Evaluate Solutions for Network Security and Security Service Edge (SSE) SC-100 Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   Contoso has a hub-and-spoke network with forced tunneling to an on-premises firewall for all outbound internet traffic. They are migrating to Microsoft Entra Internet Access as a secure web gateway. During the pilot, they notice that traffic to Microsoft 365 is still bypassing the gateway. What should you configure to ensure that Microsoft 365 traffic is inspected by the secure web gateway?

   • ACreate a conditional access policy that requires compliant devices for Microsoft 365 apps.
   • BDeploy a DNS sinkhole to block non-compliant Microsoft 365 traffic.
   • CEnable the Microsoft Entra Internet Access network tunnel and configure the traffic forwarding profile to include Microsoft 365 endpoints.
   • DConfigure an Azure Firewall policy to route Microsoft 365 traffic to the on-premises firewall.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A company is redesigning its network to adopt a zero-trust model. They want to ensure that all access to internal applications is verified explicitly and that least-privilege access is enforced. They also want to minimize the attack surface by not exposing internal applications to the internet. Which approach should they take?

   • AExpose applications via Azure Application Gateway
   • BUse Azure VPN Gateway for all remote access
   • CUse Network Security Groups to restrict access
   • DUse Microsoft Entra Private Access for all internal applications
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A company wants to use Microsoft Entra Internet Access as a secure web gateway for all internet traffic. They have a mix of managed and unmanaged devices. They need to enforce web filtering for all devices, including those that do not have the client installed. What should you implement?

   • ARequire all devices to be enrolled in Microsoft Intune before accessing the internet.
   • BConfigure DNS-based enforcement for unmanaged devices and client-based enforcement for managed devices.
   • CDeploy a proxy server on-premises and route all traffic through it.
   • DUse conditional access to block all unmanaged devices.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A company wants to provide remote users with access to a set of on-premises applications without exposing the applications to the internet. They are evaluating Microsoft Entra Private Access. The applications are hosted on a single server. What is the minimum configuration required to enable access?

   • ASet up a VPN server on the same network as the applications.
   • BInstall the Private Access connector on the server and configure the application in the Private Access portal.
   • CCreate a conditional access policy that allows remote access to the server's IP address.
   • DPublish the applications through Azure Application Gateway.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A multinational company uses Microsoft 365 and wants to secure access to Exchange Online and SharePoint Online for all users. They require that traffic to these services be inspected for threats and that access be restricted based on user risk. They also need to support users in multiple tenants. What should they configure?

   • AMicrosoft Entra Internet Access for Microsoft Services with cross-tenant access policies
   • BAzure Front Door with Web Application Firewall policies
   • CAzure Firewall with application rules for Microsoft 365
   • DMicrosoft Defender for Endpoint with network protection
   Reveal Solution Discussion Select an answer first