Specify Requirements for Securing Server and Client Endpoints SC-100 Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A company has a large number of Windows servers and workstations that use the same local administrator password. The security team wants to ensure each device has a unique, complex local admin password that is automatically rotated and stored securely. They also want to restrict who can read the passwords. What should you implement?

   • AUse Microsoft Defender for Identity to monitor local admin password usage.
   • BDeploy a PowerShell script that generates a random password and stores it in a text file on a network share.
   • CUse Group Policy to set a new static password for all devices.
   • DEnable Windows LAPS and configure it to store passwords in Azure AD with appropriate access controls.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A water treatment facility uses programmable logic controllers (PLCs) and supervisory control and data acquisition (SCADA) systems. The security team wants to detect threats without disrupting the operational technology (OT) network. What should you implement?

   • AFirewall rules that block all inbound traffic to the OT network
   • BMicrosoft Defender for IoT with passive network monitoring sensors
   • CEndpoint detection and response agents installed on all PLCs
   • DActive vulnerability scanning using standard IT tools
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company allows employees to use personally owned iOS and Android devices for email and calendar access. The security team requires that devices must have a passcode, be encrypted, and be jailbreak/root-detection compliant before accessing corporate data. They also want to be able to selectively wipe corporate data if a device is lost. What should you implement?

   • AMicrosoft Defender for Cloud Apps with session controls that block access from non-compliant devices.
   • BMicrosoft Intune with conditional access policies that require compliance, and app protection policies for mobile apps.
   • CExchange Online device access rules that require ActiveSync to block devices without a passcode.
   • DAzure AD conditional access with a 'Require compliant device' grant, using only device compliance policies from Intune.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   A security architect is defining mobile device security requirements for a corporate environment. Which capability is essential for protecting corporate data on personally owned devices?

   • AJailbreak detection only
   • BRemote wipe of the entire device
   • CApplication management and data separation
   • DFull device encryption only
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A company has 500 Windows 10/11 client endpoints. They want to reduce the attack surface by disabling legacy protocols, enforcing application control, and ensuring that local administrator accounts have unique, automatically rotated passwords. What should you configure?

   • AConfigure AppLocker to allow only signed executables and use Group Policy to set the same local admin password.
   • BEnable Windows Defender Application Control (WDAC) and configure Windows LAPS to rotate local admin passwords.
   • CUse Microsoft Defender for Endpoint attack surface reduction rules and enable Credential Guard.
   • DDeploy a Group Policy that disables SMBv1 and set a static local admin password across all devices.
   Reveal Solution Discussion Select an answer first