-in-time (JIT) activation, approval workflows, and time-bound roles, which drastically reduces the attack surface by eliminating permanent privileged access. This is the most critical first step because unmanaged privileged accounts are the primary vector for lateral movement and data exfiltration, as demonstrated in the incident.

Answer

Migrate legacy applications to support modern authentication and use Azure AD Application Proxy

Answer

Deploy Azure AD Password Protection and enforce banned password lists

Answer

Implement Conditional Access policies to block legacy authentication and require MFA for all users

Question 3

You are the security architect for a multinational corporation that uses Microsoft 365 E5 licenses. The company has deployed Microsoft Sentinel in a central Azure subscription, and all subsidiaries stream their logs to this workspace. The SOC team uses Microsoft 365 Defender to investigate incidents. Recently, the company experienced a sophisticated phishing campaign that bypassed Exchange Online Protection (EOP) and resulted in credential theft for several users. The SOC team manually created incidents in Sentinel for each compromised user. However, they want to automate the creation of Sentinel incidents from Microsoft 365 Defender alerts. Additionally, they want to ensure that when a user is confirmed compromised, a playbook automatically disables the user's account in Azure AD and resets their password. The SOC team has already deployed the Microsoft 365 Defender data connector in Sentinel and enabled streaming of alerts. However, no incidents are being created automatically from Defender alerts. You need to recommend a solution to automate incident creation and response. What should you do?

Accepted Answer

Create a Microsoft Security incident creation rule for Microsoft 365 Defender, and create an automation rule that triggers a playbook to disable the user and reset password.. Option B is correct because it uses a Microsoft Security incident creation rule, which is the proper method to automatically generate Sentinel incidents from Microsoft 365 Defender alerts. The automation rule then triggers a playbook to disable the user in Azure AD and reset their password, fulfilling the automated response requirement. This approach aligns with Sentinel's native integration for Microsoft 365 Defender, where alerts are ingested via the data connector but incidents require a dedicated rule to be created.

Answer

Configure the Microsoft 365 Defender connector to send alerts to a Logic App that creates incidents.

Answer

Enable the Microsoft 365 Defender connector by selecting the 'Create incidents' checkbox.

Answer

Create an analytics rule that queries Microsoft 365 Defender alerts and creates incidents.

Question 4

A large enterprise is designing a secure infrastructure for a multi-region application deployment. They have a hub-spoke topology in two Azure regions (East US and West US) with VNet peering between the hubs. Each region has a shared services spoke containing Azure AD Domain Services (AAD DS) and management jump boxes. Application spokes in each region host VMs that need to authenticate to the local AAD DS. The company mandates that all traffic between regions must traverse a network virtual appliance (NVA) for inspection, except for Azure management traffic. They also require that all outbound internet traffic from application VMs goes through a single Azure Firewall in the East US hub. They have deployed ExpressRoute to on-premises. Currently, application VMs in West US cannot authenticate to the local AAD DS. What is the most likely cause?

Accepted Answer

The route table for the West US application spoke has a default route (0.0.0.0/0) pointing to the NVA, causing traffic to AAD DS to be sent across regions.. The most likely cause is that the route table for the West US application spoke has a default route (0.0.0.0/0) pointing to the NVA. This forces all outbound traffic, including traffic destined for the local AAD DS (which resides in the same region's shared services spoke), to be routed through the NVA and potentially across regions via the hub peering, rather than staying within the local VNet. Since AAD DS requires low-latency, direct connectivity within the same region, this misrouting prevents authentication.

Answer

The Azure Firewall in East US is not configured to allow traffic from West US to AAD DS.

Answer

The VNet peering between East and West US hubs is not properly configured with 'Allow forwarded traffic' enabled.

Answer

The ExpressRoute circuit is down, causing traffic to be routed over the internet.

Question 5

You are the security architect for Contoso Ltd., a company that runs a critical e-commerce application on Azure Kubernetes Service (AKS). The application consists of multiple microservices that communicate over HTTP. The application uses Azure SQL Database for transactional data and Azure Redis Cache for session state. Recently, a security audit revealed that several microservices are vulnerable to SQL injection attacks because they construct SQL queries by concatenating user input. Additionally, the Redis cache is exposed to the internet with no firewall rules, and the connection string is stored in plain text in the application configuration file. The development team is concerned about performance and wants to minimize changes to the codebase. You need to design a strategy to mitigate these vulnerabilities with minimal code changes. Which of the following is the best course of action?

Accepted Answer

Deploy Azure Web Application Firewall (WAF) on Application Gateway to protect against SQL injection, configure Azure Redis Cache with a private endpoint and disable public network access, and use Azure Key Vault with a managed identity to inject the Redis connection string into the application.. Option A is correct because it addresses all three vulnerabilities with minimal code changes: Azure WAF on Application Gateway provides network-layer SQL injection protection without modifying application code; configuring Azure Redis Cache with a private endpoint and disabling public network access secures the cache without code changes; and using Azure Key Vault with a managed identity injects the Redis connection string securely at runtime, eliminating plain-text storage without altering the application's configuration loading logic.

Answer

Enable Azure Web Application Firewall (WAF) on an Application Gateway in front of AKS to block SQL injection, move Redis to a private endpoint with a firewall rule, and use Azure Key Vault with a managed identity to inject the Redis connection string.

Answer

Move all SQL queries to stored procedures, enable Redis persistence with AOF, and store the connection string in a Kubernetes secret.

Answer

Refactor the microservices to use parameterized SQL queries, configure Azure Redis Cache firewall to allow only AKS node IPs, and store the connection string in Azure Key Vault with a managed identity.

Question 6

You are the lead security architect for a multinational corporation that recently completed a merger. The new entity, Contoso Ltd., has a complex Azure environment with over 200 subscriptions spread across multiple management groups. The company's security team has identified several critical issues: (1) many subscriptions have Azure Security Center's Secure Score below 30%, (2) there are numerous unmanaged VMs with public IP addresses, (3) there is no centralized logging for security events, and (4) identity management is fragmented with multiple Azure AD tenants. The CEO mandates a 'zero-trust' security posture within 12 months. You have a limited budget and must prioritize the most impactful actions. Which course of action should you take first?

Accepted Answer

Consolidate all Azure AD tenants into a single tenant and establish a common identity baseline. Option C is correct because identity is the foundational control plane for zero-trust architecture. Without a unified identity baseline across a single Azure AD tenant, you cannot enforce consistent conditional access policies, least-privilege access, or authentication strength—making all other security controls ineffective. Consolidating tenants first directly addresses the fragmented identity management issue and enables centralized policy enforcement, which is the highest-impact, lowest-cost action to improve the security posture within 12 months.

Answer

Implement Azure Sentinel to centralize logs and create automated response playbooks

Answer

Deploy Azure Firewall and enforce forced tunneling for all VNets

Answer

Deploy Azure Policy to deny creation of VMs with public IPs and enforce NSGs

Question 7

You are a security architect for a healthcare organization that is deploying a new application on Azure. The application consists of a web frontend (Azure App Service), an API layer (Azure Functions), and a database (Azure SQL Database). The organization requires that all data be encrypted at rest and in transit. Additionally, they need to ensure that only authenticated and authorized users can access the API, and that the database is accessible only from the API layer. The organization also wants to use managed identities to avoid storing credentials. You have deployed the resources. Now you need to configure the security settings. What should you do to meet the requirements?

Accepted Answer

Enable HTTPS-only on App Service, enable Azure SQL Database transparent data encryption, configure Azure AD authentication for SQL, and set the SQL firewall to allow Azure services. Option B is correct because it meets all requirements: HTTPS-only ensures encryption in transit for the web frontend; Azure SQL Database TDE provides encryption at rest by default; configuring Azure AD authentication for SQL eliminates stored credentials and supports managed identities; and setting the SQL firewall to 'Allow Azure services' restricts database access to Azure resources, including the API layer, without exposing a public IP.

Answer

Enable App Service Authentication with Azure AD, configure the API to use API keys, and enable Always Encrypted on SQL

Answer

Enable HTTPS-only on App Service, enable Azure SQL Database firewall to allow the API's public IP, and use SQL authentication

Answer

Use Azure Front Door with WAF, store connection strings in Azure Key Vault, and enable Azure SQL Database auditing

Question 8

You are the security architect for a large financial services company. The company has a hybrid environment with on-premises Active Directory, Azure AD, and multiple Azure subscriptions. They use Microsoft Sentinel as their SIEM and have deployed Microsoft Defender for Cloud to assess their cloud security posture. Recently, the security team discovered that a critical Azure SQL database was exposed to the internet with a firewall rule allowing 'AllowAllWindowsAzureIps'. This misconfiguration was not flagged by Defender for Cloud because the corresponding recommendation was disabled in the security policy. The company wants to prevent such misconfigurations in the future and ensure that all critical resources are covered by security recommendations. They also need to ensure that any changes to security policies are reviewed and approved. Which of the following actions should you recommend as the most comprehensive solution?

Accepted Answer

Review and enable all relevant security recommendations in Defender for Cloud, and implement a change management process using Azure Policy and a custom workflow that requires approval before modifying security policies.. Option A is correct because it addresses the root cause—disabled security recommendations—by enabling all relevant recommendations in Defender for Cloud, and it enforces a change management process using Azure Policy with a custom approval workflow. This ensures that any modifications to security policies are reviewed and approved, preventing future misconfigurations like the 'AllowAllWindowsAzureIps' rule from going unnoticed. The combination of policy enforcement and approval workflow provides a comprehensive, automated governance layer that covers both detection and prevention.

Answer

Deploy Azure Monitor alerts on all SQL Server firewall rule changes and instruct the security team to manually review each change.

Answer

Assign the Contributor role to the security team on the subscription so they can directly modify firewall rules if needed.

Answer

Enable the specific recommendation for SQL Server firewall rules in Defender for Cloud and set up an automation rule to send alerts when the recommendation is triggered.

Question 9

Your organization, Contoso Ltd., is migrating its on-premises workloads to Azure. The environment includes 200 virtual machines (VMs) running Windows Server and 50 VMs running Linux. You are responsible for designing the security infrastructure. The company has the following requirements: 1) All VMs must be protected against malware. 2) Security updates must be applied automatically to Windows VMs within 24 hours of release. 3) Linux VMs must receive critical security patches within 48 hours. 4) A central dashboard must provide visibility into the security posture of all VMs. 5) All VMs must be onboarded to Microsoft Defender for Cloud to enable advanced threat protection. 6) The solution must minimize administrative overhead. You have implemented the following: - All VMs are enrolled in Microsoft Defender for Cloud with the enhanced security features enabled. - Azure Update Manager is configured to schedule updates. - Microsoft Defender for Endpoint is installed on all Windows VMs. However, after a month, the security team reports that: - 50 Windows VMs did not receive security updates within 24 hours. - 10 Linux VMs have not received any patches. - The central dashboard shows that 30 VMs are not reporting their security status. - A malware outbreak occurred on 5 Windows VMs that were not protected by Defender for Endpoint. You need to identify the most likely root cause and recommend a corrective action.

Accepted Answer

Review the network security groups (NSGs) and firewall rules to ensure outbound connectivity to the required Microsoft endpoints for Microsoft Defender for Endpoint and Windows Update.. The correct answer is D because the symptoms—VMs missing updates, not reporting status, and lacking Defender for Endpoint protection—point to a connectivity failure. Microsoft Defender for Endpoint and Windows Update require outbound connectivity to specific Microsoft endpoints (e.g., *.endpoint.microsoft.com, *.update.microsoft.com). Without this, VMs cannot receive updates, report security posture, or download Defender definitions, directly explaining all reported issues.

Answer

Onboard the VMs to Azure Arc and enable the Azure Update Manager on all VMs via Arc.

Answer

Implement Azure Policy to enforce that all VMs have the 'Deploy default Microsoft IaaS anti-malware extension for Windows' policy assigned and create a remediation task.

Answer

Configure Microsoft Entra Privileged Identity Management (PIM) to require approval for update deployments.

Question 10

Contoso Ltd. is a multinational organization with a hybrid environment consisting of on-premises Active Directory and Azure AD (now Microsoft Entra ID). They use Microsoft Defender for Cloud Apps, Microsoft Sentinel, and Microsoft 365 Defender. The security operations team has noticed that several high-severity alerts from Microsoft 365 Defender are not being forwarded to Microsoft Sentinel, causing delayed response. The team has confirmed that the data connector between Microsoft 365 Defender and Sentinel is enabled and appears healthy. However, only low-severity alerts appear in Sentinel. Further investigation reveals that the Microsoft 365 Defender portal has a configured rule set that suppresses high-severity alerts for certain users deemed low risk. The security operations manager wants to ensure all high-severity alerts are sent to Sentinel without changing the suppression rules in Microsoft 365 Defender, as those rules are required for operational efficiency. What should the team do to ensure high-severity alerts are ingested into Sentinel?

Accepted Answer

In the Microsoft 365 Defender data connector in Sentinel, enable the option to include suppressed alerts.. Option B is correct because the Microsoft 365 Defender data connector in Microsoft Sentinel includes a configuration setting to 'Include suppressed alerts.' Enabling this option forces Sentinel to ingest all alerts from Microsoft 365 Defender, including those that are suppressed by rule sets in the Defender portal. This satisfies the requirement to forward high-severity alerts without modifying the suppression rules that the operations team relies on for operational efficiency.

Answer

Modify the suppression rules in Microsoft 365 Defender to not suppress high-severity alerts.

Answer

Use the Microsoft Graph Security API connector in Sentinel to ingest alerts instead.

Answer

Create a separate Logic App to fetch high-severity alerts from Microsoft 365 Defender API and send them to Sentinel.

Question 11

A global retail company, Northwind Traders, is adopting a cloud-first strategy using Azure and Microsoft 365. They have a large number of temporary seasonal workers who need access to specific applications and data for limited periods. The security team wants to minimize the risk of standing privileges and ensure that access is granted only when needed and for a limited duration. They also need to audit all privileged access actions. The environment includes Microsoft Entra ID, Azure resources, and Microsoft 365 services. You need to design a privileged access strategy that follows the principle of least privilege and aligns with Microsoft's best practices for privileged identity management. What should you recommend?

Accepted Answer

Use Microsoft Entra Privileged Identity Management (PIM) to grant just-in-time access to Azure AD roles and Azure resources. Configure approval workflows for high-privilege roles. Set maximum activation durations. For non-Azure resources, use Privileged Access Groups (PAG) to manage access. Enable audit logging to a Log Analytics workspace for monitoring.. Option A is correct because it leverages Microsoft Entra Privileged Identity Management (PIM) to enforce just-in-time (JIT) access for Azure AD roles and Azure resources, aligning with the principle of least privilege and minimizing standing privileges. It includes approval workflows for high-privilege roles, maximum activation durations to limit exposure, and Privileged Access Groups (PAG) to manage access to non-Azure resources like Microsoft 365 workloads. Audit logging to a Log Analytics workspace provides comprehensive monitoring of all privileged actions, meeting the auditing requirement.

Answer

Create a custom role in Azure AD with limited permissions. Assign the role to a security group. Have users request access via a manual email process. The IT team approves and assigns the group membership temporarily.

Answer

Assign permanent roles to seasonal workers for the duration of their contract. Use Azure AD access reviews to periodically confirm access. Enable Azure AD audit logs. Use Conditional Access to require MFA for privileged roles.

Answer

Create separate Azure AD roles for each seasonal worker with granular permissions. Use Azure AD Identity Governance to automate access requests. Do not enable PIM to reduce complexity.

Question 12

You are a security architect for a large financial services company. The company has a hybrid identity environment with on-premises Active Directory synchronized to Microsoft Entra ID using Microsoft Entra Connect. They use Microsoft 365 E5 licenses and have deployed Microsoft Defender for Cloud, Microsoft Defender for Identity, Microsoft Sentinel, and Microsoft Purview. The company has recently suffered a ransomware attack where an attacker gained access via a compromised service account that had permanent Global Administrator privileges. The attacker then used the account to create a backdoor user and exfiltrate sensitive data from SharePoint Online. After the incident, the CISO mandates a Zero Trust security transformation with the following requirements: 
1. Eliminate standing privileged access for all cloud admins.
2. Require phishing-resistant authentication for all privileged roles.
3. Ensure that all sensitive data in SharePoint Online is automatically classified and protected.
4. Enable detection of lateral movement using anomalous behavior analytics. Which combination of actions should you recommend?

Accepted Answer

Implement Privileged Identity Management (PIM) for Global Administrator roles, configure Authentication Strengths to require FIDO2, create auto-labeling policies for credit card numbers, and enable Defender for Identity lateral movement path detection.. Option A is correct because it directly addresses all four CISO requirements: Privileged Identity Management (PIM) eliminates standing Global Administrator privileges by requiring just-in-time activation; Authentication Strengths with FIDO2 enforces phishing-resistant authentication for privileged roles; auto-labeling policies in Microsoft Purview automatically classify and protect sensitive data like credit card numbers in SharePoint Online; and Defender for Identity lateral movement path detection uses behavioral analytics to detect anomalous lateral movement, fulfilling the detection requirement.

Answer

Deploy Microsoft Entra Identity Protection for all users, configure Azure AD Conditional Access with MFA, use Microsoft Purview Information Protection with manual labeling, and enable Microsoft Sentinel analytics for lateral movement.

Answer

Configure Conditional Access to require MFA for admins, enable Microsoft Purview DLP for SharePoint, deploy Defender for Cloud Apps, and use Identity Protection for user risk.

Answer

Remove all permanent admin roles and use just-in-time access via PIM, enforce MFA via Conditional Access, apply sensitivity labels via Microsoft Purview Data Map, and use Microsoft Defender for Cloud for network security groups.

Question 13

Your organization is a small business with 50 employees that uses Microsoft 365 Business Premium. You need to design a security baseline that protects against common threats like phishing, ransomware, and data leakage. The solution must be easy to manage and require minimal ongoing effort. You have the following requirements: 1. Block malicious emails and links. 2. Protect sensitive data from being shared externally. 3. Require multi-factor authentication for all users. 4. Keep devices healthy. Which combination of policies should you implement?

Accepted Answer

Enable Microsoft Defender for Office 365 Safe Links and Safe Attachments. Create a Microsoft Purview DLP policy to prevent external sharing of sensitive data. Create a Conditional Access policy to require MFA and device compliance.. Option C is correct because it directly addresses all four requirements: Microsoft Defender for Office 365 Safe Links and Safe Attachments blocks malicious emails and links; a Microsoft Purview DLP policy prevents external sharing of sensitive data, protecting against data leakage; a Conditional Access policy requiring MFA and device compliance enforces multi-factor authentication for all users and ensures devices are healthy. This combination is easy to manage with minimal ongoing effort, as it leverages built-in Microsoft 365 Business Premium capabilities without complex custom configurations.

Answer

Enable Microsoft Defender for Office 365 for phishing protection. Use Microsoft Purview Information Protection to automatically label sensitive emails. Create a Conditional Access policy to require MFA for admins only. Use Azure Information Protection scanner.

Answer

Enable Exchange Online Protection (EOP) for spam and malware filtering. Create a Conditional Access policy to require MFA for all users. Enable device compliance policies in Microsoft Intune.

Answer

Enable Microsoft Defender for Office 365 Safe Links and Safe Attachments. Create a Microsoft Purview DLP policy to block sharing of credit card numbers. Enable security defaults in Microsoft Entra ID to enforce MFA.

Question 14

Litware, a software development company, has adopted a DevOps culture and uses Azure DevOps for CI/CD pipelines. They deploy applications to Azure Kubernetes Service (AKS) and Azure App Services. The security team wants to ensure that secrets (API keys, connection strings) are not exposed in source code or pipeline logs. They also need to scan container images for vulnerabilities before deployment and ensure that only approved images are used in production. The solution must integrate with Microsoft Defender for Cloud and follow security best practices. What should you include in the design?

Accepted Answer

Store secrets in Azure Key Vault and use Azure DevOps Variable Groups linked to Key Vault for retrieval during pipelines. Enable Microsoft Defender for Containers on AKS to scan container images for vulnerabilities. Use Azure Policy (specifically Azure Policy for AKS with Gatekeeper) to enforce that only images from approved registries are deployed.. Option B is correct because it aligns with security best practices by using Azure Key Vault to securely store secrets and linking them to Azure DevOps Variable Groups for secure retrieval during pipelines, preventing exposure in source code or logs. It enables Microsoft Defender for Containers on AKS to scan container images for vulnerabilities before deployment, and uses Azure Policy with Gatekeeper to enforce that only images from approved registries are deployed, ensuring compliance and integration with Microsoft Defender for Cloud.

Answer

Use Azure App Configuration to store secrets with encryption. Run vulnerability scans using a third-party tool integrated into the pipeline. Create a custom script to check image registry location.

Answer

Store secrets as encrypted pipeline variables in Azure DevOps. Use Azure Container Registry (ACR) tasks to scan images. Implement manual approval gates in release pipelines to verify image source.

Answer

Store secrets in Azure Key Vault but use a custom task to retrieve them. Scan images using Microsoft Defender for Cloud after deployment. Use role-based access control to restrict registry access.

Question 15

You are a security architect for a large multinational organization that uses Microsoft 365, Azure, and third-party SaaS applications. The organization has recently experienced a breach where an attacker compromised a user account via a phishing email and then used that account to access sensitive data in SharePoint Online and exfiltrate it via email. The security team wants to implement a comprehensive solution that aligns with the Zero Trust principles of 'verify explicitly', 'use least privilege', and 'assume breach'. You need to design a solution that includes identity protection, conditional access, data protection, and continuous monitoring. You have the following requirements: 1. Block phishing attacks in real time. 2. Enforce least privilege access to sensitive data. 3. Detect and respond to anomalous user behavior. 4. Protect data at rest and in transit. 5. Enable automated response to incidents. Which combination of Microsoft security services and configurations should you recommend?

Accepted Answer

Implement Microsoft Defender for Office 365 to block phishing emails. Use Conditional Access policies with session risk to enforce access controls. Deploy Microsoft Purview DLP and sensitivity labels to protect data. Use Microsoft Sentinel with automation rules and playbooks to detect and respond to incidents.. Option B is correct because it combines Microsoft Defender for Office 365 to block phishing, Conditional Access with risk policies to enforce least privilege, Microsoft Purview DLP and sensitivity labels to protect data, and Microsoft Sentinel with automation to detect and respond. Option A is wrong because it uses Azure AD (now Entra ID) Identity Protection but lacks DLP and monitoring. Option C is wrong because it does not include phishing prevention. Option D is wrong because it uses Microsoft Defender for Cloud Apps alone, which is insufficient for email and identity protection.

Answer

Implement Microsoft Defender for Cloud Apps to discover and control SaaS apps. Use Conditional Access with app control. Deploy Microsoft Purview Data Lifecycle Management. Use Azure Sentinel for monitoring.

Answer

Implement Microsoft Entra ID Protection to detect and block risky sign-ins. Use Conditional Access policies to require MFA and block legacy authentication. Use Microsoft Purview sensitivity labels to classify data and Azure Monitor to collect logs.

Answer

Implement Microsoft Defender for Identity to detect on-premises threats. Use Conditional Access with device compliance policies. Deploy Microsoft Purview Information Protection. Use Azure Security Center for monitoring.

Question 16

Tailwind Traders is a small business that uses Microsoft 365 Business Premium. They have no dedicated IT staff. The owner wants to implement basic security measures to protect against common threats like phishing, ransomware, and unauthorized access. They need a simple, cost-effective solution that aligns with Microsoft's security best practices for small businesses. Which set of actions should you recommend?

Accepted Answer

Enable Security Defaults in Microsoft Entra ID to enforce MFA for all users. Configure Microsoft Defender for Office 365 to protect against phishing and malware. Use Microsoft Defender for Business (included) for endpoint protection. Regularly review the Microsoft 365 Secure Score and implement top recommendations.. Option D is correct because it aligns with Microsoft's security best practices for small businesses with no dedicated IT staff. Security Defaults in Microsoft Entra ID provide a baseline of MFA enforcement without requiring complex configuration. Microsoft Defender for Office 365 and Defender for Business (included in Microsoft 365 Business Premium) offer integrated phishing, malware, and endpoint protection. Regularly reviewing the Secure Score ensures continuous improvement against common threats like ransomware and unauthorized access.

Answer

Implement Privileged Identity Management (PIM) for all accounts. Use Azure Information Protection to classify all emails. Set up a SIEM using Microsoft Sentinel.

Answer

Deploy Microsoft Intune to manage devices. Configure Conditional Access policies to require compliant devices. Use Microsoft Defender for Endpoint for antivirus. Set up a VPN for remote access.

Answer

Purchase Azure AD Premium P2 for all users. Use Identity Protection to detect risks. Configure Conditional Access with session controls. Use Azure AD Identity Governance for access reviews.

Question 17

You are a security architect for a global financial services company. The company is adopting Microsoft Sentinel as its primary SIEM and Microsoft Defender XDR for endpoint, email, and identity protection. The company has a hybrid environment with on-premises Active Directory and Microsoft Entra ID. The SOC team needs to be able to investigate incidents that involve lateral movement between on-premises and cloud resources. Additionally, the company must comply with GDPR, requiring that personal data be protected and that data residency requirements are met: all security logs for EU users must remain within the EU. The company already has a Microsoft Sentinel workspace in the West Europe region. You need to design a solution that meets these requirements while minimizing administrative overhead. What should you do?

Accepted Answer

Use the existing West Europe Sentinel workspace and ensure that all EU user logs are sent to that workspace via diagnostic settings.. Option B is correct because a single Sentinel workspace can handle logs from multiple regions, and using the same workspace across regions is simpler. For GDPR data residency, you can configure diagnostics settings to send logs to the workspace without needing separate workspaces. Option A is incorrect because multiple workspaces increase overhead. Option C is incorrect because Azure Arc doesn't change data residency. Option D is incorrect because a separate workspace for EU data adds complexity.

Answer

Deploy Azure Arc on on-premises servers and use Azure Policy to enforce log collection to the West Europe workspace.

Answer

Create a new Sentinel workspace in the EU region for EU logs and a separate workspace for non-EU logs.

Answer

Deploy a separate Sentinel workspace in each region where you have users.

Question 18

You are a security architect for a large organization that uses Microsoft Sentinel, Microsoft Defender XDR, and Microsoft Entra ID. The organization has a hybrid identity environment with on-premises Active Directory synchronized to Azure AD. The security team needs to detect and automatically respond to a specific attack pattern: an attacker compromises a user's credentials and then uses a new device to sign in to a critical application from an unusual location. The response should block the user's account for one hour and reset the user's password. You have already configured Microsoft Sentinel to receive sign-in logs from Azure AD. You need to design the detection and automated response. What should you do?

Accepted Answer

Enable the Microsoft Entra ID Protection data connector in Microsoft Sentinel, create an analytics rule from the 'Sign-in from new device' template, and configure a playbook to block the user and reset password.. Option C is correct because the Microsoft Entra ID Protection connector provides risk detections that can be ingested into Sentinel, and a playbook can be triggered to block the user and reset the password via the Azure AD API. Option A is incorrect because ID Protection can detect risky sign-ins, but the requirement is to use Sentinel for detection and response. Option B is incorrect because a scheduled query would be less efficient and not leverage ID Protection's risk assessments. Option D is incorrect because custom detection rules are less accurate than ID Protection's machine learning.

Answer

Create a Microsoft Sentinel scheduled analytics rule that queries sign-in logs for unusual location and new device, then trigger a playbook to block the user and reset password.

Answer

Create a custom detection rule in Microsoft Defender XDR for the attack pattern and configure an automated action to block the user.

Answer

Enable Microsoft Entra ID Protection and configure a risk-based Conditional Access policy to block access and require password change.

Question 19

Your organization uses Microsoft Entra ID for identity management and wants to implement a least-privilege access model for administrators. You need to reduce standing privileges and ensure that admin roles are activated only when needed with approval workflow. Requirements: (1) Require approval for activation of Global Administrator role, (2) Set activation duration to 4 hours maximum, (3) Require Azure MFA for activation, (4) Receive notifications when roles are activated, (5) Audit all activations for compliance. Which Microsoft Entra ID capability should you use?

Accepted Answer

Privileged Identity Management (PIM). Option C is correct because Privileged Identity Management (PIM) in Microsoft Entra ID P2 provides just-in-time role activation with approval, MFA, time limits, notifications, and audit. Option A is wrong because Conditional Access does not manage role activation. Option B is wrong because Identity Protection is for risk detection. Option D is wrong because Access Reviews are for periodic reviews, not activation workflows.

Answer

Access Reviews

Answer

Identity Protection

Answer

Conditional Access

Question 20

Your organization uses Microsoft Intune and Microsoft Defender for Endpoint. You need to design a solution that ensures all Windows 10 devices are running the latest security updates and have real-time protection enabled. If a device is non-compliant, it should be blocked from accessing corporate resources. You have already created a Conditional Access policy that requires compliant devices. You need to configure the compliance requirements and automatic remediation. What should you do?

Accepted Answer

Create an Intune device compliance policy that requires minimum OS version and real-time protection, and create a remediation policy that automatically enables real-time protection if disabled.. Option B is correct because Intune compliance policies can check for minimum OS version and require Defender for Endpoint health status, and remediation policies can automatically enforce settings. Option A is incorrect because it does not address automatic remediation. Option C is incorrect because configuration profiles deploy settings but do not enforce compliance. Option D is incorrect because app protection policies are for app-level data.

Answer

Create an Intune device configuration profile that enforces the minimum OS version and enables real-time protection.

Answer

Create an Intune app protection policy that requires the device to have the latest updates and real-time protection.

Answer

Create an Intune device compliance policy that requires minimum OS version and real-time protection, and use the Conditional Access policy to block non-compliant devices.