Question 550
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A security dashboard lists alert counts but cannot demonstrate which adversary techniques are detected. (2) An investigation labels all mobile-device anomalies as workstation persistence and misroutes response. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Include appropriate ATT&CK for ICS techniques and industrial event sources in detection design. | (2) Evaluate mobile-relevant MITRE ATT&CK behaviors and mobile telemetry availability.
- (1) Map detection use cases to MITRE ATT&CK techniques and identify uncovered tactics. | (2) Test analytic coverage against representative variations and record the sensor and response assumptions.
- (1) Include appropriate ATT&CK for ICS techniques and industrial event sources in detection design. | (2) Test analytic coverage against representative variations and record the sensor and response assumptions.
- (1) Map detection use cases to MITRE ATT&CK techniques and identify uncovered tactics. | (2) Evaluate mobile-relevant MITRE ATT&CK behaviors and mobile telemetry availability.
Explanation
Correct Answer
D:For requirement (1), Technique coverage exposes blind spots that simple alert volumes conceal. For requirement (2), Mobile attack techniques and sensors require distinct detection context. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (1) is not met: Technique coverage exposes blind spots that simple alert volumes conceal. The substituted action is instead for this different case: A factory SOC adopts only enterprise IT ATT&CK techniques while its control networks use industrial protocols. The proposed bundle therefore cannot satisfy BOTH stated requirements.
B:Requirement (2) is not met: Mobile attack techniques and sensors require distinct detection context. The substituted action is instead for this different case: A team treats a red-team simulation detection as proven coverage for every variant of an ATT&CK technique. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (1) is not met: Technique coverage exposes blind spots that simple alert volumes conceal. The substituted action is instead for this different case: A factory SOC adopts only enterprise IT ATT&CK techniques while its control networks use industrial protocols. Requirement (2) is not met: Mobile attack techniques and sensors require distinct detection context. The substituted action is instead for this different case: A team treats a red-team simulation detection as proven coverage for every variant of an ATT&CK technique. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 551
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A security design review accepts a product diagram but lacks evidence of how the proposed controls work under failure. (2) A control has been implemented only in the primary region while workloads also serve regulated traffic elsewhere. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Define architecture acceptance criteria that include control testing, telemetry and failure-mode verification. | (2) Introduce repeatable automated evidence collection and independent control-owner review.
- (1) Validate reference recommendations against local prerequisites and record justified design deviations. | (2) Introduce repeatable automated evidence collection and independent control-owner review.
- (1) Define architecture acceptance criteria that include control testing, telemetry and failure-mode verification. | (2) Assess control coverage across every approved location and execution environment.
- (1) Validate reference recommendations against local prerequisites and record justified design deviations. | (2) Assess control coverage across every approved location and execution environment.
Explanation
Correct Answer
C:For requirement (1), Diagram-level intent must be demonstrated through observable operating behavior. For requirement (2), Partial rollout creates unprotected processing paths even if the primary region passes inspection. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (2) is not met: Partial rollout creates unprotected processing paths even if the primary region passes inspection. The substituted action is instead for this different case: An engineering team plans to claim continuous compliance from an annual spreadsheet completed by a single administrator. The proposed bundle therefore cannot satisfy BOTH stated requirements.
B:Requirement (1) is not met: Diagram-level intent must be demonstrated through observable operating behavior. The substituted action is instead for this different case: An enterprise trusts a vendor reference configuration even though the deployment environment has different identity and network constraints. Requirement (2) is not met: Partial rollout creates unprotected processing paths even if the primary region passes inspection. The substituted action is instead for this different case: An engineering team plans to claim continuous compliance from an annual spreadsheet completed by a single administrator. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: Diagram-level intent must be demonstrated through observable operating behavior. The substituted action is instead for this different case: An enterprise trusts a vendor reference configuration even though the deployment environment has different identity and network constraints. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 552
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A cloud project seeks the highest possible Secure Score but ignores regulatory data residency obligations. (2) An architecture review lists technical threats but excludes vendors and privileged operators from the attack surface. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Establish an agreed source of identity truth and consistent joiner-mover-leaver architecture. | (2) Include third-party and internal trust relationships in the threat inventory and mitigation plan.
- (1) Prioritize risk and compliance requirements before using posture scores to choose compensating controls. | (2) Translate identified control gaps into risk-ranked treatment decisions with accountable owners.
- (1) Establish an agreed source of identity truth and consistent joiner-mover-leaver architecture. | (2) Translate identified control gaps into risk-ranked treatment decisions with accountable owners.
- (1) Prioritize risk and compliance requirements before using posture scores to choose compensating controls. | (2) Include third-party and internal trust relationships in the threat inventory and mitigation plan.
Explanation
Correct Answer
D:For requirement (1), A numeric posture score does not measure every legal and business constraint. For requirement (2), Supply-chain and insider paths can bypass controls designed only for internet attackers. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (1) is not met: A numeric posture score does not measure every legal and business constraint. The substituted action is instead for this different case: Two business units deploy redundant identity tools that disagree about the authoritative account lifecycle. The proposed bundle therefore cannot satisfy BOTH stated requirements.
B:Requirement (2) is not met: Supply-chain and insider paths can bypass controls designed only for internet attackers. The substituted action is instead for this different case: A risk committee receives control gaps without impact, likelihood or remediation ownership. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (1) is not met: A numeric posture score does not measure every legal and business constraint. The substituted action is instead for this different case: Two business units deploy redundant identity tools that disagree about the authoritative account lifecycle. Requirement (2) is not met: Supply-chain and insider paths can bypass controls designed only for internet attackers. The substituted action is instead for this different case: A risk committee receives control gaps without impact, likelihood or remediation ownership. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 553
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) An engineer proposes that every cloud administrator also hold permanent enterprise domain administrator privileges. (2) A tenant contains an emergency access identity with ordinary email and browsing enabled. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Scope supported administrative roles to the subsidiary through appropriate administrative units. | (2) Establish dedicated monitored emergency access accounts with restricted routine use.
- (1) Separate privileged access tiers and delegate authority only for the required control plane. | (2) Replace blanket standing ownership with narrow scoped roles and approved elevation paths.
- (1) Scope supported administrative roles to the subsidiary through appropriate administrative units. | (2) Replace blanket standing ownership with narrow scoped roles and approved elevation paths.
- (1) Separate privileged access tiers and delegate authority only for the required control plane. | (2) Establish dedicated monitored emergency access accounts with restricted routine use.
Explanation
Correct Answer
D:For requirement (1), Compartmentalized administration reduces the impact of one compromised privileged identity. For requirement (2), Recovery principals should remain available but not be exposed to everyday application risk. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (1) is not met: Compartmentalized administration reduces the impact of one compromised privileged identity. The substituted action is instead for this different case: The help desk needs to reset passwords for one subsidiary but receives tenant-wide user administrator rights. The proposed bundle therefore cannot satisfy BOTH stated requirements.
B:Requirement (2) is not met: Recovery principals should remain available but not be exposed to everyday application risk. The substituted action is instead for this different case: An automation account receives direct permanent Owner permissions on every production subscription. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (1) is not met: Compartmentalized administration reduces the impact of one compromised privileged identity. The substituted action is instead for this different case: The help desk needs to reset passwords for one subsidiary but receives tenant-wide user administrator rights. Requirement (2) is not met: Recovery principals should remain available but not be exposed to everyday application risk. The substituted action is instead for this different case: An automation account receives direct permanent Owner permissions on every production subscription. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 554
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A mixed Windows and Linux server fleet has no consistent detection coverage or local hardening baseline. (2) Production servers allow local administrator access from standard employee workstations. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Specify OS-specific endpoint protection and secure configuration standards for the server estate. | (2) Restrict privileged management ingress and require approved hardened administrative pathways.
- (1) Plan isolation or migration to a supported platform with documented interim risk controls. | (2) Restrict privileged management ingress and require approved hardened administrative pathways.
- (1) Specify OS-specific endpoint protection and secure configuration standards for the server estate. | (2) Include host operating-system patching and vulnerability monitoring in the container platform baseline.
- (1) Plan isolation or migration to a supported platform with documented interim risk controls. | (2) Include host operating-system patching and vulnerability monitoring in the container platform baseline.
Explanation
Correct Answer
A:For requirement (1), Server controls must respect platform differences while meeting common risk requirements. For requirement (2), Management-plane isolation reduces lateral movement to critical server resources. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
B:Requirement (1) is not met: Server controls must respect platform differences while meeting common risk requirements. The substituted action is instead for this different case: An internet-facing Windows server runs an unsupported OS and the team expects ordinary patch deployment to fix it. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (2) is not met: Management-plane isolation reduces lateral movement to critical server resources. The substituted action is instead for this different case: A container host has healthy runtime workloads but its underlying operating system security updates are months behind. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: Server controls must respect platform differences while meeting common risk requirements. The substituted action is instead for this different case: An internet-facing Windows server runs an unsupported OS and the team expects ordinary patch deployment to fix it. Requirement (2) is not met: Management-plane isolation reduces lateral movement to critical server resources. The substituted action is instead for this different case: A container host has healthy runtime workloads but its underlying operating system security updates are months behind. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 555
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A branch firewall blocks Azure monitoring traffic after a network redesign, leaving a gap in security telemetry. (2) A service is moved behind a private endpoint, yet its old public DNS name continues to resolve to an exposed address. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Design appropriate network flow telemetry for internal and cross-region sensitive paths. | (2) Validate DNS and public endpoint disablement after the private connectivity migration.
- (1) Include monitoring endpoint reachability and firewall telemetry in network security acceptance tests. | (2) Inventory authorized application protocols and enforce narrow hybrid network access rules.
- (1) Design appropriate network flow telemetry for internal and cross-region sensitive paths. | (2) Inventory authorized application protocols and enforce narrow hybrid network access rules.
- (1) Include monitoring endpoint reachability and firewall telemetry in network security acceptance tests. | (2) Validate DNS and public endpoint disablement after the private connectivity migration.
Explanation
Correct Answer
D:For requirement (1), Security sensors need working transport paths to deliver threat evidence. For requirement (2), Changing one application connection does not necessarily remove the original public attack surface. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (1) is not met: Security sensors need working transport paths to deliver threat evidence. The substituted action is instead for this different case: A cross-region incident requires inspecting east-west application connections but only internet ingress logs are retained. The proposed bundle therefore cannot satisfy BOTH stated requirements.
B:Requirement (2) is not met: Changing one application connection does not necessarily remove the original public attack surface. The substituted action is instead for this different case: The network team permits all ports between Azure and an acquired private cloud because it does not know the required application flows. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (1) is not met: Security sensors need working transport paths to deliver threat evidence. The substituted action is instead for this different case: A cross-region incident requires inspecting east-west application connections but only internet ingress logs are retained. Requirement (2) is not met: Changing one application connection does not necessarily remove the original public attack surface. The substituted action is instead for this different case: The network team permits all ports between Azure and an acquired private cloud because it does not know the required application flows. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 556
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A configuration team enables one generic security baseline for every device regardless of application compatibility. (2) A server build pipeline uses hardened templates but administrators repeatedly override settings after deployment. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Validate effective disk encryption state rather than relying on policy assignment alone. | (2) Include product health, update freshness and telemetry availability in the endpoint assurance standard.
- (1) Pilot platform-specific baseline controls and document justified workload exceptions. | (2) Detect configuration drift and reconcile operational changes against approved hardened baselines.
- (1) Validate effective disk encryption state rather than relying on policy assignment alone. | (2) Detect configuration drift and reconcile operational changes against approved hardened baselines.
- (1) Pilot platform-specific baseline controls and document justified workload exceptions. | (2) Include product health, update freshness and telemetry availability in the endpoint assurance standard.
Explanation
Correct Answer
B:For requirement (1), A baseline must be validated against supported operating systems and critical services. For requirement (2), Ongoing assurance must catch unsafe deviations from the initial image. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (1) is not met: A baseline must be validated against supported operating systems and critical services. The substituted action is instead for this different case: Devices report compliant because a policy was assigned, yet the expected BitLocker protection is absent. Requirement (2) is not met: Ongoing assurance must catch unsafe deviations from the initial image. The substituted action is instead for this different case: A compliance report shows that antivirus is installed but its signatures and cloud protection have not updated for weeks. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (1) is not met: A baseline must be validated against supported operating systems and critical services. The substituted action is instead for this different case: Devices report compliant because a policy was assigned, yet the expected BitLocker protection is absent. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (2) is not met: Ongoing assurance must catch unsafe deviations from the initial image. The substituted action is instead for this different case: A compliance report shows that antivirus is installed but its signatures and cloud protection have not updated for weeks. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 557
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) An engineering group performs security review only after production incidents. (2) A release manager cannot associate a production binary with the approved source commit. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Establish software bill of materials and dependency update governance for third-party packages. | (2) Create a documented risk exception path with compensating controls and time-bounded remediation.
- (1) Embed design review, testing and remediation in each phase of the application development lifecycle. | (2) Require signed or attested release provenance linking build outputs to reviewed source revisions.
- (1) Establish software bill of materials and dependency update governance for third-party packages. | (2) Require signed or attested release provenance linking build outputs to reviewed source revisions.
- (1) Embed design review, testing and remediation in each phase of the application development lifecycle. | (2) Create a documented risk exception path with compensating controls and time-bounded remediation.
Explanation
Correct Answer
B:For requirement (1), Shift-left controls catch weaknesses before deployment while preserving operational feedback. For requirement (2), Supply-chain integrity depends on knowing the origin of deployed artifacts. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (1) is not met: Shift-left controls catch weaknesses before deployment while preserving operational feedback. The substituted action is instead for this different case: A production app relies on an unsupported open-source library but developers assume vendor support covers it. Requirement (2) is not met: Supply-chain integrity depends on knowing the origin of deployed artifacts. The substituted action is instead for this different case: A team accepts security defects in a release without recording who approved the exception or when it expires. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (1) is not met: Shift-left controls catch weaknesses before deployment while preserving operational feedback. The substituted action is instead for this different case: A production app relies on an unsupported open-source library but developers assume vendor support covers it. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (2) is not met: Supply-chain integrity depends on knowing the origin of deployed artifacts. The substituted action is instead for this different case: A team accepts security defects in a release without recording who approved the exception or when it expires. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 558
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) Ransomware responders cannot use recovery consoles because the tenant's normal administrator identities were disabled. (2) A backup operator can both delete immutable backup protection settings and restore data without independent approval. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Replace person-bound privileged automation with a governed workload identity and least-privilege permissions. | (2) Include directory recovery, privileged group validation and trusted identity checkpoints in the resilience plan.
- (1) Maintain protected emergency administrative access with monitored, rehearsed recovery procedures. | (2) Separate destructive backup administration from ordinary restore permissions and enforce independent approvals.
- (1) Replace person-bound privileged automation with a governed workload identity and least-privilege permissions. | (2) Separate destructive backup administration from ordinary restore permissions and enforce independent approvals.
- (1) Maintain protected emergency administrative access with monitored, rehearsed recovery procedures. | (2) Include directory recovery, privileged group validation and trusted identity checkpoints in the resilience plan.
Explanation
Correct Answer
B:For requirement (1), Resilient privileged access preserves a controlled recovery path when ordinary accounts or policies fail. For requirement (2), Separation of duties reduces the impact of one compromised recovery operator. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (1) is not met: Resilient privileged access preserves a controlled recovery path when ordinary accounts or policies fail. The substituted action is instead for this different case: Production automation depends on one employee's Global Administrator credential and fails when that account is disabled. Requirement (2) is not met: Separation of duties reduces the impact of one compromised recovery operator. The substituted action is instead for this different case: Domain controllers in every region replicate untested privileged group changes during a security incident. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (1) is not met: Resilient privileged access preserves a controlled recovery path when ordinary accounts or policies fail. The substituted action is instead for this different case: Production automation depends on one employee's Global Administrator credential and fails when that account is disabled. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (2) is not met: Separation of duties reduces the impact of one compromised recovery operator. The substituted action is instead for this different case: Domain controllers in every region replicate untested privileged group changes during a security incident. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 559
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A high-risk identity appears in Identity Protection and the help desk proposes dismissing it without investigation. (2) A directory team plans passwordless deployment without assessing which legacy applications support modern authentication. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Design a verified recovery and strong-method re-registration process for lost authenticators. | (2) Include session revocation and token investigation in identity compromise response.
- (1) Design risk-based verification, containment and credential recovery workflows for compromised accounts. | (2) Inventory unsupported client protocols and stage their replacement before enforcing passwordless access.
- (1) Design a verified recovery and strong-method re-registration process for lost authenticators. | (2) Inventory unsupported client protocols and stage their replacement before enforcing passwordless access.
- (1) Design risk-based verification, containment and credential recovery workflows for compromised accounts. | (2) Include session revocation and token investigation in identity compromise response.
Explanation
Correct Answer
B:For requirement (1), Risk signals need justified response rather than dashboard-only dismissal. For requirement (2), Modern sign-in requires compatible clients and applications; enrollment alone does not update legacy protocols. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (1) is not met: Risk signals need justified response rather than dashboard-only dismissal. The substituted action is instead for this different case: A user replaces a phone and cannot complete MFA, so support plans to disable all MFA enforcement. Requirement (2) is not met: Modern sign-in requires compatible clients and applications; enrollment alone does not update legacy protocols. The substituted action is instead for this different case: A compromised session remains active after password change and the owner believes password reset alone closes the incident. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (1) is not met: Risk signals need justified response rather than dashboard-only dismissal. The substituted action is instead for this different case: A user replaces a phone and cannot complete MFA, so support plans to disable all MFA enforcement. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (2) is not met: Modern sign-in requires compatible clients and applications; enrollment alone does not update legacy protocols. The substituted action is instead for this different case: A compromised session remains active after password change and the owner believes password reset alone closes the incident. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 560
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A corporation has hundreds of internal apps but no inventory of their hosting, owners or authentication methods. (2) A software vendor claims SOC reports prove that every custom configuration of its application is secure. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Build an application security inventory with criticality, exposure, ownership and identity dependencies. | (2) Validate the application-specific configuration and customer responsibility model separately from vendor assurances.
- (1) Prioritize application posture findings by reachable attack paths and regulated data impact. | (2) Validate the application-specific configuration and customer responsibility model separately from vendor assurances.
- (1) Build an application security inventory with criticality, exposure, ownership and identity dependencies. | (2) Assign application security ownership and a funded vulnerability management lifecycle.
- (1) Prioritize application posture findings by reachable attack paths and regulated data impact. | (2) Assign application security ownership and a funded vulnerability management lifecycle.
Explanation
Correct Answer
A:For requirement (1), Portfolio risk cannot be assessed without knowing the applications and their attack surfaces. For requirement (2), General vendor audits do not verify the purchaser's unique deployment controls. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
B:Requirement (1) is not met: Portfolio risk cannot be assessed without knowing the applications and their attack surfaces. The substituted action is instead for this different case: An application assessment scores a public healthcare API and an internal demo app equally because both lack one HTTP header. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (2) is not met: General vendor audits do not verify the purchaser's unique deployment controls. The substituted action is instead for this different case: A security board authorizes a new application but no one owns future dependency updates. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: Portfolio risk cannot be assessed without knowing the applications and their attack surfaces. The substituted action is instead for this different case: An application assessment scores a public healthcare API and an internal demo app equally because both lack one HTTP header. Requirement (2) is not met: General vendor audits do not verify the purchaser's unique deployment controls. The substituted action is instead for this different case: A security board authorizes a new application but no one owns future dependency updates. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Microsoft Cybersecurity Architect (SC-100) Practice Tests