Question 450
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A security dashboard lists alert counts but cannot demonstrate which adversary techniques are detected. (2) A factory SOC adopts only enterprise IT ATT&CK techniques while its control networks use industrial protocols. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Map detection use cases to MITRE ATT&CK techniques and identify uncovered tactics. | (2) Test analytic coverage against representative variations and record the sensor and response assumptions.
- (1) Evaluate mobile-relevant MITRE ATT&CK behaviors and mobile telemetry availability. | (2) Test analytic coverage against representative variations and record the sensor and response assumptions.
- (1) Map detection use cases to MITRE ATT&CK techniques and identify uncovered tactics. | (2) Include appropriate ATT&CK for ICS techniques and industrial event sources in detection design.
- (1) Evaluate mobile-relevant MITRE ATT&CK behaviors and mobile telemetry availability. | (2) Include appropriate ATT&CK for ICS techniques and industrial event sources in detection design.
Explanation
Correct Answer
C:For requirement (1), Technique coverage exposes blind spots that simple alert volumes conceal. For requirement (2), Operational technology threats differ from conventional office endpoint behavior. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (2) is not met: Operational technology threats differ from conventional office endpoint behavior. The substituted action is instead for this different case: A team treats a red-team simulation detection as proven coverage for every variant of an ATT&CK technique. The proposed bundle therefore cannot satisfy BOTH stated requirements.
B:Requirement (1) is not met: Technique coverage exposes blind spots that simple alert volumes conceal. The substituted action is instead for this different case: An investigation labels all mobile-device anomalies as workstation persistence and misroutes response. Requirement (2) is not met: Operational technology threats differ from conventional office endpoint behavior. The substituted action is instead for this different case: A team treats a red-team simulation detection as proven coverage for every variant of an ATT&CK technique. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: Technique coverage exposes blind spots that simple alert volumes conceal. The substituted action is instead for this different case: An investigation labels all mobile-device anomalies as workstation persistence and misroutes response. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 451
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A security design review accepts a product diagram but lacks evidence of how the proposed controls work under failure. (2) An enterprise trusts a vendor reference configuration even though the deployment environment has different identity and network constraints. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Define architecture acceptance criteria that include control testing, telemetry and failure-mode verification. | (2) Introduce repeatable automated evidence collection and independent control-owner review.
- (1) Assess control coverage across every approved location and execution environment. | (2) Introduce repeatable automated evidence collection and independent control-owner review.
- (1) Define architecture acceptance criteria that include control testing, telemetry and failure-mode verification. | (2) Validate reference recommendations against local prerequisites and record justified design deviations.
- (1) Assess control coverage across every approved location and execution environment. | (2) Validate reference recommendations against local prerequisites and record justified design deviations.
Explanation
Correct Answer
C:For requirement (1), Diagram-level intent must be demonstrated through observable operating behavior. For requirement (2), Reusable architecture patterns still require environment-specific engineering decisions. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (2) is not met: Reusable architecture patterns still require environment-specific engineering decisions. The substituted action is instead for this different case: An engineering team plans to claim continuous compliance from an annual spreadsheet completed by a single administrator. The proposed bundle therefore cannot satisfy BOTH stated requirements.
B:Requirement (1) is not met: Diagram-level intent must be demonstrated through observable operating behavior. The substituted action is instead for this different case: A control has been implemented only in the primary region while workloads also serve regulated traffic elsewhere. Requirement (2) is not met: Reusable architecture patterns still require environment-specific engineering decisions. The substituted action is instead for this different case: An engineering team plans to claim continuous compliance from an annual spreadsheet completed by a single administrator. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: Diagram-level intent must be demonstrated through observable operating behavior. The substituted action is instead for this different case: A control has been implemented only in the primary region while workloads also serve regulated traffic elsewhere. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 452
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A cloud project seeks the highest possible Secure Score but ignores regulatory data residency obligations. (2) Two business units deploy redundant identity tools that disagree about the authoritative account lifecycle. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Include third-party and internal trust relationships in the threat inventory and mitigation plan. | (2) Translate identified control gaps into risk-ranked treatment decisions with accountable owners.
- (1) Prioritize risk and compliance requirements before using posture scores to choose compensating controls. | (2) Establish an agreed source of identity truth and consistent joiner-mover-leaver architecture.
- (1) Include third-party and internal trust relationships in the threat inventory and mitigation plan. | (2) Establish an agreed source of identity truth and consistent joiner-mover-leaver architecture.
- (1) Prioritize risk and compliance requirements before using posture scores to choose compensating controls. | (2) Translate identified control gaps into risk-ranked treatment decisions with accountable owners.
Explanation
Correct Answer
B:For requirement (1), A numeric posture score does not measure every legal and business constraint. For requirement (2), Competing identity authorities produce access drift despite strong individual controls. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (1) is not met: A numeric posture score does not measure every legal and business constraint. The substituted action is instead for this different case: An architecture review lists technical threats but excludes vendors and privileged operators from the attack surface. Requirement (2) is not met: Competing identity authorities produce access drift despite strong individual controls. The substituted action is instead for this different case: A risk committee receives control gaps without impact, likelihood or remediation ownership. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (1) is not met: A numeric posture score does not measure every legal and business constraint. The substituted action is instead for this different case: An architecture review lists technical threats but excludes vendors and privileged operators from the attack surface. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (2) is not met: Competing identity authorities produce access drift despite strong individual controls. The substituted action is instead for this different case: A risk committee receives control gaps without impact, likelihood or remediation ownership. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 453
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) An engineer proposes that every cloud administrator also hold permanent enterprise domain administrator privileges. (2) The help desk needs to reset passwords for one subsidiary but receives tenant-wide user administrator rights. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Separate privileged access tiers and delegate authority only for the required control plane. | (2) Scope supported administrative roles to the subsidiary through appropriate administrative units.
- (1) Establish dedicated monitored emergency access accounts with restricted routine use. | (2) Scope supported administrative roles to the subsidiary through appropriate administrative units.
- (1) Separate privileged access tiers and delegate authority only for the required control plane. | (2) Replace blanket standing ownership with narrow scoped roles and approved elevation paths.
- (1) Establish dedicated monitored emergency access accounts with restricted routine use. | (2) Replace blanket standing ownership with narrow scoped roles and approved elevation paths.
Explanation
Correct Answer
A:For requirement (1), Compartmentalized administration reduces the impact of one compromised privileged identity. For requirement (2), Delegated scope limits which directory objects an operator may modify. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
B:Requirement (1) is not met: Compartmentalized administration reduces the impact of one compromised privileged identity. The substituted action is instead for this different case: A tenant contains an emergency access identity with ordinary email and browsing enabled. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (2) is not met: Delegated scope limits which directory objects an operator may modify. The substituted action is instead for this different case: An automation account receives direct permanent Owner permissions on every production subscription. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: Compartmentalized administration reduces the impact of one compromised privileged identity. The substituted action is instead for this different case: A tenant contains an emergency access identity with ordinary email and browsing enabled. Requirement (2) is not met: Delegated scope limits which directory objects an operator may modify. The substituted action is instead for this different case: An automation account receives direct permanent Owner permissions on every production subscription. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 454
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A mixed Windows and Linux server fleet has no consistent detection coverage or local hardening baseline. (2) An internet-facing Windows server runs an unsupported OS and the team expects ordinary patch deployment to fix it. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Specify OS-specific endpoint protection and secure configuration standards for the server estate. | (2) Include host operating-system patching and vulnerability monitoring in the container platform baseline.
- (1) Restrict privileged management ingress and require approved hardened administrative pathways. | (2) Include host operating-system patching and vulnerability monitoring in the container platform baseline.
- (1) Specify OS-specific endpoint protection and secure configuration standards for the server estate. | (2) Plan isolation or migration to a supported platform with documented interim risk controls.
- (1) Restrict privileged management ingress and require approved hardened administrative pathways. | (2) Plan isolation or migration to a supported platform with documented interim risk controls.
Explanation
Correct Answer
C:For requirement (1), Server controls must respect platform differences while meeting common risk requirements. For requirement (2), Unsupported systems cannot be assumed protected by nonexistent vendor updates. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (2) is not met: Unsupported systems cannot be assumed protected by nonexistent vendor updates. The substituted action is instead for this different case: A container host has healthy runtime workloads but its underlying operating system security updates are months behind. The proposed bundle therefore cannot satisfy BOTH stated requirements.
B:Requirement (1) is not met: Server controls must respect platform differences while meeting common risk requirements. The substituted action is instead for this different case: Production servers allow local administrator access from standard employee workstations. Requirement (2) is not met: Unsupported systems cannot be assumed protected by nonexistent vendor updates. The substituted action is instead for this different case: A container host has healthy runtime workloads but its underlying operating system security updates are months behind. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: Server controls must respect platform differences while meeting common risk requirements. The substituted action is instead for this different case: Production servers allow local administrator access from standard employee workstations. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 455
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A branch firewall blocks Azure monitoring traffic after a network redesign, leaving a gap in security telemetry. (2) A cross-region incident requires inspecting east-west application connections but only internet ingress logs are retained. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Include monitoring endpoint reachability and firewall telemetry in network security acceptance tests. | (2) Design appropriate network flow telemetry for internal and cross-region sensitive paths.
- (1) Validate DNS and public endpoint disablement after the private connectivity migration. | (2) Design appropriate network flow telemetry for internal and cross-region sensitive paths.
- (1) Include monitoring endpoint reachability and firewall telemetry in network security acceptance tests. | (2) Inventory authorized application protocols and enforce narrow hybrid network access rules.
- (1) Validate DNS and public endpoint disablement after the private connectivity migration. | (2) Inventory authorized application protocols and enforce narrow hybrid network access rules.
Explanation
Correct Answer
A:For requirement (1), Security sensors need working transport paths to deliver threat evidence. For requirement (2), Lateral movement can occur without ever traversing the public perimeter. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
B:Requirement (1) is not met: Security sensors need working transport paths to deliver threat evidence. The substituted action is instead for this different case: A service is moved behind a private endpoint, yet its old public DNS name continues to resolve to an exposed address. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (2) is not met: Lateral movement can occur without ever traversing the public perimeter. The substituted action is instead for this different case: The network team permits all ports between Azure and an acquired private cloud because it does not know the required application flows. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: Security sensors need working transport paths to deliver threat evidence. The substituted action is instead for this different case: A service is moved behind a private endpoint, yet its old public DNS name continues to resolve to an exposed address. Requirement (2) is not met: Lateral movement can occur without ever traversing the public perimeter. The substituted action is instead for this different case: The network team permits all ports between Azure and an acquired private cloud because it does not know the required application flows. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 456
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A configuration team enables one generic security baseline for every device regardless of application compatibility. (2) Devices report compliant because a policy was assigned, yet the expected BitLocker protection is absent. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Detect configuration drift and reconcile operational changes against approved hardened baselines. | (2) Include product health, update freshness and telemetry availability in the endpoint assurance standard.
- (1) Pilot platform-specific baseline controls and document justified workload exceptions. | (2) Validate effective disk encryption state rather than relying on policy assignment alone.
- (1) Detect configuration drift and reconcile operational changes against approved hardened baselines. | (2) Validate effective disk encryption state rather than relying on policy assignment alone.
- (1) Pilot platform-specific baseline controls and document justified workload exceptions. | (2) Include product health, update freshness and telemetry availability in the endpoint assurance standard.
Explanation
Correct Answer
B:For requirement (1), A baseline must be validated against supported operating systems and critical services. For requirement (2), A deployed intention is not evidence of the required endpoint state. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (1) is not met: A baseline must be validated against supported operating systems and critical services. The substituted action is instead for this different case: A server build pipeline uses hardened templates but administrators repeatedly override settings after deployment. Requirement (2) is not met: A deployed intention is not evidence of the required endpoint state. The substituted action is instead for this different case: A compliance report shows that antivirus is installed but its signatures and cloud protection have not updated for weeks. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (1) is not met: A baseline must be validated against supported operating systems and critical services. The substituted action is instead for this different case: A server build pipeline uses hardened templates but administrators repeatedly override settings after deployment. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (2) is not met: A deployed intention is not evidence of the required endpoint state. The substituted action is instead for this different case: A compliance report shows that antivirus is installed but its signatures and cloud protection have not updated for weeks. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 457
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) An engineering group performs security review only after production incidents. (2) A production app relies on an unsupported open-source library but developers assume vendor support covers it. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Embed design review, testing and remediation in each phase of the application development lifecycle. | (2) Create a documented risk exception path with compensating controls and time-bounded remediation.
- (1) Require signed or attested release provenance linking build outputs to reviewed source revisions. | (2) Create a documented risk exception path with compensating controls and time-bounded remediation.
- (1) Embed design review, testing and remediation in each phase of the application development lifecycle. | (2) Establish software bill of materials and dependency update governance for third-party packages.
- (1) Require signed or attested release provenance linking build outputs to reviewed source revisions. | (2) Establish software bill of materials and dependency update governance for third-party packages.
Explanation
Correct Answer
C:For requirement (1), Shift-left controls catch weaknesses before deployment while preserving operational feedback. For requirement (2), Dependency provenance and maintenance are application-owner responsibilities. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (2) is not met: Dependency provenance and maintenance are application-owner responsibilities. The substituted action is instead for this different case: A team accepts security defects in a release without recording who approved the exception or when it expires. The proposed bundle therefore cannot satisfy BOTH stated requirements.
B:Requirement (1) is not met: Shift-left controls catch weaknesses before deployment while preserving operational feedback. The substituted action is instead for this different case: A release manager cannot associate a production binary with the approved source commit. Requirement (2) is not met: Dependency provenance and maintenance are application-owner responsibilities. The substituted action is instead for this different case: A team accepts security defects in a release without recording who approved the exception or when it expires. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: Shift-left controls catch weaknesses before deployment while preserving operational feedback. The substituted action is instead for this different case: A release manager cannot associate a production binary with the approved source commit. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 458
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) Ransomware responders cannot use recovery consoles because the tenant's normal administrator identities were disabled. (2) Production automation depends on one employee's Global Administrator credential and fails when that account is disabled. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Maintain protected emergency administrative access with monitored, rehearsed recovery procedures. | (2) Replace person-bound privileged automation with a governed workload identity and least-privilege permissions.
- (1) Separate destructive backup administration from ordinary restore permissions and enforce independent approvals. | (2) Replace person-bound privileged automation with a governed workload identity and least-privilege permissions.
- (1) Maintain protected emergency administrative access with monitored, rehearsed recovery procedures. | (2) Include directory recovery, privileged group validation and trusted identity checkpoints in the resilience plan.
- (1) Separate destructive backup administration from ordinary restore permissions and enforce independent approvals. | (2) Include directory recovery, privileged group validation and trusted identity checkpoints in the resilience plan.
Explanation
Correct Answer
A:For requirement (1), Resilient privileged access preserves a controlled recovery path when ordinary accounts or policies fail. For requirement (2), Nonhuman service continuity should not depend on an individual's account lifecycle or standing tenant-wide privilege. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
B:Requirement (1) is not met: Resilient privileged access preserves a controlled recovery path when ordinary accounts or policies fail. The substituted action is instead for this different case: A backup operator can both delete immutable backup protection settings and restore data without independent approval. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (2) is not met: Nonhuman service continuity should not depend on an individual's account lifecycle or standing tenant-wide privilege. The substituted action is instead for this different case: Domain controllers in every region replicate untested privileged group changes during a security incident. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: Resilient privileged access preserves a controlled recovery path when ordinary accounts or policies fail. The substituted action is instead for this different case: A backup operator can both delete immutable backup protection settings and restore data without independent approval. Requirement (2) is not met: Nonhuman service continuity should not depend on an individual's account lifecycle or standing tenant-wide privilege. The substituted action is instead for this different case: Domain controllers in every region replicate untested privileged group changes during a security incident. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 459
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A high-risk identity appears in Identity Protection and the help desk proposes dismissing it without investigation. (2) A user replaces a phone and cannot complete MFA, so support plans to disable all MFA enforcement. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Inventory unsupported client protocols and stage their replacement before enforcing passwordless access. | (2) Include session revocation and token investigation in identity compromise response.
- (1) Design risk-based verification, containment and credential recovery workflows for compromised accounts. | (2) Design a verified recovery and strong-method re-registration process for lost authenticators.
- (1) Inventory unsupported client protocols and stage their replacement before enforcing passwordless access. | (2) Design a verified recovery and strong-method re-registration process for lost authenticators.
- (1) Design risk-based verification, containment and credential recovery workflows for compromised accounts. | (2) Include session revocation and token investigation in identity compromise response.
Explanation
Correct Answer
B:For requirement (1), Risk signals need justified response rather than dashboard-only dismissal. For requirement (2), Recovery must not create a weaker bypass around the identity controls it restores. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (1) is not met: Risk signals need justified response rather than dashboard-only dismissal. The substituted action is instead for this different case: A directory team plans passwordless deployment without assessing which legacy applications support modern authentication. Requirement (2) is not met: Recovery must not create a weaker bypass around the identity controls it restores. The substituted action is instead for this different case: A compromised session remains active after password change and the owner believes password reset alone closes the incident. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (1) is not met: Risk signals need justified response rather than dashboard-only dismissal. The substituted action is instead for this different case: A directory team plans passwordless deployment without assessing which legacy applications support modern authentication. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (2) is not met: Recovery must not create a weaker bypass around the identity controls it restores. The substituted action is instead for this different case: A compromised session remains active after password change and the owner believes password reset alone closes the incident. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 460
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A corporation has hundreds of internal apps but no inventory of their hosting, owners or authentication methods. (2) An application assessment scores a public healthcare API and an internal demo app equally because both lack one HTTP header. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Validate the application-specific configuration and customer responsibility model separately from vendor assurances. | (2) Prioritize application posture findings by reachable attack paths and regulated data impact.
- (1) Build an application security inventory with criticality, exposure, ownership and identity dependencies. | (2) Assign application security ownership and a funded vulnerability management lifecycle.
- (1) Validate the application-specific configuration and customer responsibility model separately from vendor assurances. | (2) Assign application security ownership and a funded vulnerability management lifecycle.
- (1) Build an application security inventory with criticality, exposure, ownership and identity dependencies. | (2) Prioritize application posture findings by reachable attack paths and regulated data impact.
Explanation
Correct Answer
D:For requirement (1), Portfolio risk cannot be assessed without knowing the applications and their attack surfaces. For requirement (2), Contextual risk matters more than equal treatment of every checklist failure. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (1) is not met: Portfolio risk cannot be assessed without knowing the applications and their attack surfaces. The substituted action is instead for this different case: A software vendor claims SOC reports prove that every custom configuration of its application is secure. The proposed bundle therefore cannot satisfy BOTH stated requirements.
B:Requirement (2) is not met: Contextual risk matters more than equal treatment of every checklist failure. The substituted action is instead for this different case: A security board authorizes a new application but no one owns future dependency updates. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (1) is not met: Portfolio risk cannot be assessed without knowing the applications and their attack surfaces. The substituted action is instead for this different case: A software vendor claims SOC reports prove that every custom configuration of its application is secure. Requirement (2) is not met: Contextual risk matters more than equal treatment of every checklist failure. The substituted action is instead for this different case: A security board authorizes a new application but no one owns future dependency updates. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Microsoft Cybersecurity Architect (SC-100) Practice Tests