A company uses Azure Backup to protect its on-premises SQL Server databases. The security team is concerned about ransomware that might encrypt the backup data. They want to ensure that backups are protected from both deletion and encryption. What should they do?

Use Azure Site Recovery to replicate the SQL Server VMs to a secondary region.

Store backups in a storage account with a shared access signature (SAS) token that expires in 30 days.

Enable immutability on the Recovery Services vault and use customer-managed keys (CMK) stored in Azure Key Vault with soft delete and purge protection enabled.

Increase the retention period for backups to 10 years.

A large enterprise is designing a ransomware mitigation strategy. They have a hybrid environment with critical data in Azure and on-premises. The security team wants to ensure that even if an attacker gains domain admin privileges, they cannot delete or encrypt backups. They also need to maintain the ability to restore within 24 hours. Which combination of controls should they implement?

Use Azure Site Recovery for all critical workloads and rely on failover to a secondary region.

Increase the frequency of on-premises backups and store them on a local NAS device.

Store backups in the same Azure region as the production data and use the same admin accounts for simplicity.

Enable immutability on the backup vault, use Azure AD Privileged Identity Management (PIM) for backup admin roles, and store a copy of the backup encryption keys in a separate key vault with restricted access.

What is the primary purpose of evaluating security update solutions in an organization?

To reduce the number of updates released by vendors

To identify and prioritize updates based on risk and impact to the organization

To automate the installation of all updates without oversight

To ensure that all systems are updated as soon as updates are released, without any testing

A company uses Azure Backup for its Azure VMs. The security team wants to ensure that backups are protected from ransomware and malicious deletion. They also want to meet a compliance requirement to retain backups for 10 years. What should they implement?

Enable soft delete and configure a backup policy with a 10-year retention period.

Store backups in a storage account with a private endpoint and enable Azure Defender for Storage.

Use Azure Site Recovery to replicate VMs to a secondary region and retain the replicated data for 10 years.

Enable the immutable vault setting and configure a backup policy with a 10-year retention period.

A company wants to reduce the risk of ransomware spreading through its environment. They plan to implement a strategy that includes privileged access management and secure backups. Which of the following is the most effective combination?

Use multi-factor authentication (MFA) for all users, and store backups in the same storage account as production data.

Use Azure Security Center to monitor for threats, and rely on daily backups.

Use network segmentation to isolate critical systems, and use Azure Site Recovery for replication.

Use Privileged Identity Management (PIM) for just-in-time access to admin roles, and store backups in an isolated, immutable storage account.

Microsoft Certified:Cybersecurity Architect Expert

Domain 1Objective 1

Design a Resiliency Strategy for Ransomware and Other Attacks Based on Microsoft Security Best Practices SC-100 Practice Questions (Page 5)

Part of the Design solutions that align with security best practices and priorities domain, which accounts for 20–25% of the SC-100 exam. Microsoft does not publish an official question count, but from its 120-minute exam (~50–80 total, ~10–20 in this domain), expect 3–7 from this objective — we provide 31 practice questions to prepare you well beyond it. (estimate)

31questions here

7free pages

5concepts

20–25%of the exam

Questions 21–25

21expert · hard
A company uses Azure Backup to protect its on-premises SQL Server databases. The security team is concerned about ransomware that might encrypt the backup data. They want to ensure that backups are protected from both deletion and encryption. What should they do?
Select an answer first
22expert · hard
A large enterprise is designing a ransomware mitigation strategy. They have a hybrid environment with critical data in Azure and on-premises. The security team wants to ensure that even if an attacker gains domain admin privileges, they cannot delete or encrypt backups. They also need to maintain the ability to restore within 24 hours. Which combination of controls should they implement?
Select an answer first
23foundation · easy
What is the primary purpose of evaluating security update solutions in an organization?
Select an answer first
24expert · medium
A company uses Azure Backup for its Azure VMs. The security team wants to ensure that backups are protected from ransomware and malicious deletion. They also want to meet a compliance requirement to retain backups for 10 years. What should they implement?
Select an answer first
25application · medium
A company wants to reduce the risk of ransomware spreading through its environment. They plan to implement a strategy that includes privileged access management and secure backups. Which of the following is the most effective combination?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SC-100

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-100” is a trademark of its owner, used for identification only.