SC900 Kindle IP Specialist Flashcards
A company wants to make use of Windows Hello for business when it comes to authentication. Which of the following are the authentication methods available for Windows Hello for business?
A. PIN
B. Facial Recognition
C. Email message
D. Password
E. Fingerprint recognition
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 15). Kindle Edition.
A. PIN
B. Facial Recognition
E. Fingerprint recognition
Explanation:
The entire purpose of Windows Hello for Business is to ensure passwords are not used in the authentication process. Here, users can use other techniques for authentication via the use of PINs and bio metric recognitions
Your company has just set up an Azure subscription. They have the following requirements. “Be capable of executing a set of resources, resource groups, and role assignments to a set of subscriptions.” Which of the following can be applied to meet the requirement?
A. Apply lock to an Azure Policy
B. Apply lock to an Azure Blueprints
C. Apply lock to an Azure AD Identity Protection
D. Apply lock to an Azure Resource Group
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (pp. 15-16). Kindle Edition.
D. Apply lock to an Azure Resource Group
Explanation:
Here, you can define a lock on an Azure resource group. This would ensure that no one accidentally deletes resources in a resource group
You are considering the use of sensitivity labels in Microsoft 365. Can sensitivity labels be used to encode the lists in documents?
A. Yes
B. B. No
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 16). Kindle Edition.
A. Yes
Explanation:
When you use a Confidential label on a document, the label will encode the content in the document
You are planning on making use of the Azure Bastion service. Can you use the Azure Bastion service to limit traffic from the Internet onto an Azure virtual machine?
A. Yes
B. No
- You are looking at the capabilities of Azure Active Directory. Can you use Azure Active Directory to achieve device registrations in Azure Active Directory? A. Yes B. No
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 16). Kindle Edition.
B. No
Explanation:
You cannot use the Azure Bastion service to limit traffic into a Virtual machine. For this, you will want to use network security groups
Your company is planning on using Azure Cloud Services. Which of the following can be used to ensure that data can be read only by authorized users?
A. Encryption
B. Deduplication
C. Archiving
D. Compression
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 16). Kindle Edition.
A. Encryption
Explanation:
You can ensure data is encrypted. The encryption key can then be sued to decode and read out the data
Your company is planning on using Azure Active Directory to store identities. They need to make use of the self-service password reset feature. Which of the following authentication methods are accessible for self-service password reset?
A. Email
B. A passport Identification Number
C. A picture Message
D. Mobile App Notification
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 17). Kindle Edition.
Which of the following is a management and security orchestration automated response solution?
A. Azure Sentinel
B. Microsoft Defender for Cloud
C. Azure Active Directory
D. Azure AD Identity Protection
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 17). Kindle Edition.
A. Azure Sentinel
Explanation:
Azure Sentinel has the potential to consume data from a variety of sources and perform threat monitoring on that data
Which of the following offers advanced and intelligent protection of Azure and hybrid resources and workloads?
A. Azure Defender
B. Azure Policies
C. Azure Blueprints
D. Azure Active Directory
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 17). Kindle Edition.
A. Azure Defender
Explanation:
With Azure Defender, you can allow intelligent protection of your resources specified in Azure and your on premises infrastructure
Which of the following is available for the Azure Application Gateway service that helps to protect web applications from common exploits and vulnerabilities?
A. Azure Firewall
B. Azure Web Application Firewall
C. Azure Policy
D. Azure Identity Protection
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (pp. 17-18). Kindle Edition.
B. Azure Web Application Firewall
Explanation:
The Azure WAF can be used along with the Azure Application Gateway resource to defend web applications from common activities and vulnerabilities
You are evaluating the different services available in Azure when regarding security. Which of the following can be achieved using the Azure Privileged Identity Managed service?
A. Filter traffic to Azure virtual machines
B. Allow Multi-Factor Authentication for users
C. Offer just-in-time access to resource roles
D. Determine the security posture of resources
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 18). Kindle Edition.
C. Offer just-in-time access to resource roles
Explanation:
With Azure Privileged Identity Management, you can offer just in time access to Azure AD roles and resource roles
And the right to use can be allowed or rejected accordingly
You are evaluating the different discovery tools available in Microsoft 365. You want to be capable of quickly getting the email in your own Exchange mailboxes. Which of the following would you use for this need?
A. Core eDiscovery
B. Advanced eDiscovery
C. Sensitivity Labels
D. Content Search
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 18). Kindle Edition.
D. Content Search
Explanation:
The Content Search tool can be used to quickly find the email in Exchange mailboxes, documents in SharePoint sites, and OneDrive locations
You are evaluating the different discovery tools available in Microsoft 365. You want basic capabilities for exploring and exporting content in Microsoft 365. Which of the following would you use for this need?
A. Core eDiscovery
B. Privileged Access Management
C. Sensitivity Labels
D. Content Search
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 18). Kindle Edition.
D. Content Search
Explanation:
The Content search tool can be used to quickly find the email in Exchange mailboxes, documents in SharePoint sites and OneDrive locations
Which two types of resources can be protected by using Azure Firewall?
A. Azure Virtual Machines
B. Azure Active Directory (Azure AD) Users
C. Microsoft Exchange Online Inboxes
D. Azure Virtual Networks
E. Microsoft SharePoint Online Sites
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (pp. 18-19). Kindle Edition.
A. Azure Virtual Machines
D. Azure Virtual Networks
Explanation:
When it is formed, the services and Virtual Machines within the Azure network connect securely with each other
You plan to implement a security strategy and place multiple layers of defense throughout a network infrastructure. Which security methodology does this represent?
A. Threat Modeling
B. Identity as the Security Perimeter
C. Defense in Depth
D. The Shared Responsibility Model
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 19). Kindle Edition.
C. Defense in Depth
Explanation:
The Objective of defense in depth is to protect information and prevent it from being stolen by those who are not authorized to access it
What can you use to scan email attachments and forward the attachments to recipients only if the attachments are free from malware?
A. Microsoft Defender for Office 365
B. Microsoft Defender Antivirus
C. Microsoft Defender for Identity
D. Microsoft Defender for Endpoint
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 19). Kindle Edition.
- Which feature provides the Extended Detection and Response (XDR) capability of Azure Sentinel?
A. Combination with the Dynamic 365
B. Support for Threat Hunting
C. Integration with Microsoft 365 Defender
D. Support for Azure Monitor Workbooks
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 19). Kindle Edition.
What should you use in the Microsoft 365 Defender portal to view security trends and track the protection status of identities? A. Attack simulator B. Reports C. Hunting D. Incidents
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 19). Kindle Edition.
You have a Microsoft 365 E3 subscription. You plan to audit user activity by using the integrated audit log and Basic Audit. For how long will the audit records be maintained?
A. 15 days
B. 30 days
C. 90 days
D. 180 days
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (pp. 19-20). Kindle Edition.
C. 90 days
Explanation:
In the Basic Audit, audit records are maintained and searchable for the last 90 days. To recover an audit log for a longer period, you should adopt Advanced Auditing
To which type of resource can Azure Bastion provide secure access?
A. Azure Files
B. Azure SQL Managed Instances
C. Azure Virtual Machines
D. Azure App Service
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 20). Kindle Edition.
C. Azure Virtual Machines
Explanation:
Azure Bastion offers secure and seamless RDP/SSH connectivity to your virtual machines directly from the Azure portal over TLS
What is an example of encryption at rest?
A. Encoding communications by using a site-to-site VPN
B. Encrypting a virtual machine disk
C. Logging into a website by using an encrypted HTTPS connection
D. Sending an encrypted email
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 20). Kindle Edition.
B. Encrypting a virtual machine disk
Explanation:
Encryption at Rest is a common security requirement. Organizations have the choice of allowing Azure to completely manage Encryption at Rest
- Which three statements accurately describe the guiding principles of Zero Trust?
A. Define the perimeter by physical locations
B. Use identity as the main security boundary
C. Validate the permissions of a user explicitly
D. Assume that the user system can be violated E. Use the network as the primary security boundary
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 20). Kindle Edition.
B. Use identity as the main security boundary
C. Validate the permissions of a user explicitly
D. Assume that the user system can be violated E. Use the network as the primary security boundary
Explanation:
A Zero Trust approach must extend throughout the complete digital estate and serve as an integrated security philosophy and end to end strategy
This is done by applying Zero Trust controls and technologies
What can you use to provide a user with a two-hour window to complete an administrative task in Azure?
A. Azure AD PIM
B. Azure MFA
C. Azure AD Identity Protection
D. Conditional Access Policies
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (pp. 20-21). Kindle Edition.
D. Conditional Access Policies
Explanation:
Conditional Access templates are created to offer a convenient method to deploy new policies associated with Microsoft recommendations
Which score measures an organization’s progress in completing actions that help reduce risks associated with data protection and regulatory standards?
A. Microsoft Secure Score
B. Productivity Score
C. Secure score in Azure Defender
D. Compliance Score
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 21). Kindle Edition.
D. Compliance Score
Explanation:
The Compliance Manage dashboard shows your overall compliance score. This score determines your progress in completing recommended recovery actions within controls
What do you use to provide real-time integration between Azure Sentinel and another security source? A. Azure AD Connect B. A Log Analytics Workspace C. Azure Information Protection D. A Connector
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 21). Kindle Edition.
Which Microsoft portal provides information about how Microsoft cloud services comply with the regulatory standard, such as International Organization for Standardization (ISO)?
A. The Microsoft Endpoint Manager Admin Center
B. Azure Cost Management + Billing
C. Microsoft Service Trust Portal
D. The Azure Active Directory Admin Center
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 21). Kindle Edition.
C. Microsoft Service Trust Portal
Explanation:
The Microsoft Service Trust Portal includes details about Microsoft implementation of controls and processes that defend our cloud services and the customer data therein
- In the shared responsibility model for Azure deployment, what is Microsoft solely responsible for managing?
A. The management of mobile devices
B. The permissions for the user data stored in Azure
C. The formation and management of user accounts
D. The management of the physical hardware
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 21). Kindle Edition.
D. The management of the physical hardware
Explanation:
For all cloud deployment types, you have your data and identities. You are accountable for keeping the security of your data and identities, on premise resources and the cloud components you control.
- In the Microsoft Cloud Adoption Framework for Azure, which two phases are addressed before the Ready phase?
A. Plan
B. Manage
C. Adopt
D. Govern
E. Define Strategy
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 22). Kindle Edition.
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (pp. 21-22). Kindle Edition.
A. Plan
E. Define Strategy
Explanation:
The Microsoft Cloud Adoption Framework for Azure is a comprehensive lifecycle framework that helps business decision markers, IT experts and cloud architects realize their cloud adoption objectives. You may develop and implement business and technology strategies for the cloud with the support of the best practices, documentation and tools provided by this resource
Which of the following provides advanced and intelligent protection of Azure and hybrid resources and workloads?
A. Azure Defender
B. Azure Policies
C. Azure Blueprints
D. Azure Active Directory
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 22). Kindle Edition.
A. Azure Defender
Explanation:
With Azure Defender, you can allow intelligent protection of your resources specified in Azure and your on premises infrastructure
Which of the following is available for the Azure Application Gateway service that helps to protect web applications from common exploits and vulnerabilities?
A. Azure Firewall
B. Azure Web Application Firewall
C. Azure Policy
D. Azure Identity Protection
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 22). Kindle Edition.
B. Azure Web Application Firewall
Explanation:
The Azure Firewall service is a managed service that can be used to defend your Azure virtual network resources. But it cannot be used to encrypt the inbound traffic onto Azure virtual machines
- You are planning on using the Azure Firewall service. Can you use the Azure Firewall service to encrypt inbound network traffic to Azure virtual machines? A. Yes B. No
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 22). Kindle Edition.
You are considering using Azure Active Directory Access Reviews. Can you use Azure AD Access evaluations to review group memberships for users specified in Azure AD?
A. Yes
B. No
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 22). Kindle Edition.
A. Yes
Explanation:
When you make an Access Review in Azure Active Directory, you can check the access of users to teams and groups
Which of the following maps to the below encryption technique? “Encrypting information that dwells in constant storage on physical media.”
A. Encryption in transit
B. Encryption at rest
C. In-memory Encryption
D. SSL Encryption
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (pp. 22-23). Kindle Edition.
B. Encryption at rest
Explanation:
Encryption at rest ensures that the data is encrypted when it is stored on disk, preventing the attacker from accessing the unencrypted data
If an attacker gets their hands on a hard disc containing encrypted data but not the encryption keys, they will need to circumvent the encryption in order to access the data
Your company is planning on using Azure Active Directory Privileged Identity Management. Can Privileged Identity Management be used to offer time-bound assignments for Azure resources?
A. Yes
B. No
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 23). Kindle Edition.
A. Yes
Explanation:
You can give time-bound entry to Azure resources. Below is a screenshot of the page of Privileged Identity Management for Azure resources.
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 100). Kindle Edition.
Your company is planning on making use of Azure Blueprints. Can Azure Blueprints be used to make role assignments for an Azure subscription?
A. Yes
B. No
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 23). Kindle Edition.
A. Yes
Explanation:
When you make an Azure Blueprint, you can generate multiple artifacts as part of the Blueprint. One of them is role assignments.
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 101). Kindle Edition.
Your company is currently looking at using the Azure Policy service. Can the Azure Policy service be used to remediate issues identified via its compliance checks?
A. Yes
B. No
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 23). Kindle Edition.
A. Yes
Explanation:
Some of the policies in Azure Policy have a Remediation portion, which can be used to remediate issues if the resources do not align with the policy.
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 102). Kindle Edition.
You have a set of resources in Azure. Can you add a delete lock that has a read-only lock?
A. Yes
B. No
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 23). Kindle Edition.
A. Yes
Explanation:
Yes this is possible
Your company wants to start using Azure and is looking at its different security features. Which of the following could be used for the following need? “Be capable of syncing users from the on-premises Active Directory onto Azure AD.”
A. Azure AD Identity Management
B. Azure Conditional Access
C. Azure AD Roles
D. Azure AD Connect
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (pp. 23-24). Kindle Edition.
D. Azure AD Connect
Explanation:
Azure AD Connect coordinates identities from the on-premises Active Directory onto Azure Active Directory. There are different techniques available for user identity synchronization.
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 103). Kindle Edition.
What features do Azure Sentinel Advanced Detection and Response (XDR) provide?
A. Integration with Microsoft 365 Compliance Center
B. Threat Hunting Support
C. Integration with Microsoft 365 Defender
D. Azure Monitor Workbook Support
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 24). Kindle Edition.
C. Integration with Microsoft 365 Defender
Explanation:
An extended detection and response (XDR) tool called Microsoft 365 Defender automatically gathers, correlates, and assesses signal, threat, and alert data from all areas of your Microsoft 365 system, including endpoints, email, applications, and identities. To automatically thwart attacks and restore damaged assets to a secure state, it makes use of automation and artificial intelligence (AI). More than 70% of the time, remediation is totally automated by built-in self-healing technology, freeing up defenders to concentrate on other duties that make greater use of their knowledge and experience.
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (pp. 103-104). Kindle Edition.
What can you use for the provision of the two-hour window for a user to complete an administrative task in Azure?
A. Azure Active Directory (Azure AD) Privileged Identity Management (PIM)
B. Azure Multi-Factor Authentication (MFA)
C. Azure Active Directory (Azure AD) Identity Protection D. Conditional Access Policies
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 24). Kindle Edition.
A. Azure Active Directory (Azure AD) Privileged Identity Management (PIM)
Explanation:
Privileged Identity Management provides time-based and approval-based role activation to mitigate the risks of excessive, unnecessary, or misused access permissions on resources you care about. Here are some of the key features of Privileged Identity Management: Provide just-in-time privileged access to Azure AD and Azure resources Assign time-bound access to resources using start and end dates Require approval to activate privileged roles Enforce multi-factor authentication to activate any role Use justification to understand why users activate Get notifications when privileged roles are activated Conduct access reviews to ensure users still need roles Download audit history for internal or external audit Prevents removal of the last active Global Administrator role assignment
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 104). Kindle Edition.
Which kind of asset can be safeguarded by utilizing Azure Firewall?
A. Azure Virtual Machines
B. Azure Active Directory (Azure AD) Users
C. Microsoft Exchange Online Inboxes
D. Azure Virtual Networks
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 24). Kindle Edition.
D. Azure Virtual Networks
Explanation:
Network Watcher is a provincial help that empowers you to screen and analyze conditions at an organization’s situation level in, to, and from Azure. Situation-level observation empowers you to analyze issues at a start-to-finish network-level view. It is expected to have an organization watcher asset gathering to be made in each area where a virtual organization is available. An alarm is empowered in the event that an organization watcher asset bunch is not accessible in a specific locale.
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 105). Kindle Edition.
You intend to carry out a security procedure and spot various layers of defense all through an organization’s framework. Which security system does this address?
A. Threat Modeling
B. Identity as the Security Perimeter
C. Defense in Depth
D. The Shared Responsibility Model
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (pp. 24-25). Kindle Edition.
C. Defense in Depth
Explanation:
Defense in depth is a layered approach to security, which does not allow you to relying on a single perimeter. A defense in depth strategy has a series of ongoing mechanisms to lessen the pace of the furtherance of an attack. Each layer provides a shield so that a succession layer will prevent an attacker from getting unauthorized access to data if one layer is violated. Example layers of security include: Physical Physical security means limiting access to a data center that only undergoes ingress by authorized personnel. Identity and Access It includes the security controls, such as multi-factor authentication or condition-based access, to control the admittance to infrastructure and change control. Perimeter This security includes Distributed Denial of Service (DDoS) protection to filter large-scale attacks before they can cause a denial of service for users. Network Network security means network segmentation and access controls so that communication between resources can be limited. Compute Compute layer security means securing access to virtual machines either on-premises or in the cloud by closing certain ports. Application Application layer security ensures that applications are secure and free of security weaknesses and vulnerabilities. Data Data layer security includes the controls to manage business and customer data access. The data is protected through encryption. For further details, you can visit the given URL.
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (pp. 105-107). Kindle Edition.
What can you use to scan email attachments and only forward them to recipients if they are malware-free?
A.Microsoft Defender for Office 365
B. Microsoft Defender Antivirus
C.Microsoft Defender for Identity
D.Microsoft Defender for Endpoint
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 25). Kindle Edition.
A.Microsoft Defender for Office 365
Explanation:
Microsoft Defender for Office 365 is a cloud-based email filtering service that helps protect your organization from advanced threats such as phishing, business email compromise, and malware attacks that target email and collaboration tools. Defender for Office 365 also includes investigation, hunting, and remediation tools to assist security teams in identifying, prioritizing, investigating, and responding to threats. Safe Attachments is an element in Microsoft Defender for Office 365 that involves a virtual environment to browse connections in inbound email messages after they have been examined by anti-malware protection in Exchange Online Protection (EOP), however before conveyance to beneficiaries
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 107). Kindle Edition.
What tools can you use to detect threats in Azure SQL Managed Instance?
A. Microsoft Secure Score
B. application Security Groups
C. Azure Defender
D. Azure Bastion
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 25). Kindle Edition.
C. Azure Defender
Explanation:
Advanced Threat Protection for an Azure SQL Managed Instance detects unexpected and potentially hazardous attempts to access or exploit databases by detecting abnormal behaviors. Potential SQL injection, access from an odd location or datacenter access from an unfamiliar principal or potentially hazardous application, and brute force SQL credentials are all things that Advanced Threat Protection can detect. Click the View ongoing SQL, which will connect the email to send the Azure entrance and show the Microsoft Defender for Cloud alarms page, which outlines dynamic dangers recognized on the information base.
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 108). Kindle Edition.
Which Azure Active Directory (Azure AD) element might you at any point use to limit Microsoft Intune devices from getting to corporate assets?
A.Network Security Groups (NSGs)
B.Azure AD Privileged Identity Management (PIM)
C. Conditional Access Policies
D. Resource Locks
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 25). Kindle Edition.
C. Conditional Access Policies
Explanation:
Conditional Access brings signals together to make decisions and enforce organizational policies. Azure AD Conditional Access is the core of the new identity-driven control plane. Common decisions of Azure AD Conditional Access: Block access Most restrictive decisions of Azure AD Conditional Access: Grant access For the least restrictive decision, one or more of the following options would be needed: Require multi-factor authentication Require device to be marked as compliant Require Hybrid Azure AD joined device Require approved client app Require app protection policy
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (pp. 108-109). Kindle Edition.
Azure Bastion can enable secure access to which types of resources?
A. Azure Files
B.Azure SQL Managed Instances
C. Azure Virtual Machines
D. Azure App Service
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 25). Kindle Edition.
C. Azure Virtual Machines
Explanation:
Azure Bastion allows you to access your virtual machines through RDP/SSH over TLS directly from the Azure site
What is a good reason to adopt Microsoft 365’s information barrier policies?
A.To restrict unauthenticated access to Microsoft 365 B.To restrict Microsoft Teams chats between certain groups within an organization
C.To restrict Microsoft Exchange Online email between certain groups within an organization
D.To restrict data sharing to external email recipients
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 26). Kindle Edition.
C.To restrict Microsoft Exchange Online email between certain groups within an organization
Explanation:
You can set policies using Microsoft Purview Information Barriers to restrict certain users from communicating with each other or let specified segments speak only with specific other segments.
You will use user account attributes, segments, ‘block’ and/or ‘allow’ policies, and policy application to construct policies for information barriers. In Azure Active Directory, user account attributes are defined (or Exchange Online). Department, job title, location, team name, and other job profile characteristics are examples of these features. Segments are groups of users in the Microsoft Purview compliance portal defined by a user account attribute. You have defined your barrier policies and are ready to implement them in your company.
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (pp. 109-110). Kindle Edition.
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 109). Kindle Edition.
Which score indicates how far a company has progressed in completing initiatives that help lower the risks associated with data security and regulatory compliance?
A. Microsoft Secure Score
B. Productivity Score
C.Secure score in Azure Defender
D. Compliance Score
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 26). Kindle Edition.
D. Compliance Score
Explanation:
Microsoft Purview Compliance Manager is a function of the Microsoft Purview compliance portal that makes handling your organization’s compliance obligations easier and more convenient. Compliance Manager can assist you with every step of the way, from assessing your data security threats to managing the intricacies of installing controls, remaining current with requirements and certifications, and reporting to auditors.
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 110). Kindle Edition.
Which Microsoft portal provides details on how Microsoft cloud services adhere to regulatory standards such as those set forth by the International Organization for Standardization (ISO)?
A.The Microsoft Endpoint Manager Admin Center B.Azure Cost Management + Billing
C.Microsoft Service Trust Portal
D.The Azure Active Directory Admin Center
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 26). Kindle Edition.
C.Microsoft Service Trust Portal
Explanation:
The Microsoft Services Trust Portal provides details on Microsoft’s implementation of cloud services and the controls and processes that protect the customer data they contain. For further details, you can visit the given URL.
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 110). Kindle Edition.
What is Microsoft’s sole duty in the shared responsibility paradigm for an Azure deployment?
A.The management of mobile devices
B.The permissions for the user data stored in Azure C.The creation and management of user accounts D.The management of the physical hardware
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 26). Kindle Edition.
D.The management of the physical hardware
Explanation:
It is vital to understand the shared responsibility model, which security activities are handled by the cloud provider, and which tasks you handle when you investigate and evaluate public cloud services. Depending on whether the workload is hosted in a Software as a Service (SaaS), Platform as a Service (PaaS), Infrastructure as a Service (IaaS), or on-premises datacenter, the workload duties differ. Responsibility is shared. You own the entire stack in an on-premises data center. Some duties are transferred to Microsoft as you move to the cloud. According to the type of stack deployment, the following graphic depicts the regions of responsibility between you and Microsoft. You own your data and identities regardless of the cloud deployment method. You are responsible for the security of your data and identities and your on-premises resources and cloud components (which vary by service type). You are always responsible for the following obligations, regardless of the method of deployment: Account Access Management Data Endpoints
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 111). Kindle Edition.
Give an example of encryption at rest.
A.Encrypting communications by using a site-to-site VPN
B.Encrypting a virtual machine disk
C.Accessing a website by using an encrypted HTTPS connection
D.Sending an encrypted email
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 27). Kindle Edition.
B.Encrypting a virtual machine disk
Explanation:
Encryption at Rest is a typical security necessity. In Azure, associations can encrypt information at rest without the gamble or cost of a custom key administration solution. Associations have the choice of allowing Azure totally to manage Encryption at Rest. Also, associations have different choices to intently manage encryption or encryption keys.
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 112). Kindle Edition.
What is the purpose of Password Protection in Azure Active Directory (Azure AD)?
A.To control how often users must change their passwords
B.To identify devices to which users can sign in without using Multi-Factor Authentication (MFA)
C.To encrypt a password by using globally recognized encryption standards
D.To prevent users from using specific words in their passwords
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 27). Kindle Edition.
D.To prevent users from using specific words in their passwords
Explanation:
Azure Active Directory Password Protection detects and blocks recognized weak passwords and their variants and new weak keywords unique to your business. Default global banned password lists are automatically applied to all users in an Azure AD tenant using Azure AD Password Protection. You can create a bespoke banned password list to meet your specific business and security needs.
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 112). Kindle Edition.
Which Azure Active Directory (Azure AD) component could you at any point use to assess group membership and naturally eliminate clients that never again require membership in a group?
A. Access Reviews
B. Managed Identities
C. Conditional Access Policies D.Azure Ad Identity Protection
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 27). Kindle Edition.
A. Access Reviews
Explanation:
Azure Active Directory (Azure AD) access reviews empower associations to effectively manage group enrollments, admittance to big business applications, and job tasks.
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 112). Kindle Edition.
Which Microsoft 365 feature could you use at any point to limit correspondence and information sharing among individuals from two divisions at your association?
A. Sensitivity Label Policies
B. Customer Lockbox
C. Information Barriers
D.Privileged Access Management (PAM)
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 27). Kindle Edition.
C. Information Barriers
Explanation:
Microsoft Teams, SharePoint Online, and OneDrive for Business support data boundaries. Accepting your membership incorporates information barriers, a consistence executive, or data boundaries chairman can characterize approaches to permit or forestall interchanges between gatherings of clients in Microsoft Teams. Data information barriers can be utilized for circumstances like these: Client in the informal investor gathering should not impart or impart documents to the showcasing group Finance faculty chipping away at secret organization data should not convey or impart records to specific gatherings inside their association An inside group with proprietary advantage material should not call or talk online with individuals in specific gatherings inside their association An exploration group ought to just call or talk online with an item improvement group A site for informal investor gathering ought not to be shared to anybody outside the informal investor bunch
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 113). Kindle Edition.
You have an Azure membership. You really want to execute endorsement-based, time-bound job actuation. Which of the following would be recommended for you to utilize?
A.Windows Hello for Business
B.Azure Active Directory (Azure AD) Identity Protection C.access reviews in Azure Active Directory (Azure AD) D.Azure Active Directory (Azure AD) Privileged Identity Management (PIM)
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 28). Kindle Edition.
D.Azure Active Directory (Azure AD) Privileged Identity Management (PIM)
Explanation:
Privileged Identity Management (PIM) is an Azure Active Directory (Azure AD) assistant that empowers you to make due, control, and screen admittance to significant assets in your association. These assets remember assets for Azure AD, Azure, and other Microsoft Online Services, for example, Microsoft 365 or Microsoft Intune Associations need to limit the number of individuals who approach secure data or assets since that lessens the opportunity of a vindictive entertainer gaining admittance to an approved client, unintentionally affecting a delicate asset. Notwithstanding, clients actually need to do special tasks in Azure AD, Azure, Microsoft 365, or SaaS applications. Associations can give clients in the nick of time-restricted admittance to Endlessly sky blue AD assets and supervise how those clients are doing their restricted admittance.
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (pp. 113-114). Kindle Edition.
What kind of identity is made when registering an application with Active Directory (Azure AD)?
A. A user account
B.A user-assigned managed identity
C.A system-assigned managed identity
D. A service principal
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 28). Kindle Edition.
D. A service principal
Explanation:
Whenever you register an application through the Azure portal, an application item and administration principles are consequently made in your home registry or occupant.
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 114). Kindle Edition.
Which of the following uses a tiered security technique to delay an attack’s progress?
A. Shared Responsibility Model
B. Zero-Trust Methodology
C. CIA Model
D. Defense in Depth
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 28). Kindle Edition.
D. Defense in Depth
Explanation:
Defense in depth uses a layered approach to security to reduce the chances of a successful attack
A user wants to hear music. So he uses his Google account to log into the Spotify app. For further information, see the image below. Which of the following statements is NOT true in light of the above scenario?
A. Azure AD used by Spotify trusts Google
B. Google trusts Spotify’s Azure AD
C. There is a trust relationship between Spotify’s Azure AD & Google The user does not need a separate username and password to log into Spotify
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 29). Kindle Edition.
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (pp. 28-29). Kindle Edition.
B. Google trusts Spotify’s Azure AD
Explanation:
Spotifys Azure AD trusts Google in the case above. However, this is the not the case. Unless the trust relationship is configure, Google does not trust Spotify
- In entitlement management, you establish an access package and a set of resources to aid in onboarding new team members. In an access package, which of the following types of resources can you define (choose four options)?
A. Azure AD Enterprise Apps
B. SharePoint Online Sites
C. Azure Resources
D. Microsoft 365 Groups
E. Microsoft 365 Licenses
F. Azure AD Security Groups
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 29). Kindle Edition.
A. Azure AD Enterprise Apps
B. SharePoint Online Sites
D. Microsoft 365 Groups
F. Azure AD Security Groups
Explanation:
In Azure AD entitlement management, you define access packages to automate access request workflows, access assignments, and access expiration. This is critical since many users (whether new employees or those with recent role changes) are unsure of what access they require or to whom they should request it. The following are the sorts of resources defined in an access package, as seen in the figure above: Azure AD security groups and Microsoft 365 groups membership Access to Azure Active Directory apps and SaaS apps SharePoint Online site access Although you cannot manage access to Microsoft 365 licenses or Azure resources directly, you can create an Azure AD security group and allow users who require Microsoft 365 licenses access (via group-based licensing). For that group, you are required to create an Azure role assignment. If you have trouble understanding, the graphic above will help. So, the right answers are 1, 2, 4, and 6.
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (pp. 115-116). Kindle Edition.
- In the Azure portal, where can you enable workload protections?
A. Advisor
B. Azure AD Security
C. Microsoft Defender for Cloud
D. Azure Sentinel
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 30). Kindle Edition.
C. Microsoft Defender for Cloud
Explanation:
Microsoft takes a multi-layered security approach. Only Microsoft Defender for Cloud is a base layer (free, basic level of protection) Microsoft Defender for Cloud is a more advanced layer (paid, advanced protection with just-in-time access, Adaptive application controls, vulnerability assessment, etc.) Workload protections is accessed through Microsoft Defender for Cloud. Only after updating do you get the screen below.
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (pp. 116-117). Kindle Edition.
Microsoft Azure Sentinel is a scalable, cloud-native SIEM/SOAR solution. What do the acronyms stand for?
A. Security Incident Event Management (SIEM), Security Orchestration Autonomous Response (SOAR)
B. Security Information Event Management (SIEM), Security Orchestration Automated Response (SOAR)
C. Security Incident Event Management (SIEM), Security Orchestration Automated Response (SOAR)
D. Security Information Event Management (SIEM), Security Orchestration Autonomous Response (SOAR)
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 30). Kindle Edition.
B. Security Information Event Management (SIEM), Security Orchestration Automated Response (SOAR)
Explanation:
Security Information Event Management (SIEM) is a consolidated repository for all log entries created by your infrastructure, resources, devices, firewall, and endpoints. It then uses these logs to create alerts and notify the administrator. SOAR (Security Orchestration Automated Response) automates your threat response by taking these signals (with playbooks). As a result, SOAR reduces incident reaction time. In a nutshell, if SIEM identifies suspicious behavior, it generates an alarm. SOAR processes alarms (including false positives) and generates an automatic reaction.
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (pp. 117-118). Kindle Edition.
- ________________ is a feature in Microsoft Defender present for Endpoint that helps you actively detect threats.
A. Network Protection
B. Advanced Hunting
C. Next-Gen Protection
D. Automated Investigation
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 31). Kindle Edition.
B. Advanced Hunting
Explanation:
Microsoft Defender for Endpoint has several capabilities that could be useful during an exam. Advanced Hunting is the best option because it allows you to construct queries that actively seek hazards.
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 119). Kindle Edition.
Which of the following compliance solution areas would you find in the Solutions catalog as a compliance data administrator when logging into the Microsoft 365 compliance center?
A. Communication compliance
B. Information protection & governance
C. Insider risk management
D. Data loss prevention
E. Discovery & response
F. Advanced eDiscovery
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 31). Kindle Edition.
B. Information protection & governance
C. Insider risk management
E. Discovery & response
Explanation:
The Microsoft 365 solutions catalog can help you find compliance and risk management solutions for your company. The compliance solution catalog is divided into three sections. Each solution area offers details on a variety of compliance options. The only three compliance solution categories are, as you might expect, insider risk management, information protection and governance, and discovery and response.
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (pp. 119-120). Kindle Edition.
Which three sentences best explain the Zero Trust guiding principles? Each right answer contains the entire solution.
A.Define the perimeter by physical locations
B.Use identity as the primary security boundary C.Always verify the permissions of a user explicitly D.Always assume that the user system can be breached
E.Use the network as the primary security boundary
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (pp. 31-32). Kindle Edition.
B.Use identity as the primary security boundary
C.Always verify the permissions of a user explicitly
D.Always assume that the user system can be breached
Explanation:
The concept of zero trust is a security strategy. It is an approach to defining and implementing the following set of security principles rather than a product or service: Explicitly verify Use the least privileged access method Assume breach
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 120). Kindle Edition.
- In the Azure portal, where can you enable Azure Defender?
A. Shared Responsibility Model
B. Zero-Trust Methodology
C. CIA Model
D. Defense in Depth
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 32). Kindle Edition.
D. Defense in Depth
Explanation:
Defense in Depth uses a layered approach to security to reduce the chances of a successful attack
Your business intends to use Azure Cloud services. When it comes to Microsoft privacy, they are looking into the many security issues. Is transparency a core privacy principle at Microsoft?
A. Yes
B. No
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 32). Kindle Edition.
A. Yes
Explanation:
The important privacy principles addressed by Microsoft are listed below. Control Transparency Security Strong legal safeguards No targeting by content Advantages for you When it comes to transparency, Microsoft claims to be transparent in its data collection practices.
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (pp. 120-121). Kindle Edition.
Your business intends to use Azure Cloud services. Which of the following can be used to ensure that only authorized users can read data?
A. Archiving
B. Deduplication
C. Encryption
D. Compression
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 32). Kindle Edition.
C. Encryption
Explanation:
You can be certain that data is encrypted. The encryption key would then be available only to authorized users. The data can then be decrypted and read using the encryption key. Option B is improper because it is generally used to remove multiple copies of repeated data. Option A is wrong because it typically stores data that is not commonly used. Option D is inappropriate because it is typically used to lower data storage space.
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 121). Kindle Edition.
A business intends to use Azure Active Directory. Which of the following is the correct terminology for Azure Active Directory?
A. Federation Server
B. Firewall
C. Proxy Server
D. Identity Provider
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (pp. 32-33). Kindle Edition.
D. Identity Provider
Explanation:
Microsoft’s identity supplier is Azure Active Directory. This is used for identity storage and access management. Azure Active Directory may handle identity and access in both Azure and Microsoft Office 365. Since Azure Active Directory is used for identity and access management, all other options are invalid.
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 122). Kindle Edition.
Your organization intends to use Azure Active Directory. Do all Azure Active Directory versions offer the same set of features?
A. Yes
B. No
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 33). Kindle Edition.
B. No
Explanation:
Azure Active Directory comes with a variety of price options. The Free model is the most basic version. There is a feature limitation in this case. For example, you will not be able to use services like: Service Level Agreements (SLAs) Cloud users can reset their passwords themselves Management of group access
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 122). Kindle Edition.
Network Security Groups are something your firm intends to use. Is it possible to filter traffic using network security groups based on IP address, protocol, and port number?
A. Yes
B. No
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 33). Kindle Edition.
A. Yes
Explanation:
You can construct a rule based on the network security group rule’s IP address, protocol, and port number. The sample screenshot below shows the IP address, protocol, and port number.
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 122). Kindle Edition.
You must select the appropriate service based on the requirements. For the given requirement, which of the following would you use? “Provide Network Address Translation”
A. Azure Bastion
B. Network Security Group
C. Azure Firewall
D. Azure DDoS Protection
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 33). Kindle Edition.
C. Azure Firewall
Explanation:
The Azure Firewall service can convert traffic from public IP addresses to private IP addresses and virtual networks. Option A is inappropriate since it enables access to your Azure virtual machines through RDP/SSH. Option B is wrong because it is used to filter traffic to your Azure virtual machine. Option D is inappropriate since it is used to safeguard your Azure resources from large-scale Internet threats.
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 124). Kindle Edition.
You must select the appropriate service based on the requirements. For the given requirement, which of the following would you use? “Provide a secure way to RDP/SSH into Azure virtual machines.”
A. Azure Bastion
B. Azure Firewall
C. Network Security Group
D. Azure DDoS Protection
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (pp. 33-34). Kindle Edition.
A. Azure Bastion
Explanation:
The Azure Bastion service is a managed service that lets you connect to an Azure virtual machine through a browser or the Azure portal. Since this is a managed firewall service, Option B is inappropriate. Option C is wrong since it is used to filter traffic to and from your Azure virtual machines. Option D is inappropriate since it is used to safeguard your Azure resources from large-scale Internet threats.
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 124). Kindle Edition.
- Microsoft Defender for Endpoint is something your firm intends to use. Is it possible to secure Windows 10 computers using Microsoft Defender for Endpoint?
A. Yes
B. No
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 34). Kindle Edition.
A. Yes
Explanation:
Microsoft Defender for Endpoint service is compatible with Windows 10 devices.
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 124). Kindle Edition.
Your firm recently purchased an Azure subscription. The following are their requirements: “The ability to deploy a collection of resources, resource groups, and role assignments to a collection of subscriptions.” “Be able to verify that no one can delete resources defined in the ips-staging resource group.” “Ensure that the Microsoft IaaS Antimalware extension is deployed on all Windows Servers designated as Azure virtual machines.” Which of the following is appropriate for the following situation? “The ability to deploy a collection of resources, resource groups, and role assignments to a collection of subscriptions.”
A. Azure Policy
B. Azure Blueprint
C. Azure AD Identity Protection
D. Azure Resource Lock
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 34). Kindle Edition.
B. Azure Blueprint
Explanation:
Azure Blueprints can be sued to deliver a group of artifacts. Resources such as ARM templates, resource groups, and role assignments are examples of artifacts
The artifacts can be deployed using Azure Blueprints
Option A is inappropriate because this is utilized as a governance mechanism for your Azure account’s resources. Option C is inappropriate because it is used to safeguard your Azure AD IDs. Option D is inappropriate because it prevents inadvertent resource loss and modification in Azure.
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 125). Kindle Edition.
When it comes to security solutions for Microsoft 365, your firm is considering the various options available. The following are the most important needs. Find emails in Exchange mailboxes, documents in SharePoint sites, and OneDrive folders. To avoid a conflict of interest in the organization, limit communication and collaboration between two groups. Allow a Microsoft support engineer access to a user’s Exchange Online data. In Microsoft Office 365 Exchange Online, give users just-in-time access. Which of the following is appropriate for the following situation? Allow a Microsoft support engineer access to a user’s Exchange Online data.
A. Information Barriers
B. Content Search Tool
C. Customer Lockbox
D. Privileged Access Management
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 35). Kindle Edition.
C. Customer Lockbox
Explanation:
Explanation: Microsoft Engineers occasionally require user data access to identify a problem. The Customer Lockbox functionality can be used to accomplish this. Option A is inappropriate since it is utilized to prevent a conflict of interest in the organization by restricting communication and collaboration between two groups. Option B is erroneous because it is used to look for material in Exchange emails, SharePoint sites, and OneDrive folders. Option D is wrong because it is utilized to provide just-in-time access to Microsoft 365 services.
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 126). Kindle Edition.
Your business wants to start using Azure. When using Azure, they are looking into several security factors. Which of the following options could be used to meet the following need? “The ability to sync users from on-premises Active Directory to Azure Active Directory”
A. Azure AD Identity Management
B. Azure Conditional Access
C. Azure AD Roles
D. Azure AD Connect
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 35). Kindle Edition.
D. Azure AD Connect
Explanation:
Identity synchronization from on-premises Active Directory to Azure Active Directory is done via Azure AD Connect. User identity synchronization can be accomplished using a variety of approaches. Option A is inappropriate because it is used to secure Azure identities. Option B is inappropriate because it is used to grant Azure conditional access. Option C is inappropriate because it provides users with rights in Azure Active Directory to control various elements.
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 126). Kindle Edition.
A company creates a Resource Group named “Ips” with the following Azure resources. This resource group is locked with the following lock feature. Would any Azure user associated with this organization be able to create any new resource in the locked group named “Ips”?
A. Yes
B. No
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 36). Kindle Edition.
A. Yes
Explanation:
Azure Lock is the resource that protects the Resource group from any unwanted incident. Azure has two types of locks. Readonly lock, which allows authorized users to read the resources only. They are unable to make changes in the resources. The second type of lock is Delete, which ensures that the user is not allowed to delete the resource. In the given situation, the user can stop the virtual machine, create a new resource within this group, and change any resource created within “Ips” except to delete.
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (pp. 126-127). Kindle Edition.
Which of the following security information event management and security orchestration automated response solutions is scalable and cloud-native?
A. Azure Sentinel
B. Microsoft Defender for Cloud
C. Azure Active Directory
D. Azure AD Identity Protection
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 37). Kindle Edition.
A. Azure Sentinel
Explanation:
Azure Sentinel can be used as a scalable, cloud-native solution for security information event management and security orchestration automatic response. Azure Sentinel may ingest data from various sources and monitor performance threats based on that data. Option B is inaccurate because, while Microsoft Defender for Cloud can provide various security metrics and recommendations for your environment, it cannot deliver a full orchestration and response-based solution. Option C is inappropriate because you are using Azure’s identity-based solution. Option D is inappropriate because it is used to secure your Azure identities.
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (pp. 127-128). Kindle Edition.
Azure Blueprints are going to be used by your firm. Can Azure Blueprints be used to construct Azure subscription role assignments?
A. Yes
B. No
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 37). Kindle Edition.
A. Yes
Explanation:
Explanation: When constructing an Azure Blueprint, you can include several artifacts. Role assignment is one of them. Below is a screenshot of this.
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 128). Kindle Edition.
Which of the following offers advanced and intelligent Azure and hybrid resource and workload protection?
A. Azure Active Directory
B. Azure Blueprint
C. Azure Defender
D. Azure Policy
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 37). Kindle Edition.
C. Azure Defender
Explanation:
You can use Azure Defender to enable intelligent security of your Azure resources and your on-premises infrastructure. As illustrated below, this is an extra security capability included with Microsoft Defender for Cloud. Option D is inappropriate because it is utilized for Azure account resource governance. Option B is inappropriate because it is used to deploy various assets to your Azure account. Option A is wrong because this is a repository for personal information.
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (pp. 128-129). Kindle Edition.
Which of the following Azure Application Gateway features is available to help protect online applications from common attacks and vulnerabilities?
A. Azure Policy
B. Azure Identity Protection
C. Azure Firewall
D. Azure Web Application Firewall
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 37). Kindle Edition.
D. Azure Web Application Firewall
Explanation:
To secure web applications from common exploits and vulnerabilities, utilize the Azure Web Application Firewall in conjunction with the Azure Application Gateway resource. For example, it can assist defend against SQL injection and cross-site scripting attacks. Option C is wrong because this is a managed firewall service for the Azure virtual network resources. Option A is wrong because it is utilized for Azure resource governance. Option B is inappropriate because it is used to secure your Azure AD accounts.
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (pp. 129-130). Kindle Edition.
Which of the following corresponds to the encryption technology described below? “Encrypting data stored on physical media for a long time.”
A. Encryption in Transit
B. Encryption at Rest
C. In-memory Encryption
D. SSL Encryption
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (pp. 37-38). Kindle Edition.
B. Encryption at Rest
Explanation:
This concept is matched to the idea of encrypting data while it is in transit. The data on the physical media is encrypted in this case. All other possibilities are erroneous since the phrase “rest” refers to data stored on the physical device.
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 130). Kindle Edition.
You intend to make use of the Azure Firewall service. Is it possible to encrypt incoming network traffic to Azure virtual machines using the Azure Firewall service?
A. Yes
B. No
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 38). Kindle Edition.
B. No
Explanation:
Azure Firewall is a managed service for securing your Azure virtual network resources. However, it cannot encrypt incoming traffic to Azure virtual machines.
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 130). Kindle Edition.
A company has a hybrid environment. They have the following users defined in their on-premises environment. Name Part of Group ipslabA Domain Admins ipslabB Security Admins ipslabC Enterprise Admins ipslabD User Admins The following users have been defined in Azure AD. User Name Role ipslabadminA Security administrator ipslabadminB Global administrator ipslabadminC Billing Administrator ipslabadminD User Administrator The company now wants to implement Azure AD Connect. You have to decide on the users who could be part of the implementation of Azure AD Connect. The implementation must use the principle of least privilege. Who would be chosen to perform the implementation from the Active Directory side? A. ipslabadminA B. ipslabadminB C. ipslabadminC D. ipslabadminD
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (pp. 38-39). Kindle Edition.
You have a hybrid configuration of Azure Active Directory (Azure AD). You have an Azure SQL Database instance configured to support Azure AD authentication.
Database developers must connect to the database instance and authenticate by using their on-premises Active Directory account. You must ensure that developers can connect to the instance using Microsoft SQL Server Management Studio. The solution must minimize authentication prompts. Which authentication method would you recommend?
A. Active Directory - Password
B. Active Directory - Universal with MFA Support
C. SQL Server Authentication
D. Active Directory – Integrated
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 39). Kindle Edition.
A. Active Directory - Password
Explanation:
Use Active Directory password authentication when connecting with an Azure AD principal name using the Azure AD managed domain
A company has an on-premises data center and an Azure subscription. An Azure SQL database is in place that supports Azure AD authentication. The database developers need to authenticate to the database using Microsoft SQL Server Management Studio. They need to authenticate using their on-premises Active Directory account. They also want to ensure that the solution minimizes the authentication prompts. Which of the following authentication types should they use in Microsoft SQL Server Management Studio to connect?
A. SQL Login
B. Active Directory – Universal with MFA Support
C. Active Directory – Integrated
D. Active Directory – Password
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (pp. 39-40). Kindle Edition.
C. Active Directory – Integrated
Explanation:
When using a federated solution with your on premise AD, you should use the authentication type as Active Directory - Integrated into Microsoft SQL Server Management Studio
Your company is planning to implement conditional access policies. You have to implement the policies based on the existing risk events available for Azure AD. You have to identify the risk level for the following events defined for Azure AD. Users with leaked credentials Sign-ins from anonymous IP addresses Impossible travels to atypical locations Sign-in from unfamiliar locations Which of the following is the risk level associated with the following risk event? “Sign-ins from anonymous IP addresses.”
A. Low
B. Medium
C. High
D. Critical
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 40). Kindle Edition.
B. Medium
Explanation:
This event is associated with the Medium risk level. This is also given in the Microsoft documentation. Since this is clearly given in the Microsoft documentation, all other options are incorrect
Several services and resources are available in an organization’s Azure account. Customers and employees want to try these services and resources. An organization will allow only authenticated people to use the services and resources to ensure secure access. Which of the following statement is valid for the definition of Authentication?
A. This is the act of providing legitimate credentials
B. This specifies the type of service you can use in Azure
C. This specifies the type of data you can use in Azure D. This specifies what you can do in Azure
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 40). Kindle Edition.
B. This specifies the type of service you can use in Azure
Explanation:
There are multiple ways of identity management in Azure. One and most implemented secure method is Multi-Factor Authentication (MFA). MFA can be implemented using fraud alerts, blocking/unblocking users, phone call settings, notification verification, etc. Such an authentication method is termed a conditional access policy that can be achieved by Azure Active Directory (AAD).
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 132). Kindle Edition.
A company implements the Azure solution. This solution is available on both on-premises and cloud. Therefore, a large number of users can access this solution. The company needs to implement an advanced secure authentication method such as Multi-Factor Authentication (MFA) for the identity management of users. Would the company need to configure the identities of both on-premises and Azure users? A. Yes B. No
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (pp. 40-41). Kindle Edition.
An IT Engineer creates a Resource group named “IPS-rg” for his organization. A Virtual Machine called “IPS-VM” is created in the Resource group. To provide advanced secure protection, which of the following resource deployment is suited as the best possible option to avoid any accidental incident?
A. Security
B. Access Control
C. Locks
D. Configuration
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 41). Kindle Edition.
C. Locks
Explanation:
Azure Lock is the resource that protects the Resource group from any unwanted incident. Azure has two types of locks. Readonly lock, which allows authorized users to read the resources only. They are unable to make changes in the resources. The second type of lock is Delete, to ensure that the user is not allowed to delete the resource. Option A is invalid because it defines the security features for the protection of resources. Option B is invalid because it provides access rights to an authorized user. Option D is invalid because it shows the configuration of the selected resource.
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 133). Kindle Edition.
- An IT company deployed Virtual Network (VNet) with multiple subnets and Virtual Machines (VMs). They want to ensure the inbound traffic flows into the machine from port 8080. Which of the following Azure service is responsible for the secure network traffic flow?
A. Route Tables
B. Network Interface Card
C. Route Filters
D. Network Security Group
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 41). Kindle Edition.
D. Network Security Group
Explanation:
Explanation: Network Security Group (NSG) has a set of security rules that enable some special VMs to allow or not allow the inbound and outbound traffic load from other resources. The given figure shows the step to make the validity of the correct port for inbound traffic flow.
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 133). Kindle Edition.
An IT Engineer design a network on which a complex data-based application runs. To secure the application from Distributed Denial of Service (DDoS) attacks, which of the following Azure service is used as a protection layer?
A. Azure DDoS Protection
B. Azure Key Vault
C. Azure Multi-Factor Authentication
D. Azure Network Security Group
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (pp. 41-42). Kindle Edition.
A. Azure DDoS Protection
Explanation:
Azure DDoS Protection Services protect the applications against targeted DDoS attacks. With DDoS Protection, the traffic always remains within the Azure data center. It also helps in the performance because as Azure DDoS protection does the attack mitigation, that’s how traffic does not leave the data center. Option B is invalid because the Azure Key Vault provides the protection of application secrets in encrypted form. Option C is invalid because Multi-Factor Authentication (MFA) provides a high level of secure access by acquiring different types of authentication methods. Option D is invalid because the Network Security Group (NSG) acts as a resource firewall to prevent network resources from unwanted traffic loads.
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (pp. 134-135). Kindle Edition.
A company is planning to design a secure network and share the application secrets with a third party without revealing the actual secret. Which of the following Azure service is used for the sharing of secrets?
A. Azure Network Security Group
B. Azure DDoS Protection
C. Azure Key Vault
D. Azure Multi-Factor Authentication
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 42). Kindle Edition.
C. Azure Key Vault
Explanation:
Azure Key Vault store the secret and password. It allows sharing passwords and secrets with others in a hidden form so that no one can view the actual secret. Option A is invalid because the Network Security Group (NSG) acts as a resource firewall to prevent network resources from unwanted traffic loads. Option B is invalid because the DDoS Protection service protects an application against DDoS attacks. Option D is invalid because Multi-Factor Authentication (MFA) provides a high level of secure access by acquiring different types of authentication methods.
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 135). Kindle Edition.
A Network Security Engineer in an organization, Denzel implemented a network that runs sensitive and complex applications. For some reason, he stopped this running application. He decided to use Azure Firewall to stop all the network traffic load from Azure to the internet. Would this approach is correct to stop this application?
A. Yes
B. No
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 42). Kindle Edition.
B. No
Explanation:
Azure Firewall defines the rules for the incoming and outgoing traffic in the network to ensure the security of resources in the network. It does not create a blockage between Azure and the internet. It provides the secure protection layer between Azure and the internet to provide throughput without any unwanted incident or blockage.
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (pp. 135-136). Kindle Edition.
An organization decides to implement the method of advanced and secure access to an application. The organization gives a task to Security Engineer to implement a method that prevents an irrelevant user from accessing the application in multiple steps. Which of the following Azure service can be used to implement such a secure identification method?
A. Azure Network Security Group
B. Azure DDoS Protection
C. Azure Key Vault
D. Azure Multi-Factor Authentication
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 42). Kindle Edition.
D. Azure Multi-Factor Authentication
Explanation:
Multi-Factor Authentication (MFA) provides a high level of secure access by acquiring different types of authentication methods. MFA is based on “Something you know (id and password), something you have (phone or other hardware), and something you are (face recognition or biometric).” Option A is invalid because the Network Security Group (NSG) acts as a resource firewall to prevent network resources from unwanted traffic loads. Option B is invalid because the DDoS Protection service protects an application against DDoS attacks. Option C is invalid because the Azure Key Vault provides the protection of application secrets in encrypted form.
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 136). Kindle Edition.
An organization is using Azure resources. The IT head of an organization became an Azure user with Azure AD service. Now, he wants to use different service features (like PowerApps, stream, security, dynamic 365, and others) offered by Microsoft; for this, he needs to purchase licenses. Is a user limited to purchases and assigned one license only?
A. Yes
B. No
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 43). Kindle Edition.
B. No
Explanation:
Azure Active Directory service provides a combination of application access management and identity protection services. This service allows access to specific services to a specific user who has a license for access to this type of service. There are multiple licenses assigned to one user depending upon their service demand.
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 136). Kindle Edition.
An IT Engineer of an organization implements a network in which different applications are running. He decided to use Network Security Group (NSG) to enable the encrypted connection between the resources present in the network. Would the choice of NSG in this scenario is correct?
A. Yes
B. No
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 43). Kindle Edition.
B. No
Explanation:
Network Security Group (NSG) is required in the configuration of a Virtual Network (VNet) where different Virtual Machines (VM) within the subnet are connecting with each other. NSG uses Access Control List (ACL) rules to allow or deny network traffic access to subnet or VM. For further detail, you can visit the given URL.
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 137). Kindle Edition.
An organization shifts all its resources to Azure. An organization has a pay-as-you-go subscription. The administrator team of an organization wants to create a secure authentication method for accessing the Azure resources. Does Azure Active Directory (AAD) provide the authentication service for secure access?
A. Yes
B. No
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 43). Kindle Edition.
B. No
Explanation:
Network Security Group (NSG) is required in the configuration of a Virtual Network (VNet) where different Virtual Machines (VM) within the subnet are connecting with each other. NSG uses Access Control List (ACL) rules to allow or deny network traffic access to subnet or VM. For further detail, you can visit the given URL.
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 137). Kindle Edition.
- A networking company wants to use Azure AD service for better and more secure resource access. To enable an identity protection service, would a company be responsible for first creating the pop-up box for user authentication?
A. Yes
B. No
Specialist, IP. SC-900: Microsoft Security, Compliance, and Identity Fundamentals: +250 Exam Practice Questions with Detail Explanations and Reference Links : Second Edition - 2023 (p. 43). Kindle Edition.
A. Yes
Explanation:
Azure AD service is a management service that combines identity protection service and access management. Many users can securely access the Azure service by just entering the user name and password
