Specify Requirements for Securing Server and Client Endpoints SC-100 Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A company has a mix of Windows and Linux servers. They want to establish a security baseline that includes password policies, audit logging, and disabling unnecessary services. They also need to ensure that any drift from the baseline is detected and reported. What should you implement?

   • ACreate a custom PowerShell script that checks baseline settings and sends an email if drift is detected.
   • BUse Azure Policy with guest configuration to audit and enforce baseline settings on both Windows and Linux servers.
   • CUse Microsoft Defender for Cloud's recommendations to manually apply baseline settings.
   • DDeploy a configuration management tool like Ansible to apply the baseline, but rely on manual audits for drift.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A company issues corporate-owned Android devices to field workers. The devices must be fully managed, have a locked-down configuration, and only allow approved apps. What should you configure in Microsoft Intune?

   • ABring Your Own Device (BYOD) enrollment with app protection policies only
   • BAndroid Enterprise fully managed device enrollment with device restrictions and app protection policies
   • CDevice compliance policies only, with no enrollment
   • DAndroid Enterprise work profile enrollment
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A company has a large number of Windows servers and workstations. They currently use a legacy solution to manage local admin passwords, but it requires a manual process to rotate passwords. The security team wants to automate rotation and ensure that only certain IT admins can retrieve passwords. They also want to avoid storing passwords in plain text. What should you do?

   • AUse Microsoft Defender for Identity to manage local admin passwords.
   • BContinue using the legacy solution but schedule a script to rotate passwords and store them in a database.
   • CMigrate to Windows LAPS and store passwords in Azure AD with role-based access control.
   • DUse Group Policy to set a random password at each boot and store it in a file on the server.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   Your organization runs a mix of Windows Server, Linux, and legacy Unix servers. The security team wants a consistent security baseline across all server platforms and visibility into vulnerabilities. What should you use to meet this requirement?

   • ASystem Center Configuration Manager with custom baselines
   • BAzure Policy with guest configuration only
   • CMicrosoft Defender for Endpoint only, with no additional configuration
   • DMicrosoft Defender for Cloud with regulatory compliance and vulnerability assessment
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   Your organization is deploying 500 Windows 11 client endpoints. The security team wants a consistent baseline that includes local admin password rotation and hardening settings. You need to ensure the endpoints receive the baseline automatically and that local admin passwords are rotated regularly. What should you implement?

   • AGroup Policy with Local Security Policy settings and manual password changes
   • BMicrosoft Defender for Endpoint only, with no additional configuration
   • CAzure Policy with guest configuration and a scheduled runbook to reset passwords
   • DMicrosoft Intune security baselines with Windows LAPS policy
   Reveal Solution Discussion Select an answer first