Microsoft SC-100 Exam Dumps

You have a Microsoft 365 tenant that uses Microsoft SharePoint Online and Microsoft Purview. Microsoft Purview has a sensitivity label named Label1 that is applied to the files stored on SharePoint Online sites. You need to recommend a Microsoft Purview Data Loss Prevention (DLP) policy that meets the following requirements: • Prevents users from uploading the files to third-party external websites • Allows users to upload the files to Microsoft OneDrive for Business To which location should you apply the DLP policy?

You have an Azure subscription that contains 100 virtual machines, a virtual network named VNet1, and 20 users. The virtual machines run Windows Server and are connected to VNet1. The users work remotely and access Azure resources from Linux workstations. You need to ensure that the users can connect to the virtual machines from the workstations by using Secure Shell {SSH). The solution must meet the following requirements: • Ensure that the users authenticate by using their Microsoft Entra credentials. • Prevent the users from transferring files from the virtual machines by using SSH. • Prevent the users from directly accessing the virtual machines by using the public IP address of the virtual machines. What should you include in the solution?

You are designing the encryption standards for data at rest for an Azure resource You need to provide recommendations to ensure that the data at rest is encrypted by using AES-256 keys. The solution must support rotating the encryption keys monthly. Solution: For Azure SQL databases, you recommend Transparent Data Encryption (TDE) that uses customer-managed keys (CMKs). Does this meet the goal?

You have an Azure subscription that contains virtual machines, storage accounts, and Azure SQL databases. All resources are backed up multiple times a day by using Azure Backup. You are developing a strategy to protect against ransomware attacks. You need to recommend which controls must be enabled to ensure that Azure Backup can be used to restore the resources in the event of a successful ransomware attack. Which two controls should you include in the recommendation? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.

You are designing a ransomware response plan that follows Microsoft Security Best PracticesYou need to recommend a solution to limit the scope of damage of ransomware attacks without being locked out. What should you include in the recommendations? 

You have an Azure subscription that contains multiple Azure Blob Storage accounts. You need to recommend a solution to detect threats in files after the files are uploaded to a blob container. What should you include in the recommendation?

You have the following on-premises servers that run Windows Server: • Two domain controllers in an Active Directory Domain Services (AD DS) domain • Two application servers named Server1 and Server2 that run ASP.NET web apps • A VPN server named Server3 that authenticates by using RADIUS and AD DS End users use a VPN to access the web apps over the internet. You need to redesign a user access solution to increase the security of the connections to the web apps. The solution must minimize the attack surface and follow the Zero Trust principles of the Microsoft Cybersecurity Reference Architectures (MCRA). What should you include in the recommendation?

Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem. After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen. You have a Microsoft 365 subscription that uses Microsoft Defender XDR. The subscription contains 500 devices that are enrolled in Microsoft Intune. The subscription contains 500 users that connect to external software as a service (SaaS) apps by using the devices. You need to implement a solution that meets the following requirements: • Allows user access to SaaS apps that Microsoft has identified as low risk. • Blocks user access to Saas apps that Microsoft has identified as high risk. Solution: You configure app protection policies in Intune, and you create a Conditional Access policy. Does this meet the goal?

You have a Microsoft 365 subscription that contains a group named Group1. The subscription contains 1,000 Windows devices that are joined to a Microsoft Entra tenant and managed by using Microsoft Intune. All users sign in to the devices by using standard user accounts. You plan to deploy a new app named App1 to the members of Group1. The Group1 members must have administrative rights to install new versions of App1. You need to ensure that the Group1 members can install new versions of App1. The solution must follow the principles of Zero Trust. What should you implement?

You have a multicloud environment that contains an Azure subscription, an Amazon Web Services (AWS) subscription, and a Google Cloud Platform (GCP) subscription. You plan to assess data security and compliance. You need to design a Compliance Manager solution that meets the following requirements: • Provides recommended improvement actions that include detailed implementation guidance • Automatically monitors regulatory compliance • Minimizes administrative effort What should you include in the solution?

You have an Azure subscription. You plan to deploy Azure App Services apps by using Azure DevOps. You need to recommend a solution to ensure that deployed apps maintain compliance with Microsoft cloud security benchmark (MCSB) recommendations. What should you include in the recommendation?

You have on-premises Windows 11 devices that have the Global Secure Access client deployed. You have a Microsoft 365 subscription that uses Microsoft SharePoint Online and Exchange Online. You deploy Microsoft Entra Internet Access from the on-premises network to Microsoft 365. The deployment has the Microsoft 365 profile enabled and contains the following: • Default traffic policies for Microsoft 365 services • A linked Conditional Access policy that performs compliant network checks with continuous access evaluation and is applied to all users • An assignment to all the devices • An assignment to a remote network associated with the on-premises network Which Microsoft 365 resources are protected by using continuous access evaluation? 

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure subscription that has Microsoft Defender for Cloud enabled. You are evaluating the Azure Security Benchmark V3 report. In the Secure management ports controls, you discover that you have 0 out of a potential 8 points. You need to recommend configurations to increase the score of the Secure management ports controls. Solution: You recommend enabling the VMAccess extension on all virtual machines. Does this meet the goal? 

You have a Microsoft 365 tenant named contoso.com. You need to ensure that users can authenticate only to contoso.com. The solution must meet the following requirements: • Prevent the users from authenticating to other Microsoft 365 tenants. • Minimize administrative effort. What should you use?

You have a Microsoft 365 subscription. You have an Azure subscription. You need to implement a Microsoft Purview communication compliance solution for Microsoft Teams and Yammer. The solution must meet the following requirements: • Assign compliance policies to Microsoft 365 groups based on custom Microsoft Exchange Online attributes. • Minimize the number of compliance policies • Minimize administrative effort What should you include in the solution?

Your company plans to evaluate the security of its Azure environment based on the principles of the Microsoft Cloud Adoption Framework for Azure. You need to recommend a cloud-based service to evaluate whether the Azure resources comply with the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF). What should you recommend?

You have an on-premises network and a Microsoft 365 subscription. You are designing a Zero Trust security strategy. Which two security controls should you include as part of the Zero Trust solution? Each correct answer part of the solution. NOTE: Each correct answer is worth one point.

Your on-premises network contains an Active Directory Domain Services (AD DS) domain and a hybrid deployment between a Microsoft Exchange Server 2019 organization and an Exchange Online tenant. The AD DS domain contains a group named Group1. Group1 is a member of the Organization Management role group for the Exchange deployment. You have a Microsoft 365 E5 subscription that uses Microsoft Defender. You have an Azure subscription that uses Microsoft Sentinel. You need to recommend a solution to ensure that Group1 is marked as a sensitive group and that any changes made to Group1 raises an alert in Microsoft Sentinel. The solution must minimize administrative effort. What should you include in the recommendation?

You are designing the encryption standards for data at rest for an Azure resource You need to provide recommendations to ensure that the data at rest is encrypted by using AES-256 keys. The solution must support rotating the encryption keys monthly. Solution: For blob containers in Azure Storage, you recommend encryption that uses Microsoft-managed keys within an encryption scope. Does this meet the goal? 

Your company wants to optimize using Microsoft Defender for Endpoint to protect its resources against ransomware based on Microsoft Security Best Practices. You need to prepare a post-breach response plan for compromised computers based on the Microsoft Detection and Response Team (DART) approach in Microsoft Security Best Practices. What should you include in the response plan?

Your company has a main office and 10 branch offices. Each branch office contains an onpremises file server that runs Windows Server and multiple devices that run either Windows 11 or macOS. The devices are enrolled in Microsoft Intune. You have a Microsoft Entra tenant. You need to deploy Global Secure Access to implement web filtering for device traffic to the internet The solution must ensure that all the web traffic from the devices in the branch offices is controlled by using Global Secure Access. What should you do first in each branch office?

You are designing a security operations strategy based on the Zero Trust framework. You need to minimize the operational load on Tier 1 Microsoft Security Operations Center (SOC) analysts. What should you do?

Your company is designing an application architecture for Azure App Service Environment (ASE) web apps as shown in the exhibit. (Click the Exhibit tab.) Communication between the on-premises network and Azure uses an ExpressRoute connection. You need to recommend a solution to ensure that the web apps can communicate with the on-premises application server. The solution must minimize the number of public IP addresses that are allowed to access the on-premises network. What should you include in the recommendation?

You have an Azure subscription and a Microsoft 365 subscription. All users are assigned Microsoft 365 E5 licenses. All computers run Windows 11 and are Microsoft Entra joined. You need to recommend a solution to prevent computers that run early builds of Windows 11 from connecting to Microsoft 365 services. Which two types of policies should you include in the recommendation? Each correct answer presents part of the solution. 

You have a Microsoft 365 subscription. You are designing a user access solution that follows the Zero Trust principles of the Microsoft Cybersecurity Reference Architectures (MCRA). You need to recommend a solution that automatically restricts access to Microsoft Exchange Online. SharePoint Online, and Teams m near-real-lime (NRT) in response to the following Azure AD events: • A user account is disabled or deleted • The password of a user is changed or reset. • All the refresh tokens for a user are revoked • Multi-factor authentication (MFA) is enabled for a user Which two features should you include in the recommendation? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.