Specify Requirements for Securing Server and Client Endpoints SC-100 Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A company has a hybrid environment with on-premises Windows servers and Azure VMs. They want to enforce a consistent security baseline across all servers, but the on-premises servers are not always connected to Azure. They also need to ensure that any drift is detected and remediated. What should you recommend?

   • ADeploy a third-party configuration management tool that supports both environments.
   • BUse separate Group Policies for on-premises and Azure VMs, and manually reconcile them.
   • CUse Azure Automation State Configuration for both on-premises and Azure VMs.
   • DUse Azure Arc to connect on-premises servers and apply Azure Policy guest configuration to both on-premises and Azure VMs.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which Microsoft Defender for IoT capability is used to discover and inventory OT and ICS devices that are connected to the network?

   • AActive vulnerability scanning
   • BAgent-based endpoint protection
   • CPassive network monitoring
   • DCloud-based analytics only
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A power utility has an OT network with legacy PLCs that cannot be patched and a separate IT network. The security team wants to monitor the OT network for threats, but the OT network has limited bandwidth and cannot tolerate active scanning. What should you do?

   • AUse Azure Network Watcher to monitor OT traffic
   • BInstall Microsoft Defender for Endpoint agents on all PLCs
   • CRun active vulnerability scans from the IT network
   • DDeploy Microsoft Defender for IoT network sensors in passive mode and integrate with Microsoft Sentinel
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Which endpoint hardening technique reduces the attack surface by removing unnecessary software and disabling unused services?

   • ASystem hardening and minimization
   • BApplication allowlisting
   • CNetwork segmentation
   • DPatch management
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A company allows employees to use their personal phones for work email and calendar. The security team wants to protect corporate data, but employees are concerned about privacy. They want to ensure that if a phone is lost, only corporate data is wiped, not personal data. They also want to enforce a PIN and encryption. What should you implement?

   • AUse Exchange ActiveSync policies to require a PIN and enable remote wipe.
   • BUse Microsoft Defender for Cloud Apps to block access from non-compliant devices.
   • CUse Intune app protection policies (MAM) without device enrollment, combined with conditional access requiring approved apps.
   • DEnroll all personal phones in Intune MDM and configure device compliance policies.
   Reveal Solution Discussion Select an answer first