Design Solutions for Security Posture Management in Hybrid and Multicloud Environments SC-100 Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A financial services firm wants to discover all internet-facing assets associated with their organization, including unknown subdomains and expired certificates that could be exploited. They also want to prioritize remediation based on the potential impact to their attack surface. Which solution should you implement?

   • AEnable Microsoft Defender for Cloud's inventory feature to list all public IPs and certificates.
   • BUse Microsoft Secure Score to identify all internet-facing assets and their risk scores.
   • CDeploy Microsoft Defender External Attack Surface Management (EASM) and use the attack surface insights to prioritize.
   • DConfigure Azure Firewall logs to detect unknown subdomains and expired certificates.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A company wants to implement a security posture management process. They have a limited security team and need to prioritize actions. They have both on-premises and cloud resources. They want to use Microsoft Security Exposure Management to identify attack paths and track initiatives. They also want to use Defender EASM to understand their external attack surface. What should they do first?

   • ADeploy Defender EASM to discover external assets, then use Exposure Management to analyze attack paths and prioritize initiatives.
   • BFocus only on on-premises resources and ignore cloud.
   • CStart with Secure Score recommendations and ignore attack paths.
   • DEnable all Defender for Cloud plans before doing any analysis.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   A company has workloads running in Azure, on-premises, and in AWS. They want to use Microsoft Defender for Cloud to manage security posture across all these environments. What is the first step they should take to integrate AWS accounts?

   • AConnect the AWS accounts to Defender for Cloud using the AWS connector
   • BDeploy Azure Arc on all AWS resources
   • CInstall the Microsoft Monitoring Agent on every AWS EC2 instance
   • DCreate a new Azure subscription for each AWS account
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security team wants to improve their Microsoft Secure Score by 20 points. They have a list of recommendations from Defender for Cloud. They need to focus on the most efficient way to achieve this goal. What should they do?

   • AFocus on recommendations that are easy to implement, regardless of score impact.
   • BImplement all recommendations that are marked as 'high severity'.
   • CSort recommendations by potential score increase and implement those with the highest impact first.
   • DUse Azure Policy to auto-remediate all recommendations.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   In Microsoft Defender for Cloud, what is the primary purpose of the Microsoft Cloud Security Benchmark (MCSB)?

   • ATo replace Azure Policy for enforcing resource configurations
   • BTo collect and analyze security logs from hybrid and multicloud resources
   • CTo provide a set of security controls and best practices that Defender for Cloud uses to generate recommendations
   • DTo provide a single score that indicates the overall security posture
   Reveal Solution Discussion Select an answer first