Question 500
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A Defender posture report shows hundreds of failed checks but the team lacks a risk-ranked remediation plan. (2) An application cannot immediately apply a required patch because its availability architecture has no maintenance window. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Sequence fixes by exploitability, business impact and protected resource criticality. | (2) Verify observed effective configuration and assessment refresh before closing the recommendation.
- (1) Normalize posture comparisons for coverage, eligibility and differing assessed resource populations. | (2) Verify observed effective configuration and assessment refresh before closing the recommendation.
- (1) Sequence fixes by exploitability, business impact and protected resource criticality. | (2) Define time-limited compensating controls and a verified service-safe patch schedule.
- (1) Normalize posture comparisons for coverage, eligibility and differing assessed resource populations. | (2) Define time-limited compensating controls and a verified service-safe patch schedule.
Explanation
Correct Answer
C:For requirement (1), Prioritized mitigation directs effort to meaningful exposure rather than check counts. For requirement (2), Operational constraints can be managed without disregarding the vulnerability. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (2) is not met: Operational constraints can be managed without disregarding the vulnerability. The substituted action is instead for this different case: A security recommendation remains unresolved after the repair team claims the fix was applied. The proposed bundle therefore cannot satisfy BOTH stated requirements.
B:Requirement (1) is not met: Prioritized mitigation directs effort to meaningful exposure rather than check counts. The substituted action is instead for this different case: A compliance analyst compares two tenants' Secure Scores without considering different product licenses and monitored assets. Requirement (2) is not met: Operational constraints can be managed without disregarding the vulnerability. The substituted action is instead for this different case: A security recommendation remains unresolved after the repair team claims the fix was applied. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: Prioritized mitigation directs effort to meaningful exposure rather than check counts. The substituted action is instead for this different case: A compliance analyst compares two tenants' Secure Scores without considering different product licenses and monitored assets. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 501
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) IoT devices authenticate to a cloud hub using one credential shared by the full fleet. (2) A firmware update service accepts unsigned update packages from a writable public bucket. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Provision per-device identities and revoke individual compromised devices without changing all peers. | (2) Require signed firmware artifacts and restricted update distribution with rollback safeguards.
- (1) Authenticate senders and validate command authorization and schema at the IoT service boundary. | (2) Require signed firmware artifacts and restricted update distribution with rollback safeguards.
- (1) Provision per-device identities and revoke individual compromised devices without changing all peers. | (2) Define edge-data encryption, retention and secure wipe requirements for IoT decommissioning.
- (1) Authenticate senders and validate command authorization and schema at the IoT service boundary. | (2) Define edge-data encryption, retention and secure wipe requirements for IoT decommissioning.
Explanation
Correct Answer
A:For requirement (1), Unique credential scope allows containment of one compromised sensor. For requirement (2), Device trust depends on verifiable software provenance before installing updates. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
B:Requirement (1) is not met: Unique credential scope allows containment of one compromised sensor. The substituted action is instead for this different case: A cloud function processes device telemetry without validating which device supplied a command message. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (2) is not met: Device trust depends on verifiable software provenance before installing updates. The substituted action is instead for this different case: An edge gateway caches sensitive sensor data indefinitely after devices are retired. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: Unique credential scope allows containment of one compromised sensor. The substituted action is instead for this different case: A cloud function processes device telemetry without validating which device supplied a command message. Requirement (2) is not met: Device trust depends on verifiable software provenance before installing updates. The substituted action is instead for this different case: An edge gateway caches sensitive sensor data indefinitely after devices are retired. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 502
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A hybrid organization creates cloud identities independently of local AD and users appear twice after synchronization. (2) A Cloud Sync design omits agent redundancy even though on-premises directory provisioning is business-critical. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Federate workload administration to governed identities and enforce provider-specific least privilege. | (2) Design supported redundant provisioning agents and monitor synchronization health.
- (1) Define authoritative identity source and matching rules before enabling hybrid provisioning. | (2) Validate synchronization scope changes and accidental-delete protections before exporting.
- (1) Federate workload administration to governed identities and enforce provider-specific least privilege. | (2) Validate synchronization scope changes and accidental-delete protections before exporting.
- (1) Define authoritative identity source and matching rules before enabling hybrid provisioning. | (2) Design supported redundant provisioning agents and monitor synchronization health.
Explanation
Correct Answer
D:For requirement (1), Stable source matching prevents duplicate principals and fractured entitlements. For requirement (2), Identity lifecycle resilience depends on the availability of the provisioning pathway. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (1) is not met: Stable source matching prevents duplicate principals and fractured entitlements. The substituted action is instead for this different case: A multicloud team reuses one shared cloud administrator password across AWS and Azure consoles. The proposed bundle therefore cannot satisfy BOTH stated requirements.
B:Requirement (2) is not met: Identity lifecycle resilience depends on the availability of the provisioning pathway. The substituted action is instead for this different case: The team moves user objects between source OUs without assessing deletion effects in the cloud directory. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (1) is not met: Stable source matching prevents duplicate principals and fractured entitlements. The substituted action is instead for this different case: A multicloud team reuses one shared cloud administrator password across AWS and Azure consoles. Requirement (2) is not met: Identity lifecycle resilience depends on the availability of the provisioning pathway. The substituted action is instead for this different case: The team moves user objects between source OUs without assessing deletion effects in the cloud directory. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 503
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A bank wants a view of cloud resources aligned to a particular benchmark across Azure subscriptions. (2) A multicloud program needs comparable cloud-security assessments across AWS and Azure but has only onboarded Azure. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Validate manual procedures, application responsibilities and excluded assets alongside automated assessments. | (2) Track compliance trends and reassess benchmark mapping after changes to policy or resource scope.
- (1) Evaluate Defender for Cloud regulatory compliance standards and their mapped assessment evidence. | (2) Design eligible Defender for Cloud multicloud connectors and verify assessment coverage per account.
- (1) Validate manual procedures, application responsibilities and excluded assets alongside automated assessments. | (2) Design eligible Defender for Cloud multicloud connectors and verify assessment coverage per account.
- (1) Evaluate Defender for Cloud regulatory compliance standards and their mapped assessment evidence. | (2) Track compliance trends and reassess benchmark mapping after changes to policy or resource scope.
Explanation
Correct Answer
B:For requirement (1), Regulatory dashboards correlate supported control assessments with relevant resource states. For requirement (2), Unconnected environments create blind spots in consolidated regulatory monitoring. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (1) is not met: Regulatory dashboards correlate supported control assessments with relevant resource states. The substituted action is instead for this different case: The audit team mistakes a green Defender for Cloud regulatory dashboard for a guarantee of legal compliance. Requirement (2) is not met: Unconnected environments create blind spots in consolidated regulatory monitoring. The substituted action is instead for this different case: A control's compliance state changes after the security team modifies its underlying cloud policy but never reviews effects. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (1) is not met: Regulatory dashboards correlate supported control assessments with relevant resource states. The substituted action is instead for this different case: The audit team mistakes a green Defender for Cloud regulatory dashboard for a guarantee of legal compliance. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (2) is not met: Unconnected environments create blind spots in consolidated regulatory monitoring. The substituted action is instead for this different case: A control's compliance state changes after the security team modifies its underlying cloud policy but never reviews effects. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 504
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) Backups contain executable images from the period when attackers already had domain administrator access. (2) The SOC wants to preserve forensic evidence while operations teams demand an immediate full wipe of affected systems. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Validate backup recovery points and restore in an isolated clean environment before reconnecting workloads. | (2) Coordinate forensic preservation and priority restoration using segregated evidence and recovery environments.
- (1) Add business reconciliation and integrity checks before declaring financial service recovery complete. | (2) Coordinate forensic preservation and priority restoration using segregated evidence and recovery environments.
- (1) Validate backup recovery points and restore in an isolated clean environment before reconnecting workloads. | (2) Define end-to-end application recovery acceptance tests including identity, network and dependent service calls.
- (1) Add business reconciliation and integrity checks before declaring financial service recovery complete. | (2) Define end-to-end application recovery acceptance tests including identity, network and dependent service calls.
Explanation
Correct Answer
A:For requirement (1), Restoring from already compromised images can reactivate malicious persistence and undo containment. For requirement (2), Recovery planning should prevent unnecessary evidence destruction while allowing essential services to resume. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
B:Requirement (1) is not met: Restoring from already compromised images can reactivate malicious persistence and undo containment. The substituted action is instead for this different case: A critical financial workload is restored but no one compares its ledger balance to the last trusted state. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (2) is not met: Recovery planning should prevent unnecessary evidence destruction while allowing essential services to resume. The substituted action is instead for this different case: A site failover test reports success because a VM boots, yet user authentication and dependent APIs remain inaccessible. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: Restoring from already compromised images can reactivate malicious persistence and undo containment. The substituted action is instead for this different case: A critical financial workload is restored but no one compares its ledger balance to the last trusted state. Requirement (2) is not met: Recovery planning should prevent unnecessary evidence destruction while allowing essential services to resume. The substituted action is instead for this different case: A site failover test reports success because a VM boots, yet user authentication and dependent APIs remain inaccessible. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 505
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A company stores daily backups under the same highly privileged credentials as production and ransomware encrypts both. (2) A legal records system has a five-year retention policy, and its owner assumes that policy is equivalent to point-in-time backups. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Design isolated, access-restricted and immutable backup copies with independent administration. | (2) Place recovery data in approved geographically independent locations and validate regional-failover dependencies.
- (1) Schedule integrity-checked recovery tests that measure actual restore time and application consistency. | (2) Place recovery data in approved geographically independent locations and validate regional-failover dependencies.
- (1) Design isolated, access-restricted and immutable backup copies with independent administration. | (2) Specify independent backup and restoration controls in addition to legal retention enforcement.
- (1) Schedule integrity-checked recovery tests that measure actual restore time and application consistency. | (2) Specify independent backup and restoration controls in addition to legal retention enforcement.
Explanation
Correct Answer
C:For requirement (1), Separation and immutability reduce the chance that one compromise destroys the recovery source alongside production. For requirement (2), Compliance retention preserves governed records while recoverable versions and tested restore workflows address operational failure. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (2) is not met: Compliance retention preserves governed records while recoverable versions and tested restore workflows address operational failure. The substituted action is instead for this different case: A hybrid estate needs protection from a cloud-region failure while avoiding backups confined to that same region. The proposed bundle therefore cannot satisfy BOTH stated requirements.
B:Requirement (1) is not met: Separation and immutability reduce the chance that one compromise destroys the recovery source alongside production. The substituted action is instead for this different case: A cloud storage backup exists but no administrator has successfully restored a sample application. Requirement (2) is not met: Compliance retention preserves governed records while recoverable versions and tested restore workflows address operational failure. The substituted action is instead for this different case: A hybrid estate needs protection from a cloud-region failure while avoiding backups confined to that same region. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: Separation and immutability reduce the chance that one compromise destroys the recovery source alongside production. The substituted action is instead for this different case: A cloud storage backup exists but no administrator has successfully restored a sample application. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 506
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A Copilot user can summarize files the organization did not intend to share because SharePoint site permissions are broad. (2) A compliance board assumes prompt safety filters prevent leakage from an over-permissioned document corpus. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Remediate excessive SharePoint and Microsoft 365 content permissions before broad Copilot rollout. | (2) Design supported Copilot audit and activity-monitoring evidence with privacy-aware access.
- (1) Evaluate supported Microsoft Purview DLP and information-protection controls for Copilot interactions. | (2) Design supported Copilot audit and activity-monitoring evidence with privacy-aware access.
- (1) Remediate excessive SharePoint and Microsoft 365 content permissions before broad Copilot rollout. | (2) Separate AI content safety from underlying data permission and labeling governance.
- (1) Evaluate supported Microsoft Purview DLP and information-protection controls for Copilot interactions. | (2) Separate AI content safety from underlying data permission and labeling governance.
Explanation
Correct Answer
C:For requirement (1), Copilot can surface content a user can already access, making oversharing a priority risk. For requirement (2), Safety filters do not replace ACLs on retrieved business documents. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (2) is not met: Safety filters do not replace ACLs on retrieved business documents. The substituted action is instead for this different case: A security architect cannot explain which user actions and protected data sources Copilot accessed during an incident. The proposed bundle therefore cannot satisfy BOTH stated requirements.
B:Requirement (1) is not met: Copilot can surface content a user can already access, making oversharing a priority risk. The substituted action is instead for this different case: An organization deploys Copilot without deciding whether confidential prompts and generated responses belong in its DLP scope. Requirement (2) is not met: Safety filters do not replace ACLs on retrieved business documents. The substituted action is instead for this different case: A security architect cannot explain which user actions and protected data sources Copilot accessed during an incident. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: Copilot can surface content a user can already access, making oversharing a priority risk. The substituted action is instead for this different case: An organization deploys Copilot without deciding whether confidential prompts and generated responses belong in its DLP scope. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 507
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A cloud application stores long-lived client secrets in a code repository and rotates them only when employees leave. (2) A workload needs cryptographic operations while the application operators must not be able to export the master key. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Establish certificate inventory, expiry monitoring and tested renewal procedures for trust-critical services. | (2) Define independent keys, access scopes and rotation policies per workload and trust boundary.
- (1) Use Azure Key Vault or an equivalent managed secret service with controlled rotation and access policies. | (2) Evaluate managed or hardware-protected key custody with separate key administration roles.
- (1) Establish certificate inventory, expiry monitoring and tested renewal procedures for trust-critical services. | (2) Evaluate managed or hardware-protected key custody with separate key administration roles.
- (1) Use Azure Key Vault or an equivalent managed secret service with controlled rotation and access policies. | (2) Define independent keys, access scopes and rotation policies per workload and trust boundary.
Explanation
Correct Answer
B:For requirement (1), Central secret custody and rotation reduce exposure from hard-coded credentials. For requirement (2), Nonexportable key control and separation of duties reduce the blast radius of app compromise. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (1) is not met: Central secret custody and rotation reduce exposure from hard-coded credentials. The substituted action is instead for this different case: A service certificate expires and causes an identity federation outage across the enterprise. Requirement (2) is not met: Nonexportable key control and separation of duties reduce the blast radius of app compromise. The substituted action is instead for this different case: A multicloud application shares the same encryption key material broadly between unrelated environments. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (1) is not met: Central secret custody and rotation reduce exposure from hard-coded credentials. The substituted action is instead for this different case: A service certificate expires and causes an identity federation outage across the enterprise. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (2) is not met: Nonexportable key control and separation of duties reduce the blast radius of app compromise. The substituted action is instead for this different case: A multicloud application shares the same encryption key material broadly between unrelated environments. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 508
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) External employees receive SharePoint and app grants through many manual requests without expiry dates. (2) A group owner assumes removal from a Teams channel automatically revokes every separate application assignment. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Use access packages with approval, expiration and review controls where supported. | (2) Inventory direct, group-based and application grants when evaluating effective access.
- (1) Schedule sponsor-backed access reviews and remove no-longer-justified assignments. | (2) Inventory direct, group-based and application grants when evaluating effective access.
- (1) Use access packages with approval, expiration and review controls where supported. | (2) Require approval records and access-package ownership for external resource entitlements.
- (1) Schedule sponsor-backed access reviews and remove no-longer-justified assignments. | (2) Require approval records and access-package ownership for external resource entitlements.
Explanation
Correct Answer
A:For requirement (1), Entitlement workflows govern the full lifecycle of bundled resource access. For requirement (2), User access can come from multiple independent authorization paths. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
B:Requirement (1) is not met: Entitlement workflows govern the full lifecycle of bundled resource access. The substituted action is instead for this different case: A project manager approves access packages but cannot determine who still has access when a project closes. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (2) is not met: User access can come from multiple independent authorization paths. The substituted action is instead for this different case: A sensitive application allows broad guest onboarding with no evidence of who approved the initial grant. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: Entitlement workflows govern the full lifecycle of bundled resource access. The substituted action is instead for this different case: A project manager approves access packages but cannot determine who still has access when a project closes. Requirement (2) is not met: User access can come from multiple independent authorization paths. The substituted action is instead for this different case: A sensitive application allows broad guest onboarding with no evidence of who approved the initial grant. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 509
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) Employees need access to an internal application without being connected to a broad network-level VPN. (2) A private app is published but an authorized user cannot reach its service hostname through the client. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Design supported connector redundancy and verify private application availability during failure. | (2) Keep backend application authentication and resource permission checks under the Private Access architecture.
- (1) Evaluate Microsoft Entra Private Access with published application segments and scoped user grants. | (2) Validate private access app segments, DNS resolution and forwarding policy for the target.
- (1) Design supported connector redundancy and verify private application availability during failure. | (2) Validate private access app segments, DNS resolution and forwarding policy for the target.
- (1) Evaluate Microsoft Entra Private Access with published application segments and scoped user grants. | (2) Keep backend application authentication and resource permission checks under the Private Access architecture.
Explanation
Correct Answer
B:For requirement (1), Zero Trust private access can expose an application rather than a whole internal subnet. For requirement (2), A user grant alone does not establish name resolution or routing to the application. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (1) is not met: Zero Trust private access can expose an application rather than a whole internal subnet. The substituted action is instead for this different case: An application connector is deployed in only one location and becomes unavailable during routine maintenance. Requirement (2) is not met: A user grant alone does not establish name resolution or routing to the application. The substituted action is instead for this different case: A team migrates from VPN and assumes private access removes the need for server-side authorization. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (1) is not met: Zero Trust private access can expose an application rather than a whole internal subnet. The substituted action is instead for this different case: An application connector is deployed in only one location and becomes unavailable during routine maintenance. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (2) is not met: A user grant alone does not establish name resolution or routing to the application. The substituted action is instead for this different case: A team migrates from VPN and assumes private access removes the need for server-side authorization. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 510
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A SOC investigates user phishing incidents without checking related endpoint and identity alerts. (2) A tenant allows external collaboration but no one reviews guests after their projects end. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Design Microsoft 365 network optimization alongside appropriate identity and data security policies. | (2) Verify monitoring coverage and telemetry health before interpreting low alert counts as low risk.
- (1) Correlate Office 365 detections with Defender XDR cross-workload incidents. | (2) Implement guest lifecycle and sponsor-backed entitlement reviews across supported workloads.
- (1) Design Microsoft 365 network optimization alongside appropriate identity and data security policies. | (2) Implement guest lifecycle and sponsor-backed entitlement reviews across supported workloads.
- (1) Correlate Office 365 detections with Defender XDR cross-workload incidents. | (2) Verify monitoring coverage and telemetry health before interpreting low alert counts as low risk.
Explanation
Correct Answer
B:For requirement (1), Email threats can lead to identity and endpoint compromise that a mailbox-only view misses. For requirement (2), External collaboration risk persists when access remains after legitimate need ends. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (1) is not met: Email threats can lead to identity and endpoint compromise that a mailbox-only view misses. The substituted action is instead for this different case: A network team proposes exempting all Teams traffic from every security control to resolve poor call quality. Requirement (2) is not met: External collaboration risk persists when access remains after legitimate need ends. The substituted action is instead for this different case: A Microsoft 365 compliance dashboard shows no incidents, but several workloads are not licensed or connected for security signals. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (1) is not met: Email threats can lead to identity and endpoint compromise that a mailbox-only view misses. The substituted action is instead for this different case: A network team proposes exempting all Teams traffic from every security control to resolve poor call quality. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (2) is not met: External collaboration risk persists when access remains after legitimate need ends. The substituted action is instead for this different case: A Microsoft 365 compliance dashboard shows no incidents, but several workloads are not licensed or connected for security signals. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Microsoft Cybersecurity Architect (SC-100) Practice Tests