Question 420
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A high-privilege application credential appears in a public repository and the response team plans only to delete the commit. (2) An incident commander suspends a compromised administrator but leaves an active privileged cloud session untouched. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Correlate role audit events to approvals and investigate unexplained elevation. | (2) Revoke active sessions and review delegated app tokens in addition to disabling the account.
- (1) Revoke and rotate the exposed credential, then investigate its use and effective grants. | (2) Rehearse emergency access under controlled monitoring and document safe credential custody.
- (1) Correlate role audit events to approvals and investigate unexplained elevation. | (2) Rehearse emergency access under controlled monitoring and document safe credential custody.
- (1) Revoke and rotate the exposed credential, then investigate its use and effective grants. | (2) Revoke active sessions and review delegated app tokens in addition to disabling the account.
Explanation
Correct Answer
D:For requirement (1), Repository removal does not invalidate a secret that attackers may have copied. For requirement (2), Session containment may require actions beyond account state changes. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (1) is not met: Repository removal does not invalidate a secret that attackers may have copied. The substituted action is instead for this different case: A security review finds administrative role changes with no change ticket or recorded business purpose. The proposed bundle therefore cannot satisfy BOTH stated requirements.
B:Requirement (2) is not met: Session containment may require actions beyond account state changes. The substituted action is instead for this different case: A security team wants to test emergency access without leaving a highly privileged account active in daily workflows. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (1) is not met: Repository removal does not invalidate a secret that attackers may have copied. The substituted action is instead for this different case: A security review finds administrative role changes with no change ticket or recorded business purpose. Requirement (2) is not met: Session containment may require actions beyond account state changes. The substituted action is instead for this different case: A security team wants to test emergency access without leaving a highly privileged account active in daily workflows. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 421
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A privileged insider can export an entire regulated dataset despite only needing aggregate reports. (2) An external attacker obtains one employee password and can access several administrative interfaces without a new check. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Implement time-bound entitlements with periodic access reviews and automatic deprovisioning. | (2) Design phishing-resistant MFA and context-aware Conditional Access for sensitive operations.
- (1) Combine least-privilege data roles, sensitive-data monitoring and governed exfiltration controls. | (2) Scope third-party application permissions and establish rapid revocation and monitoring of delegated grants.
- (1) Implement time-bound entitlements with periodic access reviews and automatic deprovisioning. | (2) Scope third-party application permissions and establish rapid revocation and monitoring of delegated grants.
- (1) Combine least-privilege data roles, sensitive-data monitoring and governed exfiltration controls. | (2) Design phishing-resistant MFA and context-aware Conditional Access for sensitive operations.
Explanation
Correct Answer
D:For requirement (1), Restricting broad read access and detecting risky movement reduce insider-data exposure. For requirement (2), Strong authentication and risk evaluation limit credential replay across privileged surfaces. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (1) is not met: Restricting broad read access and detecting risky movement reduce insider-data exposure. The substituted action is instead for this different case: A contractor's access remains active after their approved business engagement ends. The proposed bundle therefore cannot satisfy BOTH stated requirements.
B:Requirement (2) is not met: Strong authentication and risk evaluation limit credential replay across privileged surfaces. The substituted action is instead for this different case: A supply-chain incident compromises a trusted vendor integration that has tenant-wide API permissions. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (1) is not met: Restricting broad read access and detecting risky movement reduce insider-data exposure. The substituted action is instead for this different case: A contractor's access remains active after their approved business engagement ends. Requirement (2) is not met: Strong authentication and risk evaluation limit credential replay across privileged surfaces. The substituted action is instead for this different case: A supply-chain incident compromises a trusted vendor integration that has tenant-wide API permissions. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 422
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) An Azure Function needs to read a single storage container but currently stores the account access key. (2) A scheduled job authenticates with a certificate embedded inside a container image copied to every environment. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Design supported workload identity federation and Key Vault data permissions for that pod. | (2) Move workload authentication to supported federated credentials or managed identity with controlled rotation.
- (1) Grant its managed identity scoped Azure RBAC for the required storage data operations. | (2) Validate token audience, issuer and intended resource authorization in the application trust design.
- (1) Design supported workload identity federation and Key Vault data permissions for that pod. | (2) Validate token audience, issuer and intended resource authorization in the application trust design.
- (1) Grant its managed identity scoped Azure RBAC for the required storage data operations. | (2) Move workload authentication to supported federated credentials or managed identity with controlled rotation.
Explanation
Correct Answer
D:For requirement (1), Scoped managed identity eliminates reusable account keys and narrows permitted operations. For requirement (2), Image distribution must not spread persistent private keys across deployments. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (1) is not met: Scoped managed identity eliminates reusable account keys and narrows permitted operations. The substituted action is instead for this different case: A Kubernetes pod receives cluster admin privileges to access one Azure Key Vault secret. The proposed bundle therefore cannot satisfy BOTH stated requirements.
B:Requirement (2) is not met: Image distribution must not spread persistent private keys across deployments. The substituted action is instead for this different case: A service-to-service request succeeds with an OAuth token that belongs to the wrong audience. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (1) is not met: Scoped managed identity eliminates reusable account keys and narrows permitted operations. The substituted action is instead for this different case: A Kubernetes pod receives cluster admin privileges to access one Azure Key Vault secret. Requirement (2) is not met: Image distribution must not spread persistent private keys across deployments. The substituted action is instead for this different case: A service-to-service request succeeds with an OAuth token that belongs to the wrong audience. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 423
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A financial services tenant receives executive impersonation messages and only basic bulk-spam filtering is configured. (2) Employees often click links that become malicious after a message was delivered. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Design targeted anti-phishing impersonation protection using Defender for Office 365. | (2) Include Defender for Office 365 Safe Links time-of-click protection for eligible workloads.
- (1) Evaluate Safe Attachments detonation and disposition policy for protected recipient groups. | (2) Include Defender for Office 365 Safe Links time-of-click protection for eligible workloads.
- (1) Design targeted anti-phishing impersonation protection using Defender for Office 365. | (2) Design approved Threat Explorer investigation and scoped post-delivery remediation workflows.
- (1) Evaluate Safe Attachments detonation and disposition policy for protected recipient groups. | (2) Design approved Threat Explorer investigation and scoped post-delivery remediation workflows.
Explanation
Correct Answer
A:For requirement (1), Impersonation controls address targeted sender deception beyond generic spam volume. For requirement (2), URL risk can change between delivery and user interaction, so click-time inspection provides a separate protection opportunity. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
B:Requirement (1) is not met: Impersonation controls address targeted sender deception beyond generic spam volume. The substituted action is instead for this different case: The organization requires suspicious attachments analyzed before employees open them. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (2) is not met: URL risk can change between delivery and user interaction, so click-time inspection provides a separate protection opportunity. The substituted action is instead for this different case: A SOC can identify malicious email but lacks a governed process to remove matching messages from other mailboxes. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: Impersonation controls address targeted sender deception beyond generic spam volume. The substituted action is instead for this different case: The organization requires suspicious attachments analyzed before employees open them. Requirement (2) is not met: URL risk can change between delivery and user interaction, so click-time inspection provides a separate protection opportunity. The substituted action is instead for this different case: A SOC can identify malicious email but lacks a governed process to remove matching messages from other mailboxes. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 424
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A SOC tries to isolate a compromised endpoint but the device has been offline since yesterday. (2) A reimaged laptop appears under three device records and skews threat inventory counts. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Alert on missing sensor check-in and integrity anomalies as security signals. | (2) Define remediation verification that inspects persistence and related credential compromise.
- (1) Design containment verification and an alternate response path for unreachable devices. | (2) Reconcile device identities and retire stale endpoint records using supported lifecycle procedures.
- (1) Alert on missing sensor check-in and integrity anomalies as security signals. | (2) Reconcile device identities and retire stale endpoint records using supported lifecycle procedures.
- (1) Design containment verification and an alternate response path for unreachable devices. | (2) Define remediation verification that inspects persistence and related credential compromise.
Explanation
Correct Answer
B:For requirement (1), A remote isolation request may remain pending without endpoint connectivity. For requirement (2), Accurate inventory is required for meaningful exposure and coverage metrics. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (1) is not met: A remote isolation request may remain pending without endpoint connectivity. The substituted action is instead for this different case: An attacker disables endpoint telemetry, and the operations team interprets no alerts as no compromise. Requirement (2) is not met: Accurate inventory is required for meaningful exposure and coverage metrics. The substituted action is instead for this different case: A client malware alert is closed when the process exits but persistence tasks remain installed. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (1) is not met: A remote isolation request may remain pending without endpoint connectivity. The substituted action is instead for this different case: An attacker disables endpoint telemetry, and the operations team interprets no alerts as no compromise. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (2) is not met: Accurate inventory is required for meaningful exposure and coverage metrics. The substituted action is instead for this different case: A client malware alert is closed when the process exits but persistence tasks remain installed. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 425
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A partner organization needs access to one project application but should retain its own identity administration. (2) A vendor engagement ends, but B2B guest users remain members of multiple security groups. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Use a governed Microsoft Entra B2B cross-tenant collaboration design with scoped resource grants. | (2) Separate identity proof verification from application authorization and Conditional Access evaluation.
- (1) Evaluate supported verifiable credential issuance and presentation with minimum disclosed claims. | (2) Separate identity proof verification from application authorization and Conditional Access evaluation.
- (1) Use a governed Microsoft Entra B2B cross-tenant collaboration design with scoped resource grants. | (2) Automate guest access expiration and sponsor-backed access reviews across effective memberships.
- (1) Evaluate supported verifiable credential issuance and presentation with minimum disclosed claims. | (2) Automate guest access expiration and sponsor-backed access reviews across effective memberships.
Explanation
Correct Answer
C:For requirement (1), B2B collaboration preserves independent home identities while limiting access to approved resources. For requirement (2), Removing one shared link may leave app and group permissions intact, so the full guest entitlement inventory must be reviewed. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (2) is not met: Removing one shared link may leave app and group permissions intact, so the full guest entitlement inventory must be reviewed. The substituted action is instead for this different case: A security architect assumes that verification of an external credential automatically grants access to every company application. The proposed bundle therefore cannot satisfy BOTH stated requirements.
B:Requirement (1) is not met: B2B collaboration preserves independent home identities while limiting access to approved resources. The substituted action is instead for this different case: A team wants to rely on a verifiable credential to attest a training qualification without copying the holder's complete identity file. Requirement (2) is not met: Removing one shared link may leave app and group permissions intact, so the full guest entitlement inventory must be reviewed. The substituted action is instead for this different case: A security architect assumes that verification of an external credential automatically grants access to every company application. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: B2B collaboration preserves independent home identities while limiting access to approved resources. The substituted action is instead for this different case: A team wants to rely on a verifiable credential to attest a training qualification without copying the holder's complete identity file. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 426
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A regulated database is directly exposed to internet clients despite only internal applications needing connections. (2) Multiple application tiers use a single broad network security group allowing all east-west traffic. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Design private endpoints and controlled network routing for the database service. | (2) Test effective routing symmetry and firewall state handling for hub-and-spoke inspection.
- (1) Include private DNS resolution and forwarding in the hybrid network design. | (2) Test effective routing symmetry and firewall state handling for hub-and-spoke inspection.
- (1) Design private endpoints and controlled network routing for the database service. | (2) Segment workloads with least-privilege network security group and firewall rules.
- (1) Include private DNS resolution and forwarding in the hybrid network design. | (2) Segment workloads with least-privilege network security group and firewall rules.
Explanation
Correct Answer
C:For requirement (1), Limiting public reachability reduces exposure of sensitive data-plane interfaces. For requirement (2), Explicit flow restrictions reduce lateral movement between tiers. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (2) is not met: Explicit flow restrictions reduce lateral movement between tiers. The substituted action is instead for this different case: An enterprise deploys two regional hubs but forgets to validate asymmetric return traffic through inspection appliances. The proposed bundle therefore cannot satisfy BOTH stated requirements.
B:Requirement (1) is not met: Limiting public reachability reduces exposure of sensitive data-plane interfaces. The substituted action is instead for this different case: A hybrid application requires private connectivity but its on-premises network cannot resolve the private endpoint's DNS name. Requirement (2) is not met: Explicit flow restrictions reduce lateral movement between tiers. The substituted action is instead for this different case: An enterprise deploys two regional hubs but forgets to validate asymmetric return traffic through inspection appliances. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: Limiting public reachability reduces exposure of sensitive data-plane interfaces. The substituted action is instead for this different case: A hybrid application requires private connectivity but its on-premises network cannot resolve the private endpoint's DNS name. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 427
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) An Azure subscription has hundreds of unused Owner roles assigned to service principals. (2) A project uses identical privilege reports for Azure and AWS while ignoring provider-specific permission semantics. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Review effective cloud entitlements and remove unnecessary standing role grants. | (2) Normalize entitlement risk across providers while retaining provider-specific authorization evaluation.
- (1) Reduce its effective permissions to diagnostics-read operations at the smallest practical resource scope. | (2) Normalize entitlement risk across providers while retaining provider-specific authorization evaluation.
- (1) Review effective cloud entitlements and remove unnecessary standing role grants. | (2) Incorporate activity evidence and resource criticality into cloud entitlement reviews.
- (1) Reduce its effective permissions to diagnostics-read operations at the smallest practical resource scope. | (2) Incorporate activity evidence and resource criticality into cloud entitlement reviews.
Explanation
Correct Answer
A:For requirement (1), Excess cloud permissions create takeover paths for dormant identities. For requirement (2), Multicloud access review needs comparable exposure without assuming the role models are identical. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
B:Requirement (1) is not met: Excess cloud permissions create takeover paths for dormant identities. The substituted action is instead for this different case: A managed identity can change production network routing despite only needing to read telemetry. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (2) is not met: Multicloud access review needs comparable exposure without assuming the role models are identical. The substituted action is instead for this different case: The security team sees role assignments but cannot tell whether users actually exercise their entitlements. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: Excess cloud permissions create takeover paths for dormant identities. The substituted action is instead for this different case: A managed identity can change production network routing despite only needing to read telemetry. Requirement (2) is not met: Multicloud access review needs comparable exposure without assuming the role models are identical. The substituted action is instead for this different case: The security team sees role assignments but cannot tell whether users actually exercise their entitlements. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 428
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A tabletop exercise tests backup retrieval but never identifies who can authorize a regulated-data restoration. (2) Two response teams execute contradictory network isolation and service restoration commands during the same ransomware drill. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Assign incident recovery decision rights and approval gates for sensitive data access. | (2) Trigger resilience reassessment after material architecture changes and maintain current runbooks.
- (1) Include business-process owners and freshness acceptance criteria in disaster-recovery testing. | (2) Trigger resilience reassessment after material architecture changes and maintain current runbooks.
- (1) Assign incident recovery decision rights and approval gates for sensitive data access. | (2) Establish a single incident command workflow with explicit containment and recovery handoffs.
- (1) Include business-process owners and freshness acceptance criteria in disaster-recovery testing. | (2) Establish a single incident command workflow with explicit containment and recovery handoffs.
Explanation
Correct Answer
C:For requirement (1), Governance controls establish who can use recovery material and preserve accountability during emergencies. For requirement (2), Coordinated authority prevents responders from undoing each other's actions under crisis conditions. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (2) is not met: Coordinated authority prevents responders from undoing each other's actions under crisis conditions. The substituted action is instead for this different case: A business continuity plan has no schedule to re-test after the organization moves its primary data platform to another cloud. The proposed bundle therefore cannot satisfy BOTH stated requirements.
B:Requirement (1) is not met: Governance controls establish who can use recovery material and preserve accountability during emergencies. The substituted action is instead for this different case: Recovery tests meet infrastructure RTOs but fail business-user sign-off because downstream reports lack recent data. Requirement (2) is not met: Coordinated authority prevents responders from undoing each other's actions under crisis conditions. The substituted action is instead for this different case: A business continuity plan has no schedule to re-test after the organization moves its primary data platform to another cloud. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: Governance controls establish who can use recovery material and preserve accountability during emergencies. The substituted action is instead for this different case: Recovery tests meet infrastructure RTOs but fail business-user sign-off because downstream reports lack recent data. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 429
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) Facilities deploy thousands of smart building sensors with default passwords and no central device registry. (2) A device gateway accepts unencrypted readings from field sensors across untrusted networks. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Specify secure update capability and controlled end-of-life replacement for embedded devices. | (2) Segment IoT networks and limit gateway-to-enterprise traffic to defined protocols.
- (1) Require unique device identity, credential provisioning and asset inventory for IoT onboarding. | (2) Design authenticated encrypted transport and gateway authorization for IoT telemetry.
- (1) Specify secure update capability and controlled end-of-life replacement for embedded devices. | (2) Design authenticated encrypted transport and gateway authorization for IoT telemetry.
- (1) Require unique device identity, credential provisioning and asset inventory for IoT onboarding. | (2) Segment IoT networks and limit gateway-to-enterprise traffic to defined protocols.
Explanation
Correct Answer
B:For requirement (1), Device identity controls prevent shared default credentials from scaling into systemic exposure. For requirement (2), Protected communication mitigates impersonation and disclosure along sensor paths. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (1) is not met: Device identity controls prevent shared default credentials from scaling into systemic exposure. The substituted action is instead for this different case: An IoT fleet cannot be patched remotely and no one has documented expected service life or retirement. Requirement (2) is not met: Protected communication mitigates impersonation and disclosure along sensor paths. The substituted action is instead for this different case: A retail sensor network shares routing with payment processing servers despite no operational dependency. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (1) is not met: Device identity controls prevent shared default credentials from scaling into systemic exposure. The substituted action is instead for this different case: An IoT fleet cannot be patched remotely and no one has documented expected service life or retirement. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (2) is not met: Protected communication mitigates impersonation and disclosure along sensor paths. The substituted action is instead for this different case: A retail sensor network shares routing with payment processing servers despite no operational dependency. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 430
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A partner API receives legitimate requests but cannot distinguish which partner is allowed to call a sensitive operation. (2) An API gateway accepts unlimited requests from every subscription and the backend repeatedly exhausts capacity. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Design authenticated partner identities and per-API authorization in Azure API Management. | (2) Redact credentials and personal content in API telemetry and restrict diagnostic access.
- (1) Design governed API versioning and staged deprecation for breaking changes. | (2) Redact credentials and personal content in API telemetry and restrict diagnostic access.
- (1) Design authenticated partner identities and per-API authorization in Azure API Management. | (2) Configure appropriate API Management rate and quota limits aligned to business contracts.
- (1) Design governed API versioning and staged deprecation for breaking changes. | (2) Configure appropriate API Management rate and quota limits aligned to business contracts.
Explanation
Correct Answer
C:For requirement (1), Gateway policies can enforce caller-specific API access rather than only route traffic. For requirement (2), Traffic governance protects availability and enforces fair resource consumption. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (2) is not met: Traffic governance protects availability and enforces fair resource consumption. The substituted action is instead for this different case: A gateway logs full bearer tokens and sensitive request payloads to an unrestricted workspace. The proposed bundle therefore cannot satisfy BOTH stated requirements.
B:Requirement (1) is not met: Gateway policies can enforce caller-specific API access rather than only route traffic. The substituted action is instead for this different case: An architect publishes an API without a revision or version policy, breaking all consumers when its contract changes. Requirement (2) is not met: Traffic governance protects availability and enforces fair resource consumption. The substituted action is instead for this different case: A gateway logs full bearer tokens and sensitive request payloads to an unrestricted workspace. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: Gateway policies can enforce caller-specific API access rather than only route traffic. The substituted action is instead for this different case: An architect publishes an API without a revision or version policy, breaking all consumers when its contract changes. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Microsoft Cybersecurity Architect (SC-100) Practice Tests