SC-100 · Domain 1: Design solutions that align with security best practices and priorities · 22% of the exam
Task 1.1: Design a resiliency strategy for ransomware and other attacks based on Microsoft Security Best Practices
Prioritizing threats to business-critical assets, backup and restore that survive an attacker for hybrid and multicloud estates, the ransomware plan's order of privileged access and recovery, and security updates.
Study it
Business-critical assets, threat priorities and resiliency goals
Lesson coming
Backup and restore that survive ransomware: immutable vaults and recovery order
The ransomware plan: privileged access first, then BCDR, and security updates
Lesson coming
Sample questions
Try each one before opening the answer. Every option is explained, with the Microsoft documentation page that proves it.
Question 1 · choose 1
A manufacturer has just had a ransomware scare. Its backups sit on a domain-joined backup server that the same domain admins manage, and nobody has tested a full restore. The CISO can fund one workstream this quarter and wants to follow Microsoft's ransomware protection guidance, so that a future attack doesn't force the company to choose between paying and losing data. Which workstream should get the funding first?
ADeploy privileged access workstations for every domain administrator first, and leave the backup design as it is for now
BMake critical systems restorable from backups that attackers can't erase or encrypt
CReplace the VPN with a cloud remote access service and tighten email filtering at the perimeter
DBuy a cyber insurance policy that covers ransom payments and reserve budget for negotiators
Show the answer and why
ADeploy privileged access workstations for every domain administrator first, and leave the backup design as it is for now
Incorrect
Protecting privileged roles is the second step, meant to limit the damage; without a restorable backup the company still can't recover.
BMake critical systems restorable from backups that attackers can't erase or encrypt
Correct
The guidance puts the recovery plan first: restoring from protected backups is the most immediate way to avoid being forced to pay.
CReplace the VPN with a cloud remote access service and tighten email filtering at the perimeter
Incorrect
Making it hard to get in is the third step; it reduces the chance of entry but does nothing for recovery after an attack succeeds.
DBuy a cyber insurance policy that covers ransom payments and reserve budget for negotiators
Incorrect
Paying is the outcome the guidance tries to avoid; insurance doesn't give the company a way to restore its data.
Microsoft's ransomware protection guidance has three steps in order: prepare a recovery plan (critical systems backed up and the backups protected from deliberate erasure or encryption), limit the scope of damage by protecting privileged roles, and make it hard to get in. Phase 1 calls the ability to restore from storage that neither you nor the attacker can modify the most immediate and effective action against being forced to pay.
A bank backs up its Azure VMs to a Recovery Services vault. The design must ensure that recovery points can't be deleted before their retention ends or have their retention cut, even by someone who holds Owner on the vault's subscription, and that nobody can later switch this protection off. Which design meets the requirement?
AAdd a CanNotDelete resource lock to the vault and to the resource group that contains it
BLengthen the soft delete retention period configured on the vault
CEnable immutability on the vault and leave it unlocked for flexibility
DEnable immutability on the vault and lock it so that the setting becomes irreversible
Show the answer and why
AAdd a CanNotDelete resource lock to the vault and to the resource group that contains it
Incorrect
An Owner can remove a resource lock, and a lock doesn't stop retention from being reduced in a backup policy.
BLengthen the soft delete retention period configured on the vault
Incorrect
Soft delete keeps deleted backup data for a while, but it doesn't stop a policy change that shortens retention, and it isn't the same irreversible control.
CEnable immutability on the vault and leave it unlocked for flexibility
Incorrect
Unlocked immutability is reversible, so a compromised owner could disable it first and then delete recovery points.
DEnable immutability on the vault and lock it so that the setting becomes irreversible
Correct
Locked immutability blocks the operations that could lose recovery points, and once locked it can't be disabled by anyone.
An immutable vault blocks operations that could lead to loss of recovery points, such as deleting them early or reducing retention. Immutability is reversible until you lock it; locking makes it irreversible so that malicious actors can't disable immutability and then delete backups. Resource locks and soft delete are useful but can be undone or don't block retention changes.
Your backup administrators manage several Recovery Services vaults. You want critical operations, such as disabling soft delete or reducing protection, to need approval from the security team, and a backup administrator whose account is compromised must not be able to approve their own request. Which two design choices support this? (Choose TWO.)
ACreate Resource Guard in the vaults' own resource group so that both share the same owners and one team runs the whole setup
BPlace Resource Guard in a subscription or tenant that the security team controls, separate from the vaults
CGive each backup administrator a standing Backup MUA Operator assignment on Resource Guard so that urgent requests aren't delayed
DMake sure the backup administrators hold no Contributor, Backup MUA Admin or Backup MUA Operator role on Resource Guard
EAdd a ReadOnly resource lock on every vault instead of using Resource Guard
Show the answer and why
ACreate Resource Guard in the vaults' own resource group so that both share the same owners and one team runs the whole setup
Incorrect
Shared ownership defeats the purpose: a different user must own Resource Guard.
BPlace Resource Guard in a subscription or tenant that the security team controls, separate from the vaults
Correct
A Resource Guard in a different subscription or tenant gives the most isolation between the backup admin and the security admin.
CGive each backup administrator a standing Backup MUA Operator assignment on Resource Guard so that urgent requests aren't delayed
Incorrect
Standing rights on Resource Guard let the same person both request and authorize the operation.
DMake sure the backup administrators hold no Contributor, Backup MUA Admin or Backup MUA Operator role on Resource Guard
Correct
The vault admin must not have those roles on Resource Guard; otherwise they could authorize their own critical operation.
EAdd a ReadOnly resource lock on every vault instead of using Resource Guard
Incorrect
A ReadOnly lock blocks normal backup management and can be removed by an owner; it doesn't create a second approver.
Multi-user authorization (MUA) for Azure Backup uses Resource Guard as an extra authorization check for critical operations. A different user must own Resource Guard, the vault admin must not have Contributor, Backup MUA Admin or Backup MUA Operator on it, and placing it in a different subscription or tenant gives maximum isolation between the backup admin and the security admin.
On-premises file servers are backed up to Azure with the MARS agent. Your threat model assumes an attacker gains local administrator rights on a file server and tries to stop protection and delete the cloud backup data. Which built-in capability adds an extra check before that operation can run?
AA security PIN from the Azure portal for critical operations
BThe encryption passphrase that the MARS agent applies to the data before every upload
CGeo-redundant replication of the vault that receives the backups
DA daily backup schedule with retention of thirty recovery points
Show the answer and why
AA security PIN from the Azure portal for critical operations
Correct
With the security features enabled, Stop Protection with Delete data and Change Passphrase need the security PIN, which a server admin doesn't have.
BThe encryption passphrase that the MARS agent applies to the data before every upload
Incorrect
The passphrase keeps the data confidential; it doesn't stop an operator on the server from requesting deletion.
CGeo-redundant replication of the vault that receives the backups
Incorrect
Replication copies the vault's state, including deletions; it isn't an authorization check.
DA daily backup schedule with retention of thirty recovery points
Incorrect
Retention settings decide how much history is kept but don't add a check before deletion.
The hybrid backup security features of Azure Backup add three things: a security PIN for critical operations (such as Stop Protection with Delete data and Change Passphrase, and on newer MARS versions retention reductions), retention of deleted backup data for 14 more days, and email alerts on critical operations.
A retailer runs Windows and Linux servers in Azure, in two on-premises datacenters and in AWS. The security architect wants one service that shows missing security updates across all of them every day and applies them in maintenance windows the operations team defines, without running separate update servers at each site. What should the design use?
AAzure Update Manager, with the on-premises and AWS servers connected through Azure Arc
BWindows Autopatch, with every server enrolled as a managed device
CA WSUS server in each datacenter and in AWS, reporting to a shared database
DMicrosoft Defender Vulnerability Management, configured to install the missing updates on every server itself
Show the answer and why
AAzure Update Manager, with the on-premises and AWS servers connected through Azure Arc
Correct
Update Manager assesses and patches Azure VMs and Arc-connected machines in other clouds or on premises from one place, with periodic assessment and maintenance schedules.
BWindows Autopatch, with every server enrolled as a managed device
Incorrect
Windows Autopatch automates updates for Windows client devices and Microsoft 365 Apps; it doesn't patch Linux or Windows servers.
CA WSUS server in each datacenter and in AWS, reporting to a shared database
Incorrect
Separate update servers per site are what the architect wants to avoid, and WSUS doesn't patch Linux.
DMicrosoft Defender Vulnerability Management, configured to install the missing updates on every server itself
Incorrect
Defender Vulnerability Management doesn't install operating system updates on servers in maintenance windows.
Azure Update Manager manages updates for Windows and Linux servers in Azure, on premises and in other clouds connected by Azure Arc, from one view. It offers periodic assessments every 24 hours and customer-defined maintenance schedules.
Microsoft's ransomware guidance describes who is accountable for the privileged access strategy that limits an attack's impact. Who provides executive sponsorship?
AThe user education team
BThe CISO or CIO
CThe security compliance management team
DThe central IT productivity team
Show the answer and why
AThe user education team
Incorrect
That team updates password guidance.
BThe CISO or CIO
Correct
The accountability table names the CISO or CIO for executive sponsorship.
CThe security compliance management team
Incorrect
That team monitors compliance with the changes.
DThe central IT productivity team
Incorrect
That team implements device and tenant changes.
The phase 2 guidance lays out the privileged access strategy as a sponsorship, program and project hierarchy: the CISO or CIO sponsors it, a program lead drives results, and architects and implementation teams carry out the changes.
A team asks whether it must turn something on to have its Azure Backup data encrypted at rest. What is the default?
ABackup data is stored unencrypted until a customer-managed key is added
BOnly backups of encrypted VMs are encrypted in the vault
CEncryption is available only for on-premises backups taken with the MARS agent
DIt's encrypted automatically with platform-managed keys
Show the answer and why
ABackup data is stored unencrypted until a customer-managed key is added
Incorrect
Encryption at rest is on by default.
BOnly backups of encrypted VMs are encrypted in the vault
Incorrect
All backup data is encrypted at rest, whatever the source.
CEncryption is available only for on-premises backups taken with the MARS agent
Incorrect
Encryption at rest applies to every workload in the vault.
DIt's encrypted automatically with platform-managed keys
Correct
Encryption with platform-managed keys is automatic; you can choose your own keys in Key Vault.
Azure Backup automatically encrypts backed-up data with platform-managed keys. You can also encrypt it with customer-managed keys stored in Azure Key Vault.
An architect wants deleted Azure Backup data to stay recoverable long enough to notice a slow, stealthy attack. What soft delete retention can the vault use?
A7 days by default, extendable up to 30 days
B30 days, fixed and not configurable
C14 days by default, extendable up to 180 days
D90 days by default, extendable up to a full 365 days
Show the answer and why
A7 days by default, extendable up to 30 days
Incorrect
That isn't the Azure Backup range.
B30 days, fixed and not configurable
Incorrect
The retention is configurable within its range.
C14 days by default, extendable up to 180 days
Correct
Soft delete retention ranges from 14 to 180 days, with 14 days by default.
D90 days by default, extendable up to a full 365 days
Incorrect
The maximum is 180 days.
Soft delete delays permanent deletion of backup data. The retention period is 14 days by default and can be extended to 180 days; the first 14 days carry no extra cost.
On-premises data backed up with the MARS agent is encrypted with a passphrase before upload. Who holds that passphrase?
AMicrosoft support, which can recover it if it's lost
BThe Recovery Services vault, which stores it in Key Vault
CAny Backup Contributor on the vault's subscription
DOnly the user who created it and the agent configured with it
Show the answer and why
AMicrosoft support, which can recover it if it's lost
Incorrect
Nothing about the passphrase is shared with the service.
BThe Recovery Services vault, which stores it in Key Vault
Incorrect
The vault doesn't hold the passphrase.
CAny Backup Contributor on the vault's subscription
Incorrect
Azure roles don't reveal the passphrase.
DOnly the user who created it and the agent configured with it
Correct
The passphrase isn't transmitted to or shared with the Azure Backup service.
Data backed up with the MARS agent is encrypted with a passphrase before upload and decrypted only after download. The passphrase is available only to the user who created it and the agent configured with it.