Question 560
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A corporation has hundreds of internal apps but no inventory of their hosting, owners or authentication methods. (2) A software vendor claims SOC reports prove that every custom configuration of its application is secure. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Build an application security inventory with criticality, exposure, ownership and identity dependencies. | (2) Validate the application-specific configuration and customer responsibility model separately from vendor assurances.
- (1) Prioritize application posture findings by reachable attack paths and regulated data impact. | (2) Validate the application-specific configuration and customer responsibility model separately from vendor assurances.
- (1) Build an application security inventory with criticality, exposure, ownership and identity dependencies. | (2) Assign application security ownership and a funded vulnerability management lifecycle.
- (1) Prioritize application posture findings by reachable attack paths and regulated data impact. | (2) Assign application security ownership and a funded vulnerability management lifecycle.
Explanation
Correct Answer
A:For requirement (1), Portfolio risk cannot be assessed without knowing the applications and their attack surfaces. For requirement (2), General vendor audits do not verify the purchaser's unique deployment controls. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
B:Requirement (1) is not met: Portfolio risk cannot be assessed without knowing the applications and their attack surfaces. The substituted action is instead for this different case: An application assessment scores a public healthcare API and an internal demo app equally because both lack one HTTP header. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (2) is not met: General vendor audits do not verify the purchaser's unique deployment controls. The substituted action is instead for this different case: A security board authorizes a new application but no one owns future dependency updates. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: Portfolio risk cannot be assessed without knowing the applications and their attack surfaces. The substituted action is instead for this different case: An application assessment scores a public healthcare API and an internal demo app equally because both lack one HTTP header. Requirement (2) is not met: General vendor audits do not verify the purchaser's unique deployment controls. The substituted action is instead for this different case: A security board authorizes a new application but no one owns future dependency updates. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 561
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A workload team assumes a SaaS provider automatically controls which internal employees can export confidential files. (2) A PaaS application team disables authentication because the underlying service platform already uses encryption. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Define customer-owned SaaS identity, sharing and data-protection configuration requirements. | (2) Require application identity, authorization and secret controls for PaaS workloads.
- (1) Allocate customer responsibility for guest OS and application security under the IaaS service model. | (2) Require application identity, authorization and secret controls for PaaS workloads.
- (1) Define customer-owned SaaS identity, sharing and data-protection configuration requirements. | (2) Create service-model-specific control profiles anchored in shared enterprise security requirements.
- (1) Allocate customer responsibility for guest OS and application security under the IaaS service model. | (2) Create service-model-specific control profiles anchored in shared enterprise security requirements.
Explanation
Correct Answer
A:For requirement (1), SaaS providers operate the service but customer access settings remain a shared-responsibility concern. For requirement (2), Provider platform safeguards do not authenticate application users or authorize data access. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
B:Requirement (1) is not met: SaaS providers operate the service but customer access settings remain a shared-responsibility concern. The substituted action is instead for this different case: An Azure VM owner assumes Microsoft patches every custom application installed inside the guest. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (2) is not met: Provider platform safeguards do not authenticate application users or authorize data access. The substituted action is instead for this different case: The same baseline is applied without adaptation to Kubernetes nodes, managed SQL and Microsoft 365. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: SaaS providers operate the service but customer access settings remain a shared-responsibility concern. The substituted action is instead for this different case: An Azure VM owner assumes Microsoft patches every custom application installed inside the guest. Requirement (2) is not met: Provider platform safeguards do not authenticate application users or authorize data access. The substituted action is instead for this different case: The same baseline is applied without adaptation to Kubernetes nodes, managed SQL and Microsoft 365. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 562
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A SaaS supplier will process regulated customer data but the security team has not assessed its subcontractors. (2) A vendor requests unrestricted production database access to provide temporary support. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Conduct third-party data-processing due diligence and define contractual security obligations. | (2) Approve time-limited narrowly scoped vendor access with monitored sessions and expiry.
- (1) Evaluate cross-border data movement restrictions and design approved transfer controls before exporting. | (2) Approve time-limited narrowly scoped vendor access with monitored sessions and expiry.
- (1) Conduct third-party data-processing due diligence and define contractual security obligations. | (2) Include credential revocation and third-party access closure in the data decommissioning plan.
- (1) Evaluate cross-border data movement restrictions and design approved transfer controls before exporting. | (2) Include credential revocation and third-party access closure in the data decommissioning plan.
Explanation
Correct Answer
A:For requirement (1), Supply-chain privacy duties extend beyond the immediate service provider. For requirement (2), Contracted support does not justify enduring broad access to regulated records. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
B:Requirement (1) is not met: Supply-chain privacy duties extend beyond the immediate service provider. The substituted action is instead for this different case: A database export crosses a legal jurisdiction without a documented business purpose or residency assessment. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (2) is not met: Contracted support does not justify enduring broad access to regulated records. The substituted action is instead for this different case: A project retires a cloud application but leaves external vendors with active keys to its archived data. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: Supply-chain privacy duties extend beyond the immediate service provider. The substituted action is instead for this different case: A database export crosses a legal jurisdiction without a documented business purpose or residency assessment. Requirement (2) is not met: Contracted support does not justify enduring broad access to regulated records. The substituted action is instead for this different case: A project retires a cloud application but leaves external vendors with active keys to its archived data. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 563
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A generative AI application can read unrelated customer records through its retrieval index. (2) A chatbot sends sensitive prompts to a third-party service without documenting retention or residency terms. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Include prompt-injection threat modeling and policy-enforced tool and data boundaries around the model. | (2) Establish AI data-handling requirements for storage, processing locations and vendor agreements before approval.
- (1) Restrict retrieval to user-authorized content and enforce data-plane access controls in the AI pipeline. | (2) Enforce model endpoint authentication, authorization and logging independently of content safety controls.
- (1) Include prompt-injection threat modeling and policy-enforced tool and data boundaries around the model. | (2) Enforce model endpoint authentication, authorization and logging independently of content safety controls.
- (1) Restrict retrieval to user-authorized content and enforce data-plane access controls in the AI pipeline. | (2) Establish AI data-handling requirements for storage, processing locations and vendor agreements before approval.
Explanation
Correct Answer
D:For requirement (1), Retrieval-augmented generation must not bypass original source authorization. For requirement (2), Secure AI adoption includes privacy and contractual data processing controls, not only model accuracy. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (1) is not met: Retrieval-augmented generation must not bypass original source authorization. The substituted action is instead for this different case: A model deployment accepts unfiltered user prompts that may cause the assistant to reveal privileged system instructions. The proposed bundle therefore cannot satisfy BOTH stated requirements.
B:Requirement (2) is not met: Secure AI adoption includes privacy and contractual data processing controls, not only model accuracy. The substituted action is instead for this different case: An AI team enables broad model endpoint access because it assumes safety filters also restrict callers. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (1) is not met: Retrieval-augmented generation must not bypass original source authorization. The substituted action is instead for this different case: A model deployment accepts unfiltered user prompts that may cause the assistant to reveal privileged system instructions. Requirement (2) is not met: Secure AI adoption includes privacy and contractual data processing controls, not only model accuracy. The substituted action is instead for this different case: An AI team enables broad model endpoint access because it assumes safety filters also restrict callers. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 564
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A vulnerable workstation links to a privileged service account, but teams prioritize only by its standalone CVSS number. (2) A security program wants to track whether strategic exposure-reduction initiatives improve over several months. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Use Security Exposure Management attack paths and asset criticality to prioritize the chained risk. | (2) Coordinate remediation priorities across endpoint and identity owners using attack-path analysis.
- (1) Distinguish modeled exposure relationships from confirmed compromise telemetry and incident evidence. | (2) Coordinate remediation priorities across endpoint and identity owners using attack-path analysis.
- (1) Use Security Exposure Management attack paths and asset criticality to prioritize the chained risk. | (2) Design a measurable exposure-management initiative review with consistent scope and trend baselines.
- (1) Distinguish modeled exposure relationships from confirmed compromise telemetry and incident evidence. | (2) Design a measurable exposure-management initiative review with consistent scope and trend baselines.
Explanation
Correct Answer
C:For requirement (1), Reachability to privileged resources can matter more than a single isolated severity label. For requirement (2), Trend assessment requires stable coverage and explicit outcomes, not only one dashboard snapshot. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (2) is not met: Trend assessment requires stable coverage and explicit outcomes, not only one dashboard snapshot. The substituted action is instead for this different case: Two teams independently patch the same low-impact issue while a high-risk identity-to-server path remains open. The proposed bundle therefore cannot satisfy BOTH stated requirements.
B:Requirement (1) is not met: Reachability to privileged resources can matter more than a single isolated severity label. The substituted action is instead for this different case: The exposure team treats every modeled attack path as evidence that an adversary has already traversed it. Requirement (2) is not met: Trend assessment requires stable coverage and explicit outcomes, not only one dashboard snapshot. The substituted action is instead for this different case: Two teams independently patch the same low-impact issue while a high-risk identity-to-server path remains open. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: Reachability to privileged resources can matter more than a single isolated severity label. The substituted action is instead for this different case: The exposure team treats every modeled attack path as evidence that an adversary has already traversed it. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 565
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A security engineer needs elevated directory permissions for one maintenance window but currently holds them permanently. (2) A former contractor remains eligible for Global Administrator role activation months after their project ends. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Configure approval and justification in the applicable PIM activation policy. | (2) Use PIM activation and directory audit history to reconstruct the elevation timeline.
- (1) Use Entra Privileged Identity Management eligible assignments with time-bounded activation. | (2) Review PIM eligibility periodically and revoke assignments without current business sponsorship.
- (1) Configure approval and justification in the applicable PIM activation policy. | (2) Review PIM eligibility periodically and revoke assignments without current business sponsorship.
- (1) Use Entra Privileged Identity Management eligible assignments with time-bounded activation. | (2) Use PIM activation and directory audit history to reconstruct the elevation timeline.
Explanation
Correct Answer
B:For requirement (1), Just-in-time privilege limits the duration of sensitive access while retaining a verifiable activation record. For requirement (2), Eligible assignments are still an access risk even when not activated. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (1) is not met: Just-in-time privilege limits the duration of sensitive access while retaining a verifiable activation record. The substituted action is instead for this different case: A privileged role activation proceeds without approval even though high-impact changes require a second person. Requirement (2) is not met: Eligible assignments are still an access risk even when not activated. The substituted action is instead for this different case: The SOC cannot identify who activated a privileged role just before suspicious tenant configuration changes. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (1) is not met: Just-in-time privilege limits the duration of sensitive access while retaining a verifiable activation record. The substituted action is instead for this different case: A privileged role activation proceeds without approval even though high-impact changes require a second person. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (2) is not met: Eligible assignments are still an access risk even when not activated. The substituted action is instead for this different case: The SOC cannot identify who activated a privileged role just before suspicious tenant configuration changes. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 566
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A retrieval AI assistant indexes confidential board documents for all employees without honoring SharePoint permissions. (2) A model training job copies regulated customer records into a globally shared temporary storage account. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Enforce user-context data authorization before returning retrieved passages to the model. | (2) Limit AI prompt telemetry, mask sensitive fields and enforce approved retention and audit permissions.
- (1) Design prompt-injection defenses with explicit tool permission and output-data boundaries. | (2) Limit AI prompt telemetry, mask sensitive fields and enforce approved retention and audit permissions.
- (1) Enforce user-context data authorization before returning retrieved passages to the model. | (2) Apply data minimization, restricted processing locations and controlled storage to training datasets.
- (1) Design prompt-injection defenses with explicit tool permission and output-data boundaries. | (2) Apply data minimization, restricted processing locations and controlled storage to training datasets.
Explanation
Correct Answer
C:For requirement (1), AI retrieval must not elevate the caller's rights to indexed content. For requirement (2), AI development pipelines require the same confidentiality and residency safeguards as production systems. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (2) is not met: AI development pipelines require the same confidentiality and residency safeguards as production systems. The substituted action is instead for this different case: A generative AI team logs raw confidential prompts for debugging but cannot define who is permitted to access them. The proposed bundle therefore cannot satisfy BOTH stated requirements.
B:Requirement (1) is not met: AI retrieval must not elevate the caller's rights to indexed content. The substituted action is instead for this different case: A prompt contains untrusted instructions telling a tool-using model to disclose the full hidden customer dataset. Requirement (2) is not met: AI development pipelines require the same confidentiality and residency safeguards as production systems. The substituted action is instead for this different case: A generative AI team logs raw confidential prompts for debugging but cannot define who is permitted to access them. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: AI retrieval must not elevate the caller's rights to indexed content. The substituted action is instead for this different case: A prompt contains untrusted instructions telling a tool-using model to disclose the full hidden customer dataset. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 567
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) The security team knows internal IP addresses but not the public domains and hosts registered by acquired subsidiaries. (2) An externally accessible test API contains a stale authentication endpoint, but no business owner is listed. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Use Defender External Attack Surface Management discovery to inventory internet-visible assets. | (2) Link discovered internet-facing assets to application owners and prioritize exposed authentication surfaces.
- (1) Validate attribution and ownership before treating discovered infrastructure as an enterprise asset. | (2) Link discovered internet-facing assets to application owners and prioritize exposed authentication surfaces.
- (1) Use Defender External Attack Surface Management discovery to inventory internet-visible assets. | (2) Reconcile EASM findings with decommissioning and verify public DNS and hosting retirement.
- (1) Validate attribution and ownership before treating discovered infrastructure as an enterprise asset. | (2) Reconcile EASM findings with decommissioning and verify public DNS and hosting retirement.
Explanation
Correct Answer
A:For requirement (1), External discovery reveals assets beyond known internal CMDB entries. For requirement (2), Unknown ownership delays remediation of publicly reachable sensitive interfaces. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
B:Requirement (1) is not met: External discovery reveals assets beyond known internal CMDB entries. The substituted action is instead for this different case: An exposure report shows an unknown domain and administrators assume the organization owns it. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (2) is not met: Unknown ownership delays remediation of publicly reachable sensitive interfaces. The substituted action is instead for this different case: A business removes a legacy service but external scanners still find the previous endpoint. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: External discovery reveals assets beyond known internal CMDB entries. The substituted action is instead for this different case: An exposure report shows an unknown domain and administrators assume the organization owns it. Requirement (2) is not met: Unknown ownership delays remediation of publicly reachable sensitive interfaces. The substituted action is instead for this different case: A business removes a legacy service but external scanners still find the previous endpoint. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 568
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) On-premises Linux servers are excluded from Azure inventory and policy compliance checks. (2) A Linux estate appears Arc-connected but security extensions are missing on half the servers. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Connect eligible non-Azure machines using Azure Arc-enabled servers and approved onboarding methods. | (2) Confirm feature support and shared operational responsibilities for Arc-enabled non-Azure servers.
- (1) Use a controlled onboarding identity and rotate bootstrap credentials with least-privilege permissions. | (2) Confirm feature support and shared operational responsibilities for Arc-enabled non-Azure servers.
- (1) Connect eligible non-Azure machines using Azure Arc-enabled servers and approved onboarding methods. | (2) Validate desired extension deployment and policy compliance across Arc-enabled resource groups.
- (1) Use a controlled onboarding identity and rotate bootstrap credentials with least-privilege permissions. | (2) Validate desired extension deployment and policy compliance across Arc-enabled resource groups.
Explanation
Correct Answer
C:For requirement (1), Azure Arc can expose supported external machines to Azure governance and security integrations. For requirement (2), Registration alone does not prove that each required protection component is installed. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (2) is not met: Registration alone does not prove that each required protection component is installed. The substituted action is instead for this different case: An application team assumes Arc-enabled machines automatically become full Azure virtual machines for every control. The proposed bundle therefore cannot satisfy BOTH stated requirements.
B:Requirement (1) is not met: Azure Arc can expose supported external machines to Azure governance and security integrations. The substituted action is instead for this different case: An Arc deployment script embeds a long-lived tenant secret with unrestricted resource creation rights. Requirement (2) is not met: Registration alone does not prove that each required protection component is installed. The substituted action is instead for this different case: An application team assumes Arc-enabled machines automatically become full Azure virtual machines for every control. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: Azure Arc can expose supported external machines to Azure governance and security integrations. The substituted action is instead for this different case: An Arc deployment script embeds a long-lived tenant secret with unrestricted resource creation rights. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 569
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) An enterprise compares two security tool purchases without first defining which identity, network and data threats must be covered. (2) A regional team wants to deploy controls without identifying the owner responsible for operating them. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Map security requirements to Microsoft Cybersecurity Reference Architectures capabilities before selecting products. | (2) Assign control owners, measurable assurance evidence and escalation paths for each architecture capability.
- (1) Design defense in depth with distinct controls across identities, devices, applications, network and data. | (2) Assign control owners, measurable assurance evidence and escalation paths for each architecture capability.
- (1) Map security requirements to Microsoft Cybersecurity Reference Architectures capabilities before selecting products. | (2) Extend trust-boundary diagrams to cover both organizations and their cross-tenant connections.
- (1) Design defense in depth with distinct controls across identities, devices, applications, network and data. | (2) Extend trust-boundary diagrams to cover both organizations and their cross-tenant connections.
Explanation
Correct Answer
A:For requirement (1), Capability mapping exposes gaps and dependencies independently of product branding. For requirement (2), Control ownership makes an architectural recommendation maintainable and auditable after rollout. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
B:Requirement (1) is not met: Capability mapping exposes gaps and dependencies independently of product branding. The substituted action is instead for this different case: A program proposes one global firewall as a substitute for application, identity and data security controls. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (2) is not met: Control ownership makes an architectural recommendation maintainable and auditable after rollout. The substituted action is instead for this different case: A merger introduces a new cloud estate but the reference architecture has not mapped its administrative trust boundaries. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: Capability mapping exposes gaps and dependencies independently of product branding. The substituted action is instead for this different case: A program proposes one global firewall as a substitute for application, identity and data security controls. Requirement (2) is not met: Control ownership makes an architectural recommendation maintainable and auditable after rollout. The substituted action is instead for this different case: A merger introduces a new cloud estate but the reference architecture has not mapped its administrative trust boundaries. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 570
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) Developers deploy container images directly from an unverified personal registry into production. (2) A team scans source code but never examines third-party packages shipped in the final container image. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Apply least-privilege container runtime settings and eliminate unnecessary host access. | (2) Include image and dependency scanning for the exact release artifact.
- (1) Require trusted registry sources, image vulnerability checks and provenance verification. | (2) Add supported container runtime detection and managed-cluster threat protection.
- (1) Apply least-privilege container runtime settings and eliminate unnecessary host access. | (2) Add supported container runtime detection and managed-cluster threat protection.
- (1) Require trusted registry sources, image vulnerability checks and provenance verification. | (2) Include image and dependency scanning for the exact release artifact.
Explanation
Correct Answer
D:For requirement (1), Secure container supply chains need confidence in artifact origin and content. For requirement (2), The deployed container can contain vulnerable components absent from source scans. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (1) is not met: Secure container supply chains need confidence in artifact origin and content. The substituted action is instead for this different case: A pod runs as a privileged root container with host filesystem mounts for routine application logging. The proposed bundle therefore cannot satisfy BOTH stated requirements.
B:Requirement (2) is not met: The deployed container can contain vulnerable components absent from source scans. The substituted action is instead for this different case: Runtime detections are missing for workloads in a managed Kubernetes cluster despite completed image scanning. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (1) is not met: Secure container supply chains need confidence in artifact origin and content. The substituted action is instead for this different case: A pod runs as a privileged root container with host filesystem mounts for routine application logging. Requirement (2) is not met: The deployed container can contain vulnerable components absent from source scans. The substituted action is instead for this different case: Runtime detections are missing for workloads in a managed Kubernetes cluster despite completed image scanning. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Microsoft Cybersecurity Architect (SC-100) Practice Tests