Question 600
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A Defender posture report shows hundreds of failed checks but the team lacks a risk-ranked remediation plan. (2) A compliance analyst compares two tenants' Secure Scores without considering different product licenses and monitored assets. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Define time-limited compensating controls and a verified service-safe patch schedule. | (2) Normalize posture comparisons for coverage, eligibility and differing assessed resource populations.
- (1) Sequence fixes by exploitability, business impact and protected resource criticality. | (2) Verify observed effective configuration and assessment refresh before closing the recommendation.
- (1) Define time-limited compensating controls and a verified service-safe patch schedule. | (2) Verify observed effective configuration and assessment refresh before closing the recommendation.
- (1) Sequence fixes by exploitability, business impact and protected resource criticality. | (2) Normalize posture comparisons for coverage, eligibility and differing assessed resource populations.
Explanation
Correct Answer
D:For requirement (1), Prioritized mitigation directs effort to meaningful exposure rather than check counts. For requirement (2), Raw scores are not equivalent when their denominators and controls differ. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (1) is not met: Prioritized mitigation directs effort to meaningful exposure rather than check counts. The substituted action is instead for this different case: An application cannot immediately apply a required patch because its availability architecture has no maintenance window. The proposed bundle therefore cannot satisfy BOTH stated requirements.
B:Requirement (2) is not met: Raw scores are not equivalent when their denominators and controls differ. The substituted action is instead for this different case: A security recommendation remains unresolved after the repair team claims the fix was applied. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (1) is not met: Prioritized mitigation directs effort to meaningful exposure rather than check counts. The substituted action is instead for this different case: An application cannot immediately apply a required patch because its availability architecture has no maintenance window. Requirement (2) is not met: Raw scores are not equivalent when their denominators and controls differ. The substituted action is instead for this different case: A security recommendation remains unresolved after the repair team claims the fix was applied. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 601
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A cloud function processes device telemetry without validating which device supplied a command message. (2) An edge gateway caches sensitive sensor data indefinitely after devices are retired. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Authenticate senders and validate command authorization and schema at the IoT service boundary. | (2) Define edge-data encryption, retention and secure wipe requirements for IoT decommissioning.
- (1) Provision per-device identities and revoke individual compromised devices without changing all peers. | (2) Define edge-data encryption, retention and secure wipe requirements for IoT decommissioning.
- (1) Authenticate senders and validate command authorization and schema at the IoT service boundary. | (2) Require signed firmware artifacts and restricted update distribution with rollback safeguards.
- (1) Provision per-device identities and revoke individual compromised devices without changing all peers. | (2) Require signed firmware artifacts and restricted update distribution with rollback safeguards.
Explanation
Correct Answer
A:For requirement (1), Ingestion connectivity does not imply that every source can issue operational commands. For requirement (2), Device lifecycle includes safeguarding residual local data and credentials. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
B:Requirement (1) is not met: Ingestion connectivity does not imply that every source can issue operational commands. The substituted action is instead for this different case: IoT devices authenticate to a cloud hub using one credential shared by the full fleet. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (2) is not met: Device lifecycle includes safeguarding residual local data and credentials. The substituted action is instead for this different case: A firmware update service accepts unsigned update packages from a writable public bucket. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: Ingestion connectivity does not imply that every source can issue operational commands. The substituted action is instead for this different case: IoT devices authenticate to a cloud hub using one credential shared by the full fleet. Requirement (2) is not met: Device lifecycle includes safeguarding residual local data and credentials. The substituted action is instead for this different case: A firmware update service accepts unsigned update packages from a writable public bucket. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 602
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A multicloud team reuses one shared cloud administrator password across AWS and Azure consoles. (2) The team moves user objects between source OUs without assessing deletion effects in the cloud directory. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Define authoritative identity source and matching rules before enabling hybrid provisioning. | (2) Design supported redundant provisioning agents and monitor synchronization health.
- (1) Federate workload administration to governed identities and enforce provider-specific least privilege. | (2) Validate synchronization scope changes and accidental-delete protections before exporting.
- (1) Define authoritative identity source and matching rules before enabling hybrid provisioning. | (2) Validate synchronization scope changes and accidental-delete protections before exporting.
- (1) Federate workload administration to governed identities and enforce provider-specific least privilege. | (2) Design supported redundant provisioning agents and monitor synchronization health.
Explanation
Correct Answer
B:For requirement (1), Unified sign-in need not mean one shared standing administrator credential. For requirement (2), Moving objects out of scope can trigger unintentional cloud deprovisioning. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (1) is not met: Unified sign-in need not mean one shared standing administrator credential. The substituted action is instead for this different case: A hybrid organization creates cloud identities independently of local AD and users appear twice after synchronization. Requirement (2) is not met: Moving objects out of scope can trigger unintentional cloud deprovisioning. The substituted action is instead for this different case: A Cloud Sync design omits agent redundancy even though on-premises directory provisioning is business-critical. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (1) is not met: Unified sign-in need not mean one shared standing administrator credential. The substituted action is instead for this different case: A hybrid organization creates cloud identities independently of local AD and users appear twice after synchronization. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (2) is not met: Moving objects out of scope can trigger unintentional cloud deprovisioning. The substituted action is instead for this different case: A Cloud Sync design omits agent redundancy even though on-premises directory provisioning is business-critical. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 603
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) The audit team mistakes a green Defender for Cloud regulatory dashboard for a guarantee of legal compliance. (2) A control's compliance state changes after the security team modifies its underlying cloud policy but never reviews effects. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Validate manual procedures, application responsibilities and excluded assets alongside automated assessments. | (2) Design eligible Defender for Cloud multicloud connectors and verify assessment coverage per account.
- (1) Evaluate Defender for Cloud regulatory compliance standards and their mapped assessment evidence. | (2) Design eligible Defender for Cloud multicloud connectors and verify assessment coverage per account.
- (1) Validate manual procedures, application responsibilities and excluded assets alongside automated assessments. | (2) Track compliance trends and reassess benchmark mapping after changes to policy or resource scope.
- (1) Evaluate Defender for Cloud regulatory compliance standards and their mapped assessment evidence. | (2) Track compliance trends and reassess benchmark mapping after changes to policy or resource scope.
Explanation
Correct Answer
C:For requirement (1), Technical posture evidence cannot prove every organizational and legal obligation. For requirement (2), Control evaluation results depend on the active baseline and monitored inventory. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (2) is not met: Control evaluation results depend on the active baseline and monitored inventory. The substituted action is instead for this different case: A multicloud program needs comparable cloud-security assessments across AWS and Azure but has only onboarded Azure. The proposed bundle therefore cannot satisfy BOTH stated requirements.
B:Requirement (1) is not met: Technical posture evidence cannot prove every organizational and legal obligation. The substituted action is instead for this different case: A bank wants a view of cloud resources aligned to a particular benchmark across Azure subscriptions. Requirement (2) is not met: Control evaluation results depend on the active baseline and monitored inventory. The substituted action is instead for this different case: A multicloud program needs comparable cloud-security assessments across AWS and Azure but has only onboarded Azure. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: Technical posture evidence cannot prove every organizational and legal obligation. The substituted action is instead for this different case: A bank wants a view of cloud resources aligned to a particular benchmark across Azure subscriptions. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 604
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A critical financial workload is restored but no one compares its ledger balance to the last trusted state. (2) A site failover test reports success because a VM boots, yet user authentication and dependent APIs remain inaccessible. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Validate backup recovery points and restore in an isolated clean environment before reconnecting workloads. | (2) Coordinate forensic preservation and priority restoration using segregated evidence and recovery environments.
- (1) Add business reconciliation and integrity checks before declaring financial service recovery complete. | (2) Define end-to-end application recovery acceptance tests including identity, network and dependent service calls.
- (1) Validate backup recovery points and restore in an isolated clean environment before reconnecting workloads. | (2) Define end-to-end application recovery acceptance tests including identity, network and dependent service calls.
- (1) Add business reconciliation and integrity checks before declaring financial service recovery complete. | (2) Coordinate forensic preservation and priority restoration using segregated evidence and recovery environments.
Explanation
Correct Answer
B:For requirement (1), Infrastructure availability does not prove transaction completeness or correctness after rollback. For requirement (2), A virtual machine startup alone cannot validate an end-user recovery objective. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (1) is not met: Infrastructure availability does not prove transaction completeness or correctness after rollback. The substituted action is instead for this different case: Backups contain executable images from the period when attackers already had domain administrator access. Requirement (2) is not met: A virtual machine startup alone cannot validate an end-user recovery objective. The substituted action is instead for this different case: The SOC wants to preserve forensic evidence while operations teams demand an immediate full wipe of affected systems. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (1) is not met: Infrastructure availability does not prove transaction completeness or correctness after rollback. The substituted action is instead for this different case: Backups contain executable images from the period when attackers already had domain administrator access. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (2) is not met: A virtual machine startup alone cannot validate an end-user recovery objective. The substituted action is instead for this different case: The SOC wants to preserve forensic evidence while operations teams demand an immediate full wipe of affected systems. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 605
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A cloud storage backup exists but no administrator has successfully restored a sample application. (2) A hybrid estate needs protection from a cloud-region failure while avoiding backups confined to that same region. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Schedule integrity-checked recovery tests that measure actual restore time and application consistency. | (2) Place recovery data in approved geographically independent locations and validate regional-failover dependencies.
- (1) Design isolated, access-restricted and immutable backup copies with independent administration. | (2) Place recovery data in approved geographically independent locations and validate regional-failover dependencies.
- (1) Schedule integrity-checked recovery tests that measure actual restore time and application consistency. | (2) Specify independent backup and restoration controls in addition to legal retention enforcement.
- (1) Design isolated, access-restricted and immutable backup copies with independent administration. | (2) Specify independent backup and restoration controls in addition to legal retention enforcement.
Explanation
Correct Answer
A:For requirement (1), Backup job success cannot establish that the protected data can be restored within the declared recovery time. For requirement (2), Regional fault isolation requires recovery resources that do not share the unavailable location's failure domain. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
B:Requirement (1) is not met: Backup job success cannot establish that the protected data can be restored within the declared recovery time. The substituted action is instead for this different case: A company stores daily backups under the same highly privileged credentials as production and ransomware encrypts both. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (2) is not met: Regional fault isolation requires recovery resources that do not share the unavailable location's failure domain. The substituted action is instead for this different case: A legal records system has a five-year retention policy, and its owner assumes that policy is equivalent to point-in-time backups. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: Backup job success cannot establish that the protected data can be restored within the declared recovery time. The substituted action is instead for this different case: A company stores daily backups under the same highly privileged credentials as production and ransomware encrypts both. Requirement (2) is not met: Regional fault isolation requires recovery resources that do not share the unavailable location's failure domain. The substituted action is instead for this different case: A legal records system has a five-year retention policy, and its owner assumes that policy is equivalent to point-in-time backups. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 606
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) An organization deploys Copilot without deciding whether confidential prompts and generated responses belong in its DLP scope. (2) A security architect cannot explain which user actions and protected data sources Copilot accessed during an incident. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Remediate excessive SharePoint and Microsoft 365 content permissions before broad Copilot rollout. | (2) Design supported Copilot audit and activity-monitoring evidence with privacy-aware access.
- (1) Evaluate supported Microsoft Purview DLP and information-protection controls for Copilot interactions. | (2) Separate AI content safety from underlying data permission and labeling governance.
- (1) Remediate excessive SharePoint and Microsoft 365 content permissions before broad Copilot rollout. | (2) Separate AI content safety from underlying data permission and labeling governance.
- (1) Evaluate supported Microsoft Purview DLP and information-protection controls for Copilot interactions. | (2) Design supported Copilot audit and activity-monitoring evidence with privacy-aware access.
Explanation
Correct Answer
D:For requirement (1), AI workflows require product-specific data protection scope rather than assuming email-only rules apply. For requirement (2), Investigations require traceability while restricting access to sensitive interaction logs. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (1) is not met: AI workflows require product-specific data protection scope rather than assuming email-only rules apply. The substituted action is instead for this different case: A Copilot user can summarize files the organization did not intend to share because SharePoint site permissions are broad. The proposed bundle therefore cannot satisfy BOTH stated requirements.
B:Requirement (2) is not met: Investigations require traceability while restricting access to sensitive interaction logs. The substituted action is instead for this different case: A compliance board assumes prompt safety filters prevent leakage from an over-permissioned document corpus. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (1) is not met: AI workflows require product-specific data protection scope rather than assuming email-only rules apply. The substituted action is instead for this different case: A Copilot user can summarize files the organization did not intend to share because SharePoint site permissions are broad. Requirement (2) is not met: Investigations require traceability while restricting access to sensitive interaction logs. The substituted action is instead for this different case: A compliance board assumes prompt safety filters prevent leakage from an over-permissioned document corpus. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 607
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A service certificate expires and causes an identity federation outage across the enterprise. (2) A multicloud application shares the same encryption key material broadly between unrelated environments. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Establish certificate inventory, expiry monitoring and tested renewal procedures for trust-critical services. | (2) Define independent keys, access scopes and rotation policies per workload and trust boundary.
- (1) Use Azure Key Vault or an equivalent managed secret service with controlled rotation and access policies. | (2) Define independent keys, access scopes and rotation policies per workload and trust boundary.
- (1) Establish certificate inventory, expiry monitoring and tested renewal procedures for trust-critical services. | (2) Evaluate managed or hardware-protected key custody with separate key administration roles.
- (1) Use Azure Key Vault or an equivalent managed secret service with controlled rotation and access policies. | (2) Evaluate managed or hardware-protected key custody with separate key administration roles.
Explanation
Correct Answer
A:For requirement (1), Certificate lifecycle is an availability dependency of cryptographic trust. For requirement (2), Distinct cryptographic domains prevent one breach from revealing unrelated protected data. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
B:Requirement (1) is not met: Certificate lifecycle is an availability dependency of cryptographic trust. The substituted action is instead for this different case: A cloud application stores long-lived client secrets in a code repository and rotates them only when employees leave. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (2) is not met: Distinct cryptographic domains prevent one breach from revealing unrelated protected data. The substituted action is instead for this different case: A workload needs cryptographic operations while the application operators must not be able to export the master key. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: Certificate lifecycle is an availability dependency of cryptographic trust. The substituted action is instead for this different case: A cloud application stores long-lived client secrets in a code repository and rotates them only when employees leave. Requirement (2) is not met: Distinct cryptographic domains prevent one breach from revealing unrelated protected data. The substituted action is instead for this different case: A workload needs cryptographic operations while the application operators must not be able to export the master key. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 608
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A project manager approves access packages but cannot determine who still has access when a project closes. (2) A sensitive application allows broad guest onboarding with no evidence of who approved the initial grant. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Use access packages with approval, expiration and review controls where supported. | (2) Require approval records and access-package ownership for external resource entitlements.
- (1) Schedule sponsor-backed access reviews and remove no-longer-justified assignments. | (2) Inventory direct, group-based and application grants when evaluating effective access.
- (1) Use access packages with approval, expiration and review controls where supported. | (2) Inventory direct, group-based and application grants when evaluating effective access.
- (1) Schedule sponsor-backed access reviews and remove no-longer-justified assignments. | (2) Require approval records and access-package ownership for external resource entitlements.
Explanation
Correct Answer
D:For requirement (1), Periodic attestation identifies permissions that outlive their original purpose. For requirement (2), Authorization should be tied to a named sponsor and approved business need. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (1) is not met: Periodic attestation identifies permissions that outlive their original purpose. The substituted action is instead for this different case: External employees receive SharePoint and app grants through many manual requests without expiry dates. The proposed bundle therefore cannot satisfy BOTH stated requirements.
B:Requirement (2) is not met: Authorization should be tied to a named sponsor and approved business need. The substituted action is instead for this different case: A group owner assumes removal from a Teams channel automatically revokes every separate application assignment. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (1) is not met: Periodic attestation identifies permissions that outlive their original purpose. The substituted action is instead for this different case: External employees receive SharePoint and app grants through many manual requests without expiry dates. Requirement (2) is not met: Authorization should be tied to a named sponsor and approved business need. The substituted action is instead for this different case: A group owner assumes removal from a Teams channel automatically revokes every separate application assignment. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 609
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) An application connector is deployed in only one location and becomes unavailable during routine maintenance. (2) A team migrates from VPN and assumes private access removes the need for server-side authorization. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Design supported connector redundancy and verify private application availability during failure. | (2) Keep backend application authentication and resource permission checks under the Private Access architecture.
- (1) Evaluate Microsoft Entra Private Access with published application segments and scoped user grants. | (2) Keep backend application authentication and resource permission checks under the Private Access architecture.
- (1) Design supported connector redundancy and verify private application availability during failure. | (2) Validate private access app segments, DNS resolution and forwarding policy for the target.
- (1) Evaluate Microsoft Entra Private Access with published application segments and scoped user grants. | (2) Validate private access app segments, DNS resolution and forwarding policy for the target.
Explanation
Correct Answer
A:For requirement (1), Private access depends on healthy connectors and backend reachability. For requirement (2), Network path authorization complements but does not replace app-level access control. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
B:Requirement (1) is not met: Private access depends on healthy connectors and backend reachability. The substituted action is instead for this different case: Employees need access to an internal application without being connected to a broad network-level VPN. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (2) is not met: Network path authorization complements but does not replace app-level access control. The substituted action is instead for this different case: A private app is published but an authorized user cannot reach its service hostname through the client. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: Private access depends on healthy connectors and backend reachability. The substituted action is instead for this different case: Employees need access to an internal application without being connected to a broad network-level VPN. Requirement (2) is not met: Network path authorization complements but does not replace app-level access control. The substituted action is instead for this different case: A private app is published but an authorized user cannot reach its service hostname through the client. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 610
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A network team proposes exempting all Teams traffic from every security control to resolve poor call quality. (2) A Microsoft 365 compliance dashboard shows no incidents, but several workloads are not licensed or connected for security signals. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Design Microsoft 365 network optimization alongside appropriate identity and data security policies. | (2) Verify monitoring coverage and telemetry health before interpreting low alert counts as low risk.
- (1) Correlate Office 365 detections with Defender XDR cross-workload incidents. | (2) Verify monitoring coverage and telemetry health before interpreting low alert counts as low risk.
- (1) Design Microsoft 365 network optimization alongside appropriate identity and data security policies. | (2) Implement guest lifecycle and sponsor-backed entitlement reviews across supported workloads.
- (1) Correlate Office 365 detections with Defender XDR cross-workload incidents. | (2) Implement guest lifecycle and sponsor-backed entitlement reviews across supported workloads.
Explanation
Correct Answer
A:For requirement (1), Performance optimization should not eliminate resource authorization or protection. For requirement (2), Missing detection evidence cannot prove the environment is safe because unmonitored services may conceal otherwise detectable threats. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
B:Requirement (1) is not met: Performance optimization should not eliminate resource authorization or protection. The substituted action is instead for this different case: A SOC investigates user phishing incidents without checking related endpoint and identity alerts. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (2) is not met: Missing detection evidence cannot prove the environment is safe because unmonitored services may conceal otherwise detectable threats. The substituted action is instead for this different case: A tenant allows external collaboration but no one reviews guests after their projects end. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: Performance optimization should not eliminate resource authorization or protection. The substituted action is instead for this different case: A SOC investigates user phishing incidents without checking related endpoint and identity alerts. Requirement (2) is not met: Missing detection evidence cannot prove the environment is safe because unmonitored services may conceal otherwise detectable threats. The substituted action is instead for this different case: A tenant allows external collaboration but no one reviews guests after their projects end. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Microsoft Cybersecurity Architect (SC-100) Practice Tests