Question 470
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) Developers deploy container images directly from an unverified personal registry into production. (2) A pod runs as a privileged root container with host filesystem mounts for routine application logging. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Require trusted registry sources, image vulnerability checks and provenance verification. | (2) Add supported container runtime detection and managed-cluster threat protection.
- (1) Include image and dependency scanning for the exact release artifact. | (2) Add supported container runtime detection and managed-cluster threat protection.
- (1) Require trusted registry sources, image vulnerability checks and provenance verification. | (2) Apply least-privilege container runtime settings and eliminate unnecessary host access.
- (1) Include image and dependency scanning for the exact release artifact. | (2) Apply least-privilege container runtime settings and eliminate unnecessary host access.
Explanation
Correct Answer
C:For requirement (1), Secure container supply chains need confidence in artifact origin and content. For requirement (2), Privileged containers expand the impact of an application compromise to the host. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (2) is not met: Privileged containers expand the impact of an application compromise to the host. The substituted action is instead for this different case: Runtime detections are missing for workloads in a managed Kubernetes cluster despite completed image scanning. The proposed bundle therefore cannot satisfy BOTH stated requirements.
B:Requirement (1) is not met: Secure container supply chains need confidence in artifact origin and content. The substituted action is instead for this different case: A team scans source code but never examines third-party packages shipped in the final container image. Requirement (2) is not met: Privileged containers expand the impact of an application compromise to the host. The substituted action is instead for this different case: Runtime detections are missing for workloads in a managed Kubernetes cluster despite completed image scanning. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: Secure container supply chains need confidence in artifact origin and content. The substituted action is instead for this different case: A team scans source code but never examines third-party packages shipped in the final container image. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 471
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) Administrators make portal edits in production that drift from approved landing-zone templates. (2) A team moves a policy assignment into enforcement without testing its effect on existing resources. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Manage shared security templates through branch review and controlled pipeline promotion. | (2) Evaluate policy compliance and use a phased enforcement rollout with appropriate exemptions.
- (1) Apply reviewed infrastructure-as-code changes and detect configuration drift against the declared baseline. | (2) Issue a time-bounded exception with justification, compensating safeguards and expiration review.
- (1) Manage shared security templates through branch review and controlled pipeline promotion. | (2) Issue a time-bounded exception with justification, compensating safeguards and expiration review.
- (1) Apply reviewed infrastructure-as-code changes and detect configuration drift against the declared baseline. | (2) Evaluate policy compliance and use a phased enforcement rollout with appropriate exemptions.
Explanation
Correct Answer
D:For requirement (1), Reproducible templates make changes auditable and reduce hidden production variance. For requirement (2), Preventive policy can disrupt existing operations if not assessed first. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (1) is not met: Reproducible templates make changes auditable and reduce hidden production variance. The substituted action is instead for this different case: Two teams edit shared network security definitions concurrently without versioned approval. The proposed bundle therefore cannot satisfy BOTH stated requirements.
B:Requirement (2) is not met: Preventive policy can disrupt existing operations if not assessed first. The substituted action is instead for this different case: A workload owner requests a permanent exemption from encryption requirements for a short migration. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (1) is not met: Reproducible templates make changes auditable and reduce hidden production variance. The substituted action is instead for this different case: Two teams edit shared network security definitions concurrently without versioned approval. Requirement (2) is not met: Preventive policy can disrupt existing operations if not assessed first. The substituted action is instead for this different case: A workload owner requests a permanent exemption from encryption requirements for a short migration. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 472
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) Security standards require all new storage accounts to disable anonymous public blob access. (2) Existing resources violate a required diagnostic-settings policy, but the team assumes a policy assignment changes them retroactively. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Require scoped Azure Policy exemptions with recorded rationale, owner and end date. | (2) Define remediation tasks and managed identities for supported deployIfNotExists policy effects.
- (1) Use a scoped Azure Policy deny or equivalent enforcement effect for prohibited public storage configuration. | (2) Review initiative compliance at policy and resource levels and collect supporting configuration evidence.
- (1) Require scoped Azure Policy exemptions with recorded rationale, owner and end date. | (2) Review initiative compliance at policy and resource levels and collect supporting configuration evidence.
- (1) Use a scoped Azure Policy deny or equivalent enforcement effect for prohibited public storage configuration. | (2) Define remediation tasks and managed identities for supported deployIfNotExists policy effects.
Explanation
Correct Answer
D:For requirement (1), Preventive guardrails stop noncompliant resources before they become exposed. For requirement (2), Assessment and remediation are different actions for already-deployed resources. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (1) is not met: Preventive guardrails stop noncompliant resources before they become exposed. The substituted action is instead for this different case: A production subscription receives a temporary security-policy exemption without business justification or expiry. The proposed bundle therefore cannot satisfy BOTH stated requirements.
B:Requirement (2) is not met: Assessment and remediation are different actions for already-deployed resources. The substituted action is instead for this different case: A compliance team uses an initiative for common controls but cannot identify which resource failed each policy. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (1) is not met: Preventive guardrails stop noncompliant resources before they become exposed. The substituted action is instead for this different case: A production subscription receives a temporary security-policy exemption without business justification or expiry. Requirement (2) is not met: Assessment and remediation are different actions for already-deployed resources. The substituted action is instead for this different case: A compliance team uses an initiative for common controls but cannot identify which resource failed each policy. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 473
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A security architect turns on Defender for Cloud posture recommendations for storage but expects runtime alerts on malicious blob access automatically. (2) A SQL team reviews vulnerability recommendations but has no way to investigate suspicious database queries. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Correlate Defender storage detections with resource identity, workload owner and activity logs. | (2) Select Defender data workload plans based on actual protected services, licensing and risk.
- (1) Evaluate Microsoft Defender for Storage protection and supported threat detections for the account. | (2) Design Defender for Databases threat detection and database audit correlation.
- (1) Correlate Defender storage detections with resource identity, workload owner and activity logs. | (2) Design Defender for Databases threat detection and database audit correlation.
- (1) Evaluate Microsoft Defender for Storage protection and supported threat detections for the account. | (2) Select Defender data workload plans based on actual protected services, licensing and risk.
Explanation
Correct Answer
B:For requirement (1), Storage-specific threat protection is distinct from configuration assessment. For requirement (2), Data-plane attacks require investigation signals beyond posture findings. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (1) is not met: Storage-specific threat protection is distinct from configuration assessment. The substituted action is instead for this different case: A storage threat alert identifies a suspicious upload but the SOC cannot map it to a specific application owner. Requirement (2) is not met: Data-plane attacks require investigation signals beyond posture findings. The substituted action is instead for this different case: An architect enables all data threat protection plans without assessing resource coverage and ongoing ingestion cost. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (1) is not met: Storage-specific threat protection is distinct from configuration assessment. The substituted action is instead for this different case: A storage threat alert identifies a suspicious upload but the SOC cannot map it to a specific application owner. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (2) is not met: Data-plane attacks require investigation signals beyond posture findings. The substituted action is instead for this different case: An architect enables all data threat protection plans without assessing resource coverage and ongoing ingestion cost. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 474
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A Sentinel analytic rule produces hundreds of identical alerts, and analysts manually open tickets for each. (2) An automation deletes suspicious users immediately based only on a low-confidence anomaly signal. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Design a Logic Apps playbook triggered by validated Sentinel automation rules. | (2) Record playbook run IDs, incident links and action outcomes in the response evidence.
- (1) Design action-center review and approval responsibilities into the response workflow. | (2) Record playbook run IDs, incident links and action outcomes in the response evidence.
- (1) Design a Logic Apps playbook triggered by validated Sentinel automation rules. | (2) Insert evidence checks, human approval and reversible containment before destructive SOAR actions.
- (1) Design action-center review and approval responsibilities into the response workflow. | (2) Insert evidence checks, human approval and reversible containment before destructive SOAR actions.
Explanation
Correct Answer
C:For requirement (1), SOAR automates repeatable steps while preserving scoped triggering and response authority. For requirement (2), Security automation must reflect confidence and potential business disruption. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (2) is not met: Security automation must reflect confidence and potential business disruption. The substituted action is instead for this different case: A SOC cannot explain which playbook isolated a device after several overlapping detections. The proposed bundle therefore cannot satisfy BOTH stated requirements.
B:Requirement (1) is not met: SOAR automates repeatable steps while preserving scoped triggering and response authority. The substituted action is instead for this different case: A Defender XDR automated investigation recommends an action that requires approval, but leadership assumes it already executed. Requirement (2) is not met: Security automation must reflect confidence and potential business disruption. The substituted action is instead for this different case: A SOC cannot explain which playbook isolated a device after several overlapping detections. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: SOAR automates repeatable steps while preserving scoped triggering and response authority. The substituted action is instead for this different case: A Defender XDR automated investigation recommends an action that requires approval, but leadership assumes it already executed. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 475
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A public API accepts traffic directly on its application origin even though the architecture diagram shows an edge firewall. (2) An online store is targeted by repetitive automated login attempts, and the team only considers storage encryption. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Separate web, application and data tiers using controlled network segmentation. | (2) Enforce authenticated encryption on internal service-to-database traffic where supported.
- (1) Restrict origin access to trusted reverse proxies and protect the approved ingress path. | (2) Design bot, rate-limit and identity-abuse defenses in the application ingress architecture.
- (1) Separate web, application and data tiers using controlled network segmentation. | (2) Design bot, rate-limit and identity-abuse defenses in the application ingress architecture.
- (1) Restrict origin access to trusted reverse proxies and protect the approved ingress path. | (2) Enforce authenticated encryption on internal service-to-database traffic where supported.
Explanation
Correct Answer
B:For requirement (1), A bypassable edge control cannot filter traffic that reaches the origin directly. For requirement (2), Credential stuffing is an application authentication threat rather than a data-at-rest issue. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (1) is not met: A bypassable edge control cannot filter traffic that reaches the origin directly. The substituted action is instead for this different case: A multi-tier web app places its database and front end in the same unrestricted subnet. Requirement (2) is not met: Credential stuffing is an application authentication threat rather than a data-at-rest issue. The substituted action is instead for this different case: A web workload has public TLS but uses plaintext connections between its internal service and database. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (1) is not met: A bypassable edge control cannot filter traffic that reaches the origin directly. The substituted action is instead for this different case: A multi-tier web app places its database and front end in the same unrestricted subnet. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (2) is not met: Credential stuffing is an application authentication threat rather than a data-at-rest issue. The substituted action is instead for this different case: A web workload has public TLS but uses plaintext connections between its internal service and database. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 476
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A company wants to deploy an AI assistant to answer HR questions but has not inventoried the sensitive data sources. (2) The AI governance board approves a model but no one owns evaluations for harmful outputs or data leakage. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Define permitted training and fine-tuning data categories and privacy protections. | (2) Assign model risk ownership with preproduction safety, privacy and adversarial evaluation gates.
- (1) Perform AI data classification and access-path discovery before selecting the model architecture. | (2) Design scoped agent identities, approval gates and audited tool authorization.
- (1) Define permitted training and fine-tuning data categories and privacy protections. | (2) Design scoped agent identities, approval gates and audited tool authorization.
- (1) Perform AI data classification and access-path discovery before selecting the model architecture. | (2) Assign model risk ownership with preproduction safety, privacy and adversarial evaluation gates.
Explanation
Correct Answer
D:For requirement (1), Secure AI design starts with knowing which data the assistant may retrieve and expose. For requirement (2), Model approval needs measurable evidence and accountable remediation of observed safety failures. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (1) is not met: Secure AI design starts with knowing which data the assistant may retrieve and expose. The substituted action is instead for this different case: A team sends every internal document to model tuning without confirming consent or data minimization rules. The proposed bundle therefore cannot satisfy BOTH stated requirements.
B:Requirement (2) is not met: Model approval needs measurable evidence and accountable remediation of observed safety failures. The substituted action is instead for this different case: An autonomous AI agent can call production administration tools with the operator's full credentials. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (1) is not met: Secure AI design starts with knowing which data the assistant may retrieve and expose. The substituted action is instead for this different case: A team sends every internal document to model tuning without confirming consent or data minimization rules. Requirement (2) is not met: Model approval needs measurable evidence and accountable remediation of observed safety failures. The substituted action is instead for this different case: An autonomous AI agent can call production administration tools with the operator's full credentials. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 477
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A critical incident is assigned to several teams without a named incident commander or escalation owner. (2) A phishing case is closed as resolved after mailbox cleanup although attacker-issued OAuth grants remain active. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Require confirmation of containment state and follow-up monitoring in incident playbooks. | (2) Add post-incident root-cause analysis and detection engineering follow-up to incident governance.
- (1) Establish incident severity criteria, ownership and cross-team escalation procedures. | (2) Require persistence, identity and token remediation checks before incident closure.
- (1) Require confirmation of containment state and follow-up monitoring in incident playbooks. | (2) Require persistence, identity and token remediation checks before incident closure.
- (1) Establish incident severity criteria, ownership and cross-team escalation procedures. | (2) Add post-incident root-cause analysis and detection engineering follow-up to incident governance.
Explanation
Correct Answer
B:For requirement (1), A defined response lifecycle prevents conflicting containment and missed handoffs. For requirement (2), Removing an initial artifact does not establish that access mechanisms have been removed. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (1) is not met: A defined response lifecycle prevents conflicting containment and missed handoffs. The substituted action is instead for this different case: Analysts isolate a server but no one validates whether that response action actually completed. Requirement (2) is not met: Removing an initial artifact does not establish that access mechanisms have been removed. The substituted action is instead for this different case: After a breach, investigators have no process to incorporate lessons into detection coverage. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (1) is not met: A defined response lifecycle prevents conflicting containment and missed handoffs. The substituted action is instead for this different case: Analysts isolate a server but no one validates whether that response action actually completed. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (2) is not met: Removing an initial artifact does not establish that access mechanisms have been removed. The substituted action is instead for this different case: After a breach, investigators have no process to incorporate lessons into detection coverage. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 478
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) An Azure AI service endpoint allows public anonymous queries because its output includes safety moderation. (2) An AI model accesses a document index containing unrelated departments' confidential files. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Require supported authentication and network restrictions for Azure AI service endpoints. | (2) Design user-aware retrieval security and filtered document access in the AI workload.
- (1) Treat model input and retrieved text as untrusted, and gate privileged tool execution with policy. | (2) Design user-aware retrieval security and filtered document access in the AI workload.
- (1) Require supported authentication and network restrictions for Azure AI service endpoints. | (2) Apply data minimization, log access restrictions and approved retention for AI prompts and outputs.
- (1) Treat model input and retrieved text as untrusted, and gate privileged tool execution with policy. | (2) Apply data minimization, log access restrictions and approved retention for AI prompts and outputs.
Explanation
Correct Answer
A:For requirement (1), Content moderation does not authorize callers or prevent resource abuse. For requirement (2), AI applications must respect original data entitlements during retrieval. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
B:Requirement (1) is not met: Content moderation does not authorize callers or prevent resource abuse. The substituted action is instead for this different case: A prompt-injection attack asks an AI assistant to run a privileged management API call. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (2) is not met: AI applications must respect original data entitlements during retrieval. The substituted action is instead for this different case: An AI service sends model prompts into logs containing personal identifiers with indefinite retention. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: Content moderation does not authorize callers or prevent resource abuse. The substituted action is instead for this different case: A prompt-injection attack asks an AI assistant to run a privileged management API call. Requirement (2) is not met: AI applications must respect original data entitlements during retrieval. The substituted action is instead for this different case: An AI service sends model prompts into logs containing personal identifiers with indefinite retention. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 479
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A retailer cannot decide which workloads to restore first because all servers have equal priority labels. (2) A hospital has recovery objectives but has never quantified the maximum permissible data loss for patient scheduling. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Build a dependency map and test recovery of the identity, network and data services required by order processing. | (2) Define a documented recovery point objective for the scheduling data and validate it against clinical risk.
- (1) Perform a business impact analysis and map revenue-critical services to accountable owners and dependencies. | (2) Rank cybersecurity recovery priorities using safety, outage impact and critical business processes rather than asset price alone.
- (1) Build a dependency map and test recovery of the identity, network and data services required by order processing. | (2) Rank cybersecurity recovery priorities using safety, outage impact and critical business processes rather than asset price alone.
- (1) Perform a business impact analysis and map revenue-critical services to accountable owners and dependencies. | (2) Define a documented recovery point objective for the scheduling data and validate it against clinical risk.
Explanation
Correct Answer
D:For requirement (1), Business impact analysis distinguishes business-critical recovery order from an undifferentiated inventory of machines. For requirement (2), RPO specifies acceptable data loss and drives backup and replication design rather than merely restoration time. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (1) is not met: Business impact analysis distinguishes business-critical recovery order from an undifferentiated inventory of machines. The substituted action is instead for this different case: A distribution firm promises one-hour recovery without identifying the network and identity systems its order platform needs. The proposed bundle therefore cannot satisfy BOTH stated requirements.
B:Requirement (2) is not met: RPO specifies acceptable data loss and drives backup and replication design rather than merely restoration time. The substituted action is instead for this different case: Executives prioritize systems only by purchase cost, ignoring the operational harm of a manufacturing shutdown. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (1) is not met: Business impact analysis distinguishes business-critical recovery order from an undifferentiated inventory of machines. The substituted action is instead for this different case: A distribution firm promises one-hour recovery without identifying the network and identity systems its order platform needs. Requirement (2) is not met: RPO specifies acceptable data loss and drives backup and replication design rather than merely restoration time. The substituted action is instead for this different case: Executives prioritize systems only by purchase cost, ignoring the operational harm of a manufacturing shutdown. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 480
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A collaboration tenant has several risky sharing settings but leadership only tracks purchased security licenses. (2) A Secure Score rises after a control receives an exception status although the underlying user access configuration is unchanged. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Normalize posture assessment for licensed controls, coverage and business-critical workloads. | (2) Rank Microsoft 365 hardening measures by exposure, business dependencies and tested rollout impact.
- (1) Evaluate Microsoft Secure Score recommendations and effective protection for Microsoft 365 workloads. | (2) Distinguish Secure Score acceptance states from verified technical control enforcement.
- (1) Normalize posture assessment for licensed controls, coverage and business-critical workloads. | (2) Distinguish Secure Score acceptance states from verified technical control enforcement.
- (1) Evaluate Microsoft Secure Score recommendations and effective protection for Microsoft 365 workloads. | (2) Rank Microsoft 365 hardening measures by exposure, business dependencies and tested rollout impact.
Explanation
Correct Answer
B:For requirement (1), Security product licensing does not establish that recommended controls are enabled. For requirement (2), Assessment scores may not prove an unsafe configuration has been repaired. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (1) is not met: Security product licensing does not establish that recommended controls are enabled. The substituted action is instead for this different case: An architect compares two Microsoft 365 tenants' security scores without considering their different licensed feature sets. Requirement (2) is not met: Assessment scores may not prove an unsafe configuration has been repaired. The substituted action is instead for this different case: The security architect wants to prioritize tenant security improvements but cannot quantify the impact of disrupting daily collaboration. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (1) is not met: Security product licensing does not establish that recommended controls are enabled. The substituted action is instead for this different case: An architect compares two Microsoft 365 tenants' security scores without considering their different licensed feature sets. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (2) is not met: Assessment scores may not prove an unsafe configuration has been repaired. The substituted action is instead for this different case: The security architect wants to prioritize tenant security improvements but cannot quantify the impact of disrupting daily collaboration. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Microsoft Cybersecurity Architect (SC-100) Practice Tests