Specify Requirements for Securing Server and Client Endpoints SC-100 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A company allows employees to use personal iOS and Android devices for email and calendar access. The security team requires device passcodes, encryption, and the ability to selectively wipe corporate data without affecting personal data. What should you configure in Microsoft Intune?

   • ADevice enrollment into Intune with full wipe capabilities
   • BApp protection policies with selective wipe and device compliance policies requiring passcode and encryption
   • CConditional Access policies requiring compliant devices, with no additional Intune configuration
   • DExchange Active Sync mailbox policies only
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A company runs a mix of Windows Server 2019, Ubuntu 22.04, and RHEL 9 servers in Azure. The security team wants a consistent security baseline across all servers, including OS configuration, firewall rules, and antivirus settings. They also need to track compliance over time. What should you recommend?

   • AUse Microsoft Defender for Cloud's regulatory compliance dashboard to apply security baselines automatically to all servers.
   • BCreate custom DSC configurations for each OS and deploy them via Azure Automation State Configuration, then report compliance manually.
   • CConfigure Windows Server Update Services (WSUS) and Linux package repositories to ensure all servers have the latest patches.
   • DApply Azure Policy guest configuration assignments with built-in baselines for Windows and Linux, and monitor compliance in Microsoft Defender for Cloud.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A company has a mix of Windows 10 and Windows 11 endpoints. They want to harden the endpoints by enabling application control, reducing the attack surface, and ensuring local admin passwords are unique. They also need to support legacy applications that are not digitally signed. What should you do?

   • AUse Windows Defender Application Control (WDAC) in audit mode to identify applications, then enforce with a signed policy, and use Windows LAPS.
   • BUse AppLocker to allow only signed applications and configure Windows LAPS.
   • CDeploy a Group Policy that disables legacy protocols and sets a common local admin password.
   • DEnable Microsoft Defender for Endpoint attack surface reduction rules and use a static local admin password.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A manufacturer deploys IoT sensors on the factory floor that send telemetry to a cloud application. The sensors run a custom Linux-based firmware and cannot install standard endpoint agents. The security team needs visibility into device vulnerabilities and anomalies, and must be able to respond to threats. What should you recommend?

   • AInstall Microsoft Defender for Endpoint on each sensor via a custom script.
   • BRequire all sensors to be replaced with models that support Microsoft Defender for Endpoint.
   • CUse Microsoft Defender for IoT to monitor the sensor network and integrate with Microsoft Sentinel for response.
   • DDeploy a network-based intrusion detection system (IDS) that inspects all traffic to the sensors.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is a key security consideration when deploying security solutions in an OT/ICS environment that differs from typical IT environments?

   • AConfidentiality is always the highest priority
   • BAvailability and safety are often prioritized over confidentiality
   • CStandard IT security agents can be installed on all devices
   • DPatching can be performed at any time without impact
   Reveal Solution Discussion Select an answer first