nerdexam
Microsoft

SC-100 · Question #176

You have a Microsoft 365 subscription and an Azure subscription. Microsoft 365 Defender and Microsoft Defender for Cloud are enabled. The Azure subscription contains 50 virtual machines. Each…

The correct answer is D. application control policies in Microsoft Defender for Endpoint. Blocking unauthorized applications on Windows Server VMs requires a policy-enforced allowlist at the endpoint level, which Microsoft Defender for Endpoint application control provides via Windows Defender Application Control (WDAC).

Design security solutions for infrastructure

Question

You have a Microsoft 365 subscription and an Azure subscription. Microsoft 365 Defender and Microsoft Defender for Cloud are enabled. The Azure subscription contains 50 virtual machines. Each virtual machine runs different applications on Windows Server 2019. You need to recommend a solution to ensure that only authorized applications can run on the virtual machines. If an unauthorized application attempts to run or be installed, the application must be blocked automatically until an administrator authorizes the application. Which security control should you recommend?

Options

  • Aapp discovery anomaly detection policies in Microsoft Defender for Cloud Apps
  • BAzure Security Benchmark compliance controls in Defender for Cloud
  • Capp registrations in Azure AD
  • Dapplication control policies in Microsoft Defender for Endpoint

How the community answered

(40 responses)
  • A
    13% (5)
  • B
    3% (1)
  • C
    5% (2)
  • D
    80% (32)

Why each option

Blocking unauthorized applications on Windows Server VMs requires a policy-enforced allowlist at the endpoint level, which Microsoft Defender for Endpoint application control provides via Windows Defender Application Control (WDAC).

Aapp discovery anomaly detection policies in Microsoft Defender for Cloud Apps

App discovery anomaly detection in Defender for Cloud Apps identifies unusual cloud application usage across network traffic but has no mechanism to block executable files from running on Windows Server virtual machines.

BAzure Security Benchmark compliance controls in Defender for Cloud

Azure Security Benchmark compliance controls in Defender for Cloud evaluate and score security posture against Microsoft's baseline but do not enforce application allowlists or automatically block unauthorized software.

Capp registrations in Azure AD

App registrations in Azure AD register applications for OAuth/OIDC-based identity and authorization flows and have no capability to control which executables are permitted to run on a VM operating system.

Dapplication control policies in Microsoft Defender for EndpointCorrect

Microsoft Defender for Endpoint application control policies leverage Windows Defender Application Control (WDAC) to define an allowlist of trusted applications per device. Any binary not on the allowlist is automatically blocked from running or installing, and an administrator must explicitly authorize a new application by updating the policy before it can execute.

Concept tested: Endpoint application allowlisting with Microsoft Defender for Endpoint

Source: https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/mde-security-configuration-management

Topics

#Application Control#Endpoint Security#Microsoft Defender for Endpoint#Virtual Machine Security

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full SC-100 Practice