Question 620
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) An incident commander suspends a compromised administrator but leaves an active privileged cloud session untouched. (2) A security team wants to test emergency access without leaving a highly privileged account active in daily workflows. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Revoke and rotate the exposed credential, then investigate its use and effective grants. | (2) Correlate role audit events to approvals and investigate unexplained elevation.
- (1) Revoke active sessions and review delegated app tokens in addition to disabling the account. | (2) Rehearse emergency access under controlled monitoring and document safe credential custody.
- (1) Revoke and rotate the exposed credential, then investigate its use and effective grants. | (2) Rehearse emergency access under controlled monitoring and document safe credential custody.
- (1) Revoke active sessions and review delegated app tokens in addition to disabling the account. | (2) Correlate role audit events to approvals and investigate unexplained elevation.
Explanation
Correct Answer
B:For requirement (1), Session containment may require actions beyond account state changes. For requirement (2), Recovery readiness depends on tested access and careful operational protection. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (1) is not met: Session containment may require actions beyond account state changes. The substituted action is instead for this different case: A high-privilege application credential appears in a public repository and the response team plans only to delete the commit. Requirement (2) is not met: Recovery readiness depends on tested access and careful operational protection. The substituted action is instead for this different case: A security review finds administrative role changes with no change ticket or recorded business purpose. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (1) is not met: Session containment may require actions beyond account state changes. The substituted action is instead for this different case: A high-privilege application credential appears in a public repository and the response team plans only to delete the commit. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (2) is not met: Recovery readiness depends on tested access and careful operational protection. The substituted action is instead for this different case: A security review finds administrative role changes with no change ticket or recorded business purpose. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 621
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) An external attacker obtains one employee password and can access several administrative interfaces without a new check. (2) A supply-chain incident compromises a trusted vendor integration that has tenant-wide API permissions. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Combine least-privilege data roles, sensitive-data monitoring and governed exfiltration controls. | (2) Scope third-party application permissions and establish rapid revocation and monitoring of delegated grants.
- (1) Design phishing-resistant MFA and context-aware Conditional Access for sensitive operations. | (2) Implement time-bound entitlements with periodic access reviews and automatic deprovisioning.
- (1) Combine least-privilege data roles, sensitive-data monitoring and governed exfiltration controls. | (2) Implement time-bound entitlements with periodic access reviews and automatic deprovisioning.
- (1) Design phishing-resistant MFA and context-aware Conditional Access for sensitive operations. | (2) Scope third-party application permissions and establish rapid revocation and monitoring of delegated grants.
Explanation
Correct Answer
D:For requirement (1), Strong authentication and risk evaluation limit credential replay across privileged surfaces. For requirement (2), Vendor compromise impact depends on the permissions and persistence granted to the integration. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (1) is not met: Strong authentication and risk evaluation limit credential replay across privileged surfaces. The substituted action is instead for this different case: A privileged insider can export an entire regulated dataset despite only needing aggregate reports. The proposed bundle therefore cannot satisfy BOTH stated requirements.
B:Requirement (2) is not met: Vendor compromise impact depends on the permissions and persistence granted to the integration. The substituted action is instead for this different case: A contractor's access remains active after their approved business engagement ends. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (1) is not met: Strong authentication and risk evaluation limit credential replay across privileged surfaces. The substituted action is instead for this different case: A privileged insider can export an entire regulated dataset despite only needing aggregate reports. Requirement (2) is not met: Vendor compromise impact depends on the permissions and persistence granted to the integration. The substituted action is instead for this different case: A contractor's access remains active after their approved business engagement ends. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 622
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A scheduled job authenticates with a certificate embedded inside a container image copied to every environment. (2) A service-to-service request succeeds with an OAuth token that belongs to the wrong audience. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Grant its managed identity scoped Azure RBAC for the required storage data operations. | (2) Design supported workload identity federation and Key Vault data permissions for that pod.
- (1) Move workload authentication to supported federated credentials or managed identity with controlled rotation. | (2) Validate token audience, issuer and intended resource authorization in the application trust design.
- (1) Grant its managed identity scoped Azure RBAC for the required storage data operations. | (2) Validate token audience, issuer and intended resource authorization in the application trust design.
- (1) Move workload authentication to supported federated credentials or managed identity with controlled rotation. | (2) Design supported workload identity federation and Key Vault data permissions for that pod.
Explanation
Correct Answer
B:For requirement (1), Image distribution must not spread persistent private keys across deployments. For requirement (2), A valid token for one API does not authorize access to a different service. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (1) is not met: Image distribution must not spread persistent private keys across deployments. The substituted action is instead for this different case: An Azure Function needs to read a single storage container but currently stores the account access key. Requirement (2) is not met: A valid token for one API does not authorize access to a different service. The substituted action is instead for this different case: A Kubernetes pod receives cluster admin privileges to access one Azure Key Vault secret. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (1) is not met: Image distribution must not spread persistent private keys across deployments. The substituted action is instead for this different case: An Azure Function needs to read a single storage container but currently stores the account access key. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (2) is not met: A valid token for one API does not authorize access to a different service. The substituted action is instead for this different case: A Kubernetes pod receives cluster admin privileges to access one Azure Key Vault secret. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 623
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) Employees often click links that become malicious after a message was delivered. (2) A SOC can identify malicious email but lacks a governed process to remove matching messages from other mailboxes. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Design targeted anti-phishing impersonation protection using Defender for Office 365. | (2) Design approved Threat Explorer investigation and scoped post-delivery remediation workflows.
- (1) Include Defender for Office 365 Safe Links time-of-click protection for eligible workloads. | (2) Evaluate Safe Attachments detonation and disposition policy for protected recipient groups.
- (1) Design targeted anti-phishing impersonation protection using Defender for Office 365. | (2) Evaluate Safe Attachments detonation and disposition policy for protected recipient groups.
- (1) Include Defender for Office 365 Safe Links time-of-click protection for eligible workloads. | (2) Design approved Threat Explorer investigation and scoped post-delivery remediation workflows.
Explanation
Correct Answer
D:For requirement (1), URL risk can change between delivery and user interaction, so click-time inspection provides a separate protection opportunity. For requirement (2), Campaign-level investigation should lead to controlled response across actual affected recipients. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (1) is not met: URL risk can change between delivery and user interaction, so click-time inspection provides a separate protection opportunity. The substituted action is instead for this different case: A financial services tenant receives executive impersonation messages and only basic bulk-spam filtering is configured. The proposed bundle therefore cannot satisfy BOTH stated requirements.
B:Requirement (2) is not met: Campaign-level investigation should lead to controlled response across actual affected recipients. The substituted action is instead for this different case: The organization requires suspicious attachments analyzed before employees open them. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (1) is not met: URL risk can change between delivery and user interaction, so click-time inspection provides a separate protection opportunity. The substituted action is instead for this different case: A financial services tenant receives executive impersonation messages and only basic bulk-spam filtering is configured. Requirement (2) is not met: Campaign-level investigation should lead to controlled response across actual affected recipients. The substituted action is instead for this different case: The organization requires suspicious attachments analyzed before employees open them. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 624
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A reimaged laptop appears under three device records and skews threat inventory counts. (2) A client malware alert is closed when the process exits but persistence tasks remain installed. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Design containment verification and an alternate response path for unreachable devices. | (2) Alert on missing sensor check-in and integrity anomalies as security signals.
- (1) Reconcile device identities and retire stale endpoint records using supported lifecycle procedures. | (2) Define remediation verification that inspects persistence and related credential compromise.
- (1) Design containment verification and an alternate response path for unreachable devices. | (2) Define remediation verification that inspects persistence and related credential compromise.
- (1) Reconcile device identities and retire stale endpoint records using supported lifecycle procedures. | (2) Alert on missing sensor check-in and integrity anomalies as security signals.
Explanation
Correct Answer
B:For requirement (1), Accurate inventory is required for meaningful exposure and coverage metrics. For requirement (2), A stopped process does not prove a threat is fully eradicated if persistence mechanisms and related identities remain compromised. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (1) is not met: Accurate inventory is required for meaningful exposure and coverage metrics. The substituted action is instead for this different case: A SOC tries to isolate a compromised endpoint but the device has been offline since yesterday. Requirement (2) is not met: A stopped process does not prove a threat is fully eradicated if persistence mechanisms and related identities remain compromised. The substituted action is instead for this different case: An attacker disables endpoint telemetry, and the operations team interprets no alerts as no compromise. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (1) is not met: Accurate inventory is required for meaningful exposure and coverage metrics. The substituted action is instead for this different case: A SOC tries to isolate a compromised endpoint but the device has been offline since yesterday. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (2) is not met: A stopped process does not prove a threat is fully eradicated if persistence mechanisms and related identities remain compromised. The substituted action is instead for this different case: An attacker disables endpoint telemetry, and the operations team interprets no alerts as no compromise. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 625
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A vendor engagement ends, but B2B guest users remain members of multiple security groups. (2) A security architect assumes that verification of an external credential automatically grants access to every company application. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Use a governed Microsoft Entra B2B cross-tenant collaboration design with scoped resource grants. | (2) Separate identity proof verification from application authorization and Conditional Access evaluation.
- (1) Automate guest access expiration and sponsor-backed access reviews across effective memberships. | (2) Evaluate supported verifiable credential issuance and presentation with minimum disclosed claims.
- (1) Use a governed Microsoft Entra B2B cross-tenant collaboration design with scoped resource grants. | (2) Evaluate supported verifiable credential issuance and presentation with minimum disclosed claims.
- (1) Automate guest access expiration and sponsor-backed access reviews across effective memberships. | (2) Separate identity proof verification from application authorization and Conditional Access evaluation.
Explanation
Correct Answer
D:For requirement (1), Removing one shared link may leave app and group permissions intact, so the full guest entitlement inventory must be reviewed. For requirement (2), Proving an attribute does not override resource-specific permissions. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (1) is not met: Removing one shared link may leave app and group permissions intact, so the full guest entitlement inventory must be reviewed. The substituted action is instead for this different case: A partner organization needs access to one project application but should retain its own identity administration. The proposed bundle therefore cannot satisfy BOTH stated requirements.
B:Requirement (2) is not met: Proving an attribute does not override resource-specific permissions. The substituted action is instead for this different case: A team wants to rely on a verifiable credential to attest a training qualification without copying the holder's complete identity file. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (1) is not met: Removing one shared link may leave app and group permissions intact, so the full guest entitlement inventory must be reviewed. The substituted action is instead for this different case: A partner organization needs access to one project application but should retain its own identity administration. Requirement (2) is not met: Proving an attribute does not override resource-specific permissions. The substituted action is instead for this different case: A team wants to rely on a verifiable credential to attest a training qualification without copying the holder's complete identity file. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 626
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) Multiple application tiers use a single broad network security group allowing all east-west traffic. (2) An enterprise deploys two regional hubs but forgets to validate asymmetric return traffic through inspection appliances. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Design private endpoints and controlled network routing for the database service. | (2) Test effective routing symmetry and firewall state handling for hub-and-spoke inspection.
- (1) Segment workloads with least-privilege network security group and firewall rules. | (2) Include private DNS resolution and forwarding in the hybrid network design.
- (1) Design private endpoints and controlled network routing for the database service. | (2) Include private DNS resolution and forwarding in the hybrid network design.
- (1) Segment workloads with least-privilege network security group and firewall rules. | (2) Test effective routing symmetry and firewall state handling for hub-and-spoke inspection.
Explanation
Correct Answer
D:For requirement (1), Explicit flow restrictions reduce lateral movement between tiers. For requirement (2), Inconsistent forward and return paths can break stateful filtering or bypass expected controls. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (1) is not met: Explicit flow restrictions reduce lateral movement between tiers. The substituted action is instead for this different case: A regulated database is directly exposed to internet clients despite only internal applications needing connections. The proposed bundle therefore cannot satisfy BOTH stated requirements.
B:Requirement (2) is not met: Inconsistent forward and return paths can break stateful filtering or bypass expected controls. The substituted action is instead for this different case: A hybrid application requires private connectivity but its on-premises network cannot resolve the private endpoint's DNS name. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (1) is not met: Explicit flow restrictions reduce lateral movement between tiers. The substituted action is instead for this different case: A regulated database is directly exposed to internet clients despite only internal applications needing connections. Requirement (2) is not met: Inconsistent forward and return paths can break stateful filtering or bypass expected controls. The substituted action is instead for this different case: A hybrid application requires private connectivity but its on-premises network cannot resolve the private endpoint's DNS name. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 627
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A project uses identical privilege reports for Azure and AWS while ignoring provider-specific permission semantics. (2) The security team sees role assignments but cannot tell whether users actually exercise their entitlements. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Review effective cloud entitlements and remove unnecessary standing role grants. | (2) Incorporate activity evidence and resource criticality into cloud entitlement reviews.
- (1) Normalize entitlement risk across providers while retaining provider-specific authorization evaluation. | (2) Reduce its effective permissions to diagnostics-read operations at the smallest practical resource scope.
- (1) Review effective cloud entitlements and remove unnecessary standing role grants. | (2) Reduce its effective permissions to diagnostics-read operations at the smallest practical resource scope.
- (1) Normalize entitlement risk across providers while retaining provider-specific authorization evaluation. | (2) Incorporate activity evidence and resource criticality into cloud entitlement reviews.
Explanation
Correct Answer
D:For requirement (1), Multicloud access review needs comparable exposure without assuming the role models are identical. For requirement (2), Permission presence and actual use both inform the risk of persistent access. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (1) is not met: Multicloud access review needs comparable exposure without assuming the role models are identical. The substituted action is instead for this different case: An Azure subscription has hundreds of unused Owner roles assigned to service principals. The proposed bundle therefore cannot satisfy BOTH stated requirements.
B:Requirement (2) is not met: Permission presence and actual use both inform the risk of persistent access. The substituted action is instead for this different case: A managed identity can change production network routing despite only needing to read telemetry. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (1) is not met: Multicloud access review needs comparable exposure without assuming the role models are identical. The substituted action is instead for this different case: An Azure subscription has hundreds of unused Owner roles assigned to service principals. Requirement (2) is not met: Permission presence and actual use both inform the risk of persistent access. The substituted action is instead for this different case: A managed identity can change production network routing despite only needing to read telemetry. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 628
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) Two response teams execute contradictory network isolation and service restoration commands during the same ransomware drill. (2) A business continuity plan has no schedule to re-test after the organization moves its primary data platform to another cloud. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Assign incident recovery decision rights and approval gates for sensitive data access. | (2) Include business-process owners and freshness acceptance criteria in disaster-recovery testing.
- (1) Establish a single incident command workflow with explicit containment and recovery handoffs. | (2) Trigger resilience reassessment after material architecture changes and maintain current runbooks.
- (1) Assign incident recovery decision rights and approval gates for sensitive data access. | (2) Trigger resilience reassessment after material architecture changes and maintain current runbooks.
- (1) Establish a single incident command workflow with explicit containment and recovery handoffs. | (2) Include business-process owners and freshness acceptance criteria in disaster-recovery testing.
Explanation
Correct Answer
B:For requirement (1), Coordinated authority prevents responders from undoing each other's actions under crisis conditions. For requirement (2), Recovery documentation becomes unreliable when topology and dependencies evolve without corresponding drills. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (1) is not met: Coordinated authority prevents responders from undoing each other's actions under crisis conditions. The substituted action is instead for this different case: A tabletop exercise tests backup retrieval but never identifies who can authorize a regulated-data restoration. Requirement (2) is not met: Recovery documentation becomes unreliable when topology and dependencies evolve without corresponding drills. The substituted action is instead for this different case: Recovery tests meet infrastructure RTOs but fail business-user sign-off because downstream reports lack recent data. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (1) is not met: Coordinated authority prevents responders from undoing each other's actions under crisis conditions. The substituted action is instead for this different case: A tabletop exercise tests backup retrieval but never identifies who can authorize a regulated-data restoration. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (2) is not met: Recovery documentation becomes unreliable when topology and dependencies evolve without corresponding drills. The substituted action is instead for this different case: Recovery tests meet infrastructure RTOs but fail business-user sign-off because downstream reports lack recent data. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 629
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A device gateway accepts unencrypted readings from field sensors across untrusted networks. (2) A retail sensor network shares routing with payment processing servers despite no operational dependency. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Require unique device identity, credential provisioning and asset inventory for IoT onboarding. | (2) Segment IoT networks and limit gateway-to-enterprise traffic to defined protocols.
- (1) Design authenticated encrypted transport and gateway authorization for IoT telemetry. | (2) Specify secure update capability and controlled end-of-life replacement for embedded devices.
- (1) Require unique device identity, credential provisioning and asset inventory for IoT onboarding. | (2) Specify secure update capability and controlled end-of-life replacement for embedded devices.
- (1) Design authenticated encrypted transport and gateway authorization for IoT telemetry. | (2) Segment IoT networks and limit gateway-to-enterprise traffic to defined protocols.
Explanation
Correct Answer
D:For requirement (1), Protected communication mitigates impersonation and disclosure along sensor paths. For requirement (2), Network isolation reduces lateral movement from less-managed devices to sensitive services. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (1) is not met: Protected communication mitigates impersonation and disclosure along sensor paths. The substituted action is instead for this different case: Facilities deploy thousands of smart building sensors with default passwords and no central device registry. The proposed bundle therefore cannot satisfy BOTH stated requirements.
B:Requirement (2) is not met: Network isolation reduces lateral movement from less-managed devices to sensitive services. The substituted action is instead for this different case: An IoT fleet cannot be patched remotely and no one has documented expected service life or retirement. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (1) is not met: Protected communication mitigates impersonation and disclosure along sensor paths. The substituted action is instead for this different case: Facilities deploy thousands of smart building sensors with default passwords and no central device registry. Requirement (2) is not met: Network isolation reduces lateral movement from less-managed devices to sensitive services. The substituted action is instead for this different case: An IoT fleet cannot be patched remotely and no one has documented expected service life or retirement. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 630
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) An API gateway accepts unlimited requests from every subscription and the backend repeatedly exhausts capacity. (2) A gateway logs full bearer tokens and sensitive request payloads to an unrestricted workspace. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Configure appropriate API Management rate and quota limits aligned to business contracts. | (2) Redact credentials and personal content in API telemetry and restrict diagnostic access.
- (1) Design authenticated partner identities and per-API authorization in Azure API Management. | (2) Redact credentials and personal content in API telemetry and restrict diagnostic access.
- (1) Configure appropriate API Management rate and quota limits aligned to business contracts. | (2) Design governed API versioning and staged deprecation for breaking changes.
- (1) Design authenticated partner identities and per-API authorization in Azure API Management. | (2) Design governed API versioning and staged deprecation for breaking changes.
Explanation
Correct Answer
A:For requirement (1), Traffic governance protects availability and enforces fair resource consumption. For requirement (2), Observability should not leak the secrets and data it is intended to protect. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
B:Requirement (1) is not met: Traffic governance protects availability and enforces fair resource consumption. The substituted action is instead for this different case: A partner API receives legitimate requests but cannot distinguish which partner is allowed to call a sensitive operation. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (2) is not met: Observability should not leak the secrets and data it is intended to protect. The substituted action is instead for this different case: An architect publishes an API without a revision or version policy, breaking all consumers when its contract changes. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: Traffic governance protects availability and enforces fair resource consumption. The substituted action is instead for this different case: A partner API receives legitimate requests but cannot distinguish which partner is allowed to call a sensitive operation. Requirement (2) is not met: Observability should not leak the secrets and data it is intended to protect. The substituted action is instead for this different case: An architect publishes an API without a revision or version policy, breaking all consumers when its contract changes. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Microsoft Cybersecurity Architect (SC-100) Practice Tests