Where can Windows LAPS store the local administrator password for a device that is joined to Microsoft Entra ID?

Local Security Authority (LSA) secrets

A manufacturing company is deploying IoT sensors and cameras on the production floor. The security team needs to inventory these devices, monitor for vulnerabilities, and detect suspicious activity. What should you implement?

Network security groups (NSGs) on the production network

Microsoft Defender for IoT with network sensors and Defender for Cloud integration

Azure Security Center (legacy) with just the standard tier

Microsoft Intune with device compliance policies for IoT devices

A company has a mix of Windows 10 and Windows 11 endpoints. The security team wants to apply a security baseline, but some legacy applications require relaxed settings. You need to ensure the baseline is applied while allowing exceptions for the legacy apps. What should you do?

Create multiple Intune security baseline profiles with different settings and assign them to different device groups

Use Group Policy to override the Intune baseline settings

Do not apply a baseline to any device to avoid conflicts

Apply the same baseline to all devices and manually change settings on legacy devices

A financial services firm is deploying Windows 10 endpoints. The security team requires that users cannot install unauthorized software, local admin rights are restricted, and local admin passwords are unique per device. What should you implement?

Microsoft Defender for Endpoint with attack surface reduction rules only

Local Security Policy to set a strong local admin password

Group Policy to disable the Windows Installer service

Windows Defender Application Control (WDAC) with Windows LAPS and standard user accounts

What is the primary purpose of Windows Local Administrator Password Solution (Windows LAPS)?

To encrypt local administrator passwords

To replace the need for domain accounts

To provide a single sign-on experience for local accounts

To automatically manage and rotate the local administrator password on Windows devices

Microsoft Certified:Cybersecurity Architect Expert

Domain 3Objective 2

Specify Requirements for Securing Server and Client Endpoints SC-100 Practice Questions (Page 4)

Part of the Design security solutions for infrastructure domain, which accounts for 25–30% of the SC-100 exam. Microsoft does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–24 in this domain), expect 3–6 from this objective — we provide 38 practice questions to prepare you well beyond it. (estimate)

38questions here

8free pages

7concepts

25–30%of the exam

Questions 16–20

16foundation · easy
Where can Windows LAPS store the local administrator password for a device that is joined to Microsoft Entra ID?
Select an answer first
17application · medium
A manufacturing company is deploying IoT sensors and cameras on the production floor. The security team needs to inventory these devices, monitor for vulnerabilities, and detect suspicious activity. What should you implement?
Select an answer first
18expert · hard
A company has a mix of Windows 10 and Windows 11 endpoints. The security team wants to apply a security baseline, but some legacy applications require relaxed settings. You need to ensure the baseline is applied while allowing exceptions for the legacy apps. What should you do?
Select an answer first
19application · medium
A financial services firm is deploying Windows 10 endpoints. The security team requires that users cannot install unauthorized software, local admin rights are restricted, and local admin passwords are unique per device. What should you implement?
Select an answer first
20foundation · easy
What is the primary purpose of Windows Local Administrator Password Solution (Windows LAPS)?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SC-100

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-100” is a trademark of its owner, used for identification only.