Microsoft SC-100 Practice Exam Questions & Answers

Explanation Endpoint Privilege Management in Microsoft Intune allows standard users to run applications that require admin rights without giving them full administrative access to their devices. This is managed through a security context that elevates only specific applications as needed. The key advantage is that Group1 members can assist users while maintaining the security posture of keeping regular user accounts unprivileged. This directly addresses identity and access management within the security operations domain.

Explanation

For threat modeling using a top-down approach based on the Microsoft Cloud Adoption Framework, you should start with: Define business goals, critical assets, and organizational risk tolerance first, then map architecture and data flows, and finally identify threats at each layer. More specifically, begin with STRIDE methodology (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege) applied to your cloud architecture components, or use Microsoft's threat modeling tool in conjunction with the Azure Security Architecture reference. The top-down approach starts with high-level business and architecture context before drilling down into technical threat scenarios.

Explanation

https://docs.microsoft.com/en-us/azure/sentinel/tutorial-respond-threats-playbook?tabs=LAC

Explanation

https://docs.microsoft.com/en-us/learn/modules/configure-vnet-peering/5-determine-service-chaining-uses

Explanation

To evaluate the security posture of workloads in an Azure landing zone, the first step should be to run Microsoft Defender for Cloud's security assessment or use Azure Security Benchmark assessment tools in Microsoft Defender for Cloud. You should first enable Microsoft Defender for Cloud (Defender CSPM plan) to establish a baseline security posture assessment. This provides comprehensive visibility into security vulnerabilities, compliance status, and security recommendations across all resources in the landing zone before implementing remediation steps.

Explanation

The requirements specify a sophisticated encryption solution with specific security properties:

• Minimizes malware risks from elevated privileges: Always Encrypted encrypts data at the application level before it reaches the database, preventing even DBAs with elevated privileges from accessing sensitive data in plaintext.
• Prevents DBA access to sensitive data: Always Encrypted keys are managed outside the database (in Key Vault or application), ensuring database administrators cannot decrypt sensitive columns even if they access the database directly.
• Enables server-side pattern matching: Always Encrypted with randomized encryption supports deterministic encryption for pattern matching operations on the server side.
• Supports Azure Attestation: SQL Server with Always Encrypted can be configured with Azure Attestation to prove that keys are only accessed by authorized code.
• Uses hardware-based encryption: When configured with Azure Key Vault in a Dedicated HSM or using SQL Server's Transparent Data Encryption with hardware security modules, encryption is hardware-backed.
• Why SQL Server vs. SQL Database: The migration from on-premises SQL Server makes SQL Server on Azure VMs (with Always Encrypted) the most appropriate solution, though SQL Database with Always Encrypted is also viable.

This combination provides defense-in-depth encryption protecting against privileged account abuse while maintaining necessary database functionality.