Microsoft Cybersecurity Architect: SC-100

Correct Answer:

Box 1: Specialized security

Securing devices as part of the privileged access story Box 2: Enterprise security

Box 3: Privileged security

Reference: https://learn.microsoft.com/en-us/security/compass/privileged-access-devices

Correct Answer: BC

B: Azure identity and access for landing zones, Privileged Identity Management (PIM)

Use Azure AD Privileged Identity Management (PIM) to establish zero-trust and least privilege access. Map your organization's roles to the minimum access levels needed. Azure AD PIM can use Azure native tools, extend current tools and

processes, or use both current and native tools as needed.

Azure identity and access for landing zones, Design recommendations include:

*

(B) Use Azure AD managed identities for Azure resources to avoid credential-based authentication. Many security breaches of public cloud resources originate with credential theft embedded in code or other text. Enforcing managed identities for programmatic access greatly reduces the risk of credential theft.

*

Etc.

C: Improve landing zone security, onboard Microsoft Sentinel You can enable Microsoft Sentinel, and then set up data connectors to monitor and protect your environment. After you connect your data sources using data connectors, you choose from a gallery of expertly created workbooks that surface insights based on your data. These workbooks can be easily customized to your needs.

Note: Landing zone security best practices

The following list of reference architectures and best practices provides examples of ways to improve landing zone security:

Microsoft Defender for Cloud: Onboard a subscription to Defender for Cloud.

Microsoft Sentinel: Onboard to Microsoft Sentinel to provide a security information event management (SIEM) and security orchestration automated response (SOAR) solution.

Secure network architecture: Reference architecture for implementing a perimeter network and secure network architecture.

Identity management and access control: Series of best practices for implementing identity and access to secure a landing zone in Azure.

Network security practices: Provides additional best practices for securing the network.

Operational security provides best practices for increasing operational security in Azure.

The Security Baseline discipline: Example of developing a governance-driven security baseline to enforce security requirements.

Incorrect:

Not E: Implementing alerts is not a preventive measure.

Reference: https://docs.microsoft.com/en-us/azure/cloud-adoption-framework/ready/landing-zone/design-area/identity-access-landing-zones

https://docs.microsoft.com/en-us/azure/sentinel/quickstart-onboard

Correct Answer: CD

C: Bastion provides secure remote access.

It uses RDP/SSH session is over TLS on port 443.

Note: Azure Bastion is a service you deploy that lets you connect to a virtual machine using your browser and the Azure portal. The Azure Bastion service is a fully platform-managed PaaS service that you provision inside your virtual network.

It provides secure and seamless RDP/SSH connectivity to your virtual machines directly from the Azure portal over TLS. When you connect via Azure Bastion, your virtual machines don't need a public IP address, agent, or special client

software.

D: Lock down inbound traffic to your Azure Virtual Machines with Microsoft Defender for Cloud's just-in-time (JIT) virtual machine (VM) access feature. This reduces exposure to attacks while providing easy access when you need to connect

to a VM.

Meets the requirement: Only provide permission to connect the virtual machines when required

Incorrect:

Not B: Does not address: Only provide permission to connect the virtual machines when required

Just Enough Administration (JEA) is a security technology that enables delegated administration for anything managed by PowerShell. With JEA, you can:

Reduce the number of administrators on your machines using virtual accounts or group-managed service accounts to perform privileged actions on behalf of regular users.

Limit what users can do by specifying which cmdlets, functions, and external commands they can run.

Better understand what your users are doing with transcripts and logs that show you exactly which commands a user executed during their session.

Not E: Does not help with the remote access.

Note: Classic Virtual Machine Contributor: Lets you manage classic virtual machines, but not access to them, and not the virtual network or storage account they're connected to.

Reference: https://docs.microsoft.com/en-us/powershell/scripting/learn/remoting/jea/overview?view=powershell-7.2 https://docs.microsoft.com/en-us/azure/defender-for-cloud/just-in-time-access-usage https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles