Design Solutions for Security Posture Management in Hybrid and Multicloud Environments SC-100 Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which type of asset would Microsoft Defender EASM typically discover and monitor?

   • AInternal virtual machines on a private network
   • BOn-premises Active Directory domain controllers
   • CAzure SQL databases with private endpoints only
   • DPublicly accessible web applications and domains
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A company has a hybrid environment with on-premises servers and AWS workloads. They want to use Defender for Cloud for security posture management, but they have a constraint: they cannot install any additional agents on the AWS workloads. They also need to protect the on-premises servers with Defender for Servers. What should they do?

   • AUse Azure Arc for AWS workloads and on-premises servers.
   • BConnect AWS accounts to Defender for Cloud using the native connector, and connect on-premises servers via Azure Arc.
   • CInstall the Log Analytics agent on AWS workloads and on-premises servers.
   • DUse Microsoft Defender for Cloud Apps to protect AWS workloads.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   In Microsoft Security Exposure Management, what is an 'attack path'?

   • AA record of all security incidents that occurred in the last 30 days
   • BA sequence of exposures and vulnerabilities that an attacker could exploit to reach a critical asset
   • CA list of all external IP addresses associated with the organization
   • DA set of security policies that define allowed network traffic
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A company has a mix of Azure VMs, AKS clusters, and Azure SQL databases. They want to enable workload protection but have a limited budget. They need to protect the most critical assets first. What should they do?

   • AUse Microsoft Secure Score to decide which plans to enable.
   • BEnable all Defender plans on all subscriptions.
   • CEnable Defender for Servers, Defender for Containers, and Defender for SQL, but only on the subscriptions that contain critical assets.
   • DEnable only Defender for Servers and skip containers and SQL.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A security architect is designing a posture management process. They have multiple initiatives and want to ensure that the most critical attack paths are addressed first, even if they are not reflected in the Secure Score. What should they include in the process?

   • AFocus on regulatory compliance only.
   • BOnly track Secure Score improvements and ignore attack paths.
   • CRegular review of attack path analysis and security insights from Microsoft Security Exposure Management, integrated with Secure Score recommendations.
   • DUse Defender EASM to identify attack paths.
   Reveal Solution Discussion Select an answer first