Question 460
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A corporation has hundreds of internal apps but no inventory of their hosting, owners or authentication methods. (2) An application assessment scores a public healthcare API and an internal demo app equally because both lack one HTTP header. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Validate the application-specific configuration and customer responsibility model separately from vendor assurances. | (2) Prioritize application posture findings by reachable attack paths and regulated data impact.
- (1) Build an application security inventory with criticality, exposure, ownership and identity dependencies. | (2) Assign application security ownership and a funded vulnerability management lifecycle.
- (1) Validate the application-specific configuration and customer responsibility model separately from vendor assurances. | (2) Assign application security ownership and a funded vulnerability management lifecycle.
- (1) Build an application security inventory with criticality, exposure, ownership and identity dependencies. | (2) Prioritize application posture findings by reachable attack paths and regulated data impact.
Explanation
Correct Answer
D:For requirement (1), Portfolio risk cannot be assessed without knowing the applications and their attack surfaces. For requirement (2), Contextual risk matters more than equal treatment of every checklist failure. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (1) is not met: Portfolio risk cannot be assessed without knowing the applications and their attack surfaces. The substituted action is instead for this different case: A software vendor claims SOC reports prove that every custom configuration of its application is secure. The proposed bundle therefore cannot satisfy BOTH stated requirements.
B:Requirement (2) is not met: Contextual risk matters more than equal treatment of every checklist failure. The substituted action is instead for this different case: A security board authorizes a new application but no one owns future dependency updates. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (1) is not met: Portfolio risk cannot be assessed without knowing the applications and their attack surfaces. The substituted action is instead for this different case: A software vendor claims SOC reports prove that every custom configuration of its application is secure. Requirement (2) is not met: Contextual risk matters more than equal treatment of every checklist failure. The substituted action is instead for this different case: A security board authorizes a new application but no one owns future dependency updates. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 461
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A workload team assumes a SaaS provider automatically controls which internal employees can export confidential files. (2) An Azure VM owner assumes Microsoft patches every custom application installed inside the guest. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Require application identity, authorization and secret controls for PaaS workloads. | (2) Create service-model-specific control profiles anchored in shared enterprise security requirements.
- (1) Define customer-owned SaaS identity, sharing and data-protection configuration requirements. | (2) Allocate customer responsibility for guest OS and application security under the IaaS service model.
- (1) Require application identity, authorization and secret controls for PaaS workloads. | (2) Allocate customer responsibility for guest OS and application security under the IaaS service model.
- (1) Define customer-owned SaaS identity, sharing and data-protection configuration requirements. | (2) Create service-model-specific control profiles anchored in shared enterprise security requirements.
Explanation
Correct Answer
B:For requirement (1), SaaS providers operate the service but customer access settings remain a shared-responsibility concern. For requirement (2), IaaS customers remain responsible for many workload and software controls. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (1) is not met: SaaS providers operate the service but customer access settings remain a shared-responsibility concern. The substituted action is instead for this different case: A PaaS application team disables authentication because the underlying service platform already uses encryption. Requirement (2) is not met: IaaS customers remain responsible for many workload and software controls. The substituted action is instead for this different case: The same baseline is applied without adaptation to Kubernetes nodes, managed SQL and Microsoft 365. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (1) is not met: SaaS providers operate the service but customer access settings remain a shared-responsibility concern. The substituted action is instead for this different case: A PaaS application team disables authentication because the underlying service platform already uses encryption. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (2) is not met: IaaS customers remain responsible for many workload and software controls. The substituted action is instead for this different case: The same baseline is applied without adaptation to Kubernetes nodes, managed SQL and Microsoft 365. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 462
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A SaaS supplier will process regulated customer data but the security team has not assessed its subcontractors. (2) A database export crosses a legal jurisdiction without a documented business purpose or residency assessment. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Approve time-limited narrowly scoped vendor access with monitored sessions and expiry. | (2) Evaluate cross-border data movement restrictions and design approved transfer controls before exporting.
- (1) Conduct third-party data-processing due diligence and define contractual security obligations. | (2) Include credential revocation and third-party access closure in the data decommissioning plan.
- (1) Approve time-limited narrowly scoped vendor access with monitored sessions and expiry. | (2) Include credential revocation and third-party access closure in the data decommissioning plan.
- (1) Conduct third-party data-processing due diligence and define contractual security obligations. | (2) Evaluate cross-border data movement restrictions and design approved transfer controls before exporting.
Explanation
Correct Answer
D:For requirement (1), Supply-chain privacy duties extend beyond the immediate service provider. For requirement (2), Data transfers may trigger obligations that network encryption alone cannot satisfy. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (1) is not met: Supply-chain privacy duties extend beyond the immediate service provider. The substituted action is instead for this different case: A vendor requests unrestricted production database access to provide temporary support. The proposed bundle therefore cannot satisfy BOTH stated requirements.
B:Requirement (2) is not met: Data transfers may trigger obligations that network encryption alone cannot satisfy. The substituted action is instead for this different case: A project retires a cloud application but leaves external vendors with active keys to its archived data. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (1) is not met: Supply-chain privacy duties extend beyond the immediate service provider. The substituted action is instead for this different case: A vendor requests unrestricted production database access to provide temporary support. Requirement (2) is not met: Data transfers may trigger obligations that network encryption alone cannot satisfy. The substituted action is instead for this different case: A project retires a cloud application but leaves external vendors with active keys to its archived data. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 463
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A generative AI application can read unrelated customer records through its retrieval index. (2) A model deployment accepts unfiltered user prompts that may cause the assistant to reveal privileged system instructions. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Establish AI data-handling requirements for storage, processing locations and vendor agreements before approval. | (2) Enforce model endpoint authentication, authorization and logging independently of content safety controls.
- (1) Restrict retrieval to user-authorized content and enforce data-plane access controls in the AI pipeline. | (2) Include prompt-injection threat modeling and policy-enforced tool and data boundaries around the model.
- (1) Establish AI data-handling requirements for storage, processing locations and vendor agreements before approval. | (2) Include prompt-injection threat modeling and policy-enforced tool and data boundaries around the model.
- (1) Restrict retrieval to user-authorized content and enforce data-plane access controls in the AI pipeline. | (2) Enforce model endpoint authentication, authorization and logging independently of content safety controls.
Explanation
Correct Answer
B:For requirement (1), Retrieval-augmented generation must not bypass original source authorization. For requirement (2), Untrusted prompts must not be treated as authority to use privileged tools or disclose protected context. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (1) is not met: Retrieval-augmented generation must not bypass original source authorization. The substituted action is instead for this different case: A chatbot sends sensitive prompts to a third-party service without documenting retention or residency terms. Requirement (2) is not met: Untrusted prompts must not be treated as authority to use privileged tools or disclose protected context. The substituted action is instead for this different case: An AI team enables broad model endpoint access because it assumes safety filters also restrict callers. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (1) is not met: Retrieval-augmented generation must not bypass original source authorization. The substituted action is instead for this different case: A chatbot sends sensitive prompts to a third-party service without documenting retention or residency terms. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (2) is not met: Untrusted prompts must not be treated as authority to use privileged tools or disclose protected context. The substituted action is instead for this different case: An AI team enables broad model endpoint access because it assumes safety filters also restrict callers. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 464
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A vulnerable workstation links to a privileged service account, but teams prioritize only by its standalone CVSS number. (2) The exposure team treats every modeled attack path as evidence that an adversary has already traversed it. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Use Security Exposure Management attack paths and asset criticality to prioritize the chained risk. | (2) Coordinate remediation priorities across endpoint and identity owners using attack-path analysis.
- (1) Design a measurable exposure-management initiative review with consistent scope and trend baselines. | (2) Coordinate remediation priorities across endpoint and identity owners using attack-path analysis.
- (1) Use Security Exposure Management attack paths and asset criticality to prioritize the chained risk. | (2) Distinguish modeled exposure relationships from confirmed compromise telemetry and incident evidence.
- (1) Design a measurable exposure-management initiative review with consistent scope and trend baselines. | (2) Distinguish modeled exposure relationships from confirmed compromise telemetry and incident evidence.
Explanation
Correct Answer
C:For requirement (1), Reachability to privileged resources can matter more than a single isolated severity label. For requirement (2), Risk graph edges show possible paths, not proof of actual execution. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (2) is not met: Risk graph edges show possible paths, not proof of actual execution. The substituted action is instead for this different case: Two teams independently patch the same low-impact issue while a high-risk identity-to-server path remains open. The proposed bundle therefore cannot satisfy BOTH stated requirements.
B:Requirement (1) is not met: Reachability to privileged resources can matter more than a single isolated severity label. The substituted action is instead for this different case: A security program wants to track whether strategic exposure-reduction initiatives improve over several months. Requirement (2) is not met: Risk graph edges show possible paths, not proof of actual execution. The substituted action is instead for this different case: Two teams independently patch the same low-impact issue while a high-risk identity-to-server path remains open. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: Reachability to privileged resources can matter more than a single isolated severity label. The substituted action is instead for this different case: A security program wants to track whether strategic exposure-reduction initiatives improve over several months. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 465
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A security engineer needs elevated directory permissions for one maintenance window but currently holds them permanently. (2) A privileged role activation proceeds without approval even though high-impact changes require a second person. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Use Entra Privileged Identity Management eligible assignments with time-bounded activation. | (2) Configure approval and justification in the applicable PIM activation policy.
- (1) Review PIM eligibility periodically and revoke assignments without current business sponsorship. | (2) Configure approval and justification in the applicable PIM activation policy.
- (1) Use Entra Privileged Identity Management eligible assignments with time-bounded activation. | (2) Use PIM activation and directory audit history to reconstruct the elevation timeline.
- (1) Review PIM eligibility periodically and revoke assignments without current business sponsorship. | (2) Use PIM activation and directory audit history to reconstruct the elevation timeline.
Explanation
Correct Answer
A:For requirement (1), Just-in-time privilege limits the duration of sensitive access while retaining a verifiable activation record. For requirement (2), Privilege elevation can be gated on accountable independent authorization. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
B:Requirement (1) is not met: Just-in-time privilege limits the duration of sensitive access while retaining a verifiable activation record. The substituted action is instead for this different case: A former contractor remains eligible for Global Administrator role activation months after their project ends. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (2) is not met: Privilege elevation can be gated on accountable independent authorization. The substituted action is instead for this different case: The SOC cannot identify who activated a privileged role just before suspicious tenant configuration changes. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: Just-in-time privilege limits the duration of sensitive access while retaining a verifiable activation record. The substituted action is instead for this different case: A former contractor remains eligible for Global Administrator role activation months after their project ends. Requirement (2) is not met: Privilege elevation can be gated on accountable independent authorization. The substituted action is instead for this different case: The SOC cannot identify who activated a privileged role just before suspicious tenant configuration changes. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 466
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A retrieval AI assistant indexes confidential board documents for all employees without honoring SharePoint permissions. (2) A prompt contains untrusted instructions telling a tool-using model to disclose the full hidden customer dataset. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Apply data minimization, restricted processing locations and controlled storage to training datasets. | (2) Design prompt-injection defenses with explicit tool permission and output-data boundaries.
- (1) Enforce user-context data authorization before returning retrieved passages to the model. | (2) Limit AI prompt telemetry, mask sensitive fields and enforce approved retention and audit permissions.
- (1) Apply data minimization, restricted processing locations and controlled storage to training datasets. | (2) Limit AI prompt telemetry, mask sensitive fields and enforce approved retention and audit permissions.
- (1) Enforce user-context data authorization before returning retrieved passages to the model. | (2) Design prompt-injection defenses with explicit tool permission and output-data boundaries.
Explanation
Correct Answer
D:For requirement (1), AI retrieval must not elevate the caller's rights to indexed content. For requirement (2), Model instruction filters cannot replace independent enforcement on protected data tools. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (1) is not met: AI retrieval must not elevate the caller's rights to indexed content. The substituted action is instead for this different case: A model training job copies regulated customer records into a globally shared temporary storage account. The proposed bundle therefore cannot satisfy BOTH stated requirements.
B:Requirement (2) is not met: Model instruction filters cannot replace independent enforcement on protected data tools. The substituted action is instead for this different case: A generative AI team logs raw confidential prompts for debugging but cannot define who is permitted to access them. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (1) is not met: AI retrieval must not elevate the caller's rights to indexed content. The substituted action is instead for this different case: A model training job copies regulated customer records into a globally shared temporary storage account. Requirement (2) is not met: Model instruction filters cannot replace independent enforcement on protected data tools. The substituted action is instead for this different case: A generative AI team logs raw confidential prompts for debugging but cannot define who is permitted to access them. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 467
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) The security team knows internal IP addresses but not the public domains and hosts registered by acquired subsidiaries. (2) An exposure report shows an unknown domain and administrators assume the organization owns it. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Use Defender External Attack Surface Management discovery to inventory internet-visible assets. | (2) Reconcile EASM findings with decommissioning and verify public DNS and hosting retirement.
- (1) Link discovered internet-facing assets to application owners and prioritize exposed authentication surfaces. | (2) Reconcile EASM findings with decommissioning and verify public DNS and hosting retirement.
- (1) Use Defender External Attack Surface Management discovery to inventory internet-visible assets. | (2) Validate attribution and ownership before treating discovered infrastructure as an enterprise asset.
- (1) Link discovered internet-facing assets to application owners and prioritize exposed authentication surfaces. | (2) Validate attribution and ownership before treating discovered infrastructure as an enterprise asset.
Explanation
Correct Answer
C:For requirement (1), External discovery reveals assets beyond known internal CMDB entries. For requirement (2), Discovery signals require evidence before responsibility or remediation is assigned. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (2) is not met: Discovery signals require evidence before responsibility or remediation is assigned. The substituted action is instead for this different case: A business removes a legacy service but external scanners still find the previous endpoint. The proposed bundle therefore cannot satisfy BOTH stated requirements.
B:Requirement (1) is not met: External discovery reveals assets beyond known internal CMDB entries. The substituted action is instead for this different case: An externally accessible test API contains a stale authentication endpoint, but no business owner is listed. Requirement (2) is not met: Discovery signals require evidence before responsibility or remediation is assigned. The substituted action is instead for this different case: A business removes a legacy service but external scanners still find the previous endpoint. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: External discovery reveals assets beyond known internal CMDB entries. The substituted action is instead for this different case: An externally accessible test API contains a stale authentication endpoint, but no business owner is listed. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 468
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) On-premises Linux servers are excluded from Azure inventory and policy compliance checks. (2) An Arc deployment script embeds a long-lived tenant secret with unrestricted resource creation rights. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Connect eligible non-Azure machines using Azure Arc-enabled servers and approved onboarding methods. | (2) Use a controlled onboarding identity and rotate bootstrap credentials with least-privilege permissions.
- (1) Validate desired extension deployment and policy compliance across Arc-enabled resource groups. | (2) Use a controlled onboarding identity and rotate bootstrap credentials with least-privilege permissions.
- (1) Connect eligible non-Azure machines using Azure Arc-enabled servers and approved onboarding methods. | (2) Confirm feature support and shared operational responsibilities for Arc-enabled non-Azure servers.
- (1) Validate desired extension deployment and policy compliance across Arc-enabled resource groups. | (2) Confirm feature support and shared operational responsibilities for Arc-enabled non-Azure servers.
Explanation
Correct Answer
A:For requirement (1), Azure Arc can expose supported external machines to Azure governance and security integrations. For requirement (2), Hybrid management agents must not create an uncontrolled credential exposure path. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
B:Requirement (1) is not met: Azure Arc can expose supported external machines to Azure governance and security integrations. The substituted action is instead for this different case: A Linux estate appears Arc-connected but security extensions are missing on half the servers. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (2) is not met: Hybrid management agents must not create an uncontrolled credential exposure path. The substituted action is instead for this different case: An application team assumes Arc-enabled machines automatically become full Azure virtual machines for every control. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: Azure Arc can expose supported external machines to Azure governance and security integrations. The substituted action is instead for this different case: A Linux estate appears Arc-connected but security extensions are missing on half the servers. Requirement (2) is not met: Hybrid management agents must not create an uncontrolled credential exposure path. The substituted action is instead for this different case: An application team assumes Arc-enabled machines automatically become full Azure virtual machines for every control. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 469
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) An enterprise compares two security tool purchases without first defining which identity, network and data threats must be covered. (2) A program proposes one global firewall as a substitute for application, identity and data security controls. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Assign control owners, measurable assurance evidence and escalation paths for each architecture capability. | (2) Design defense in depth with distinct controls across identities, devices, applications, network and data.
- (1) Map security requirements to Microsoft Cybersecurity Reference Architectures capabilities before selecting products. | (2) Extend trust-boundary diagrams to cover both organizations and their cross-tenant connections.
- (1) Assign control owners, measurable assurance evidence and escalation paths for each architecture capability. | (2) Extend trust-boundary diagrams to cover both organizations and their cross-tenant connections.
- (1) Map security requirements to Microsoft Cybersecurity Reference Architectures capabilities before selecting products. | (2) Design defense in depth with distinct controls across identities, devices, applications, network and data.
Explanation
Correct Answer
D:For requirement (1), Capability mapping exposes gaps and dependencies independently of product branding. For requirement (2), No single perimeter control replaces workload-specific authorization and protection. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (1) is not met: Capability mapping exposes gaps and dependencies independently of product branding. The substituted action is instead for this different case: A regional team wants to deploy controls without identifying the owner responsible for operating them. The proposed bundle therefore cannot satisfy BOTH stated requirements.
B:Requirement (2) is not met: No single perimeter control replaces workload-specific authorization and protection. The substituted action is instead for this different case: A merger introduces a new cloud estate but the reference architecture has not mapped its administrative trust boundaries. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (1) is not met: Capability mapping exposes gaps and dependencies independently of product branding. The substituted action is instead for this different case: A regional team wants to deploy controls without identifying the owner responsible for operating them. Requirement (2) is not met: No single perimeter control replaces workload-specific authorization and protection. The substituted action is instead for this different case: A merger introduces a new cloud estate but the reference architecture has not mapped its administrative trust boundaries. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 470
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) Developers deploy container images directly from an unverified personal registry into production. (2) A pod runs as a privileged root container with host filesystem mounts for routine application logging. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Require trusted registry sources, image vulnerability checks and provenance verification. | (2) Add supported container runtime detection and managed-cluster threat protection.
- (1) Include image and dependency scanning for the exact release artifact. | (2) Add supported container runtime detection and managed-cluster threat protection.
- (1) Require trusted registry sources, image vulnerability checks and provenance verification. | (2) Apply least-privilege container runtime settings and eliminate unnecessary host access.
- (1) Include image and dependency scanning for the exact release artifact. | (2) Apply least-privilege container runtime settings and eliminate unnecessary host access.
Explanation
Correct Answer
C:For requirement (1), Secure container supply chains need confidence in artifact origin and content. For requirement (2), Privileged containers expand the impact of an application compromise to the host. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (2) is not met: Privileged containers expand the impact of an application compromise to the host. The substituted action is instead for this different case: Runtime detections are missing for workloads in a managed Kubernetes cluster despite completed image scanning. The proposed bundle therefore cannot satisfy BOTH stated requirements.
B:Requirement (1) is not met: Secure container supply chains need confidence in artifact origin and content. The substituted action is instead for this different case: A team scans source code but never examines third-party packages shipped in the final container image. Requirement (2) is not met: Privileged containers expand the impact of an application compromise to the host. The substituted action is instead for this different case: Runtime detections are missing for workloads in a managed Kubernetes cluster despite completed image scanning. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: Secure container supply chains need confidence in artifact origin and content. The substituted action is instead for this different case: A team scans source code but never examines third-party packages shipped in the final container image. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Microsoft Cybersecurity Architect (SC-100) Practice Tests