Question 640
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) Endpoint detectors become noisy after a new sensor rollout, and leadership believes attacks have doubled. (2) A detection rule catches a false-positive administrative script, and the owner asks for blanket script exclusions. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Enrich external indicators with local telemetry, time context and confidence before escalation. | (2) Design behavioral detections and threat-hunting hypotheses beyond one static indicator.
- (1) Normalize security metrics by monitored asset coverage and detection-rule changes. | (2) Use evidence-based narrow tuning and regression tests rather than disabling the broad detection family.
- (1) Enrich external indicators with local telemetry, time context and confidence before escalation. | (2) Use evidence-based narrow tuning and regression tests rather than disabling the broad detection family.
- (1) Normalize security metrics by monitored asset coverage and detection-rule changes. | (2) Design behavioral detections and threat-hunting hypotheses beyond one static indicator.
Explanation
Correct Answer
B:For requirement (1), Improved visibility can increase alert counts without a matching change in attacker activity. For requirement (2), Scoped exceptions limit noise without removing visibility for genuine malicious variants. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (1) is not met: Improved visibility can increase alert counts without a matching change in attacker activity. The substituted action is instead for this different case: A SOC promotes every external threat indicator to a high-severity alert without validating matches against tenant events. Requirement (2) is not met: Scoped exceptions limit noise without removing visibility for genuine malicious variants. The substituted action is instead for this different case: A malware campaign changes IP addresses while maintaining the same credential-theft technique. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (1) is not met: Improved visibility can increase alert counts without a matching change in attacker activity. The substituted action is instead for this different case: A SOC promotes every external threat indicator to a high-severity alert without validating matches against tenant events. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (2) is not met: Scoped exceptions limit noise without removing visibility for genuine malicious variants. The substituted action is instead for this different case: A malware campaign changes IP addresses while maintaining the same credential-theft technique. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 641
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A BYOD policy grants unrestricted access to corporate data from unregistered personal phones. (2) Remote workers report that a compliance policy was assigned yet their device sign-ins remain unrestricted. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Require verified endpoint onboarding, protection state and detection telemetry for managed clients. | (2) Select platform-supported Defender protection and configuration methods for each client operating system.
- (1) Design app and device access requirements with mobile application protection where supported. | (2) Verify effective device compliance reporting and Conditional Access enforcement together.
- (1) Require verified endpoint onboarding, protection state and detection telemetry for managed clients. | (2) Verify effective device compliance reporting and Conditional Access enforcement together.
- (1) Design app and device access requirements with mobile application protection where supported. | (2) Select platform-supported Defender protection and configuration methods for each client operating system.
Explanation
Correct Answer
B:For requirement (1), Personal devices require clear data boundaries without assuming full corporate device ownership. For requirement (2), Configuration assignment and evaluated access conditions are separate states. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (1) is not met: Personal devices require clear data boundaries without assuming full corporate device ownership. The substituted action is instead for this different case: The enterprise enrolls laptops into device management but does not verify Defender endpoint sensor health. Requirement (2) is not met: Configuration assignment and evaluated access conditions are separate states. The substituted action is instead for this different case: Mac and Windows employees are assigned the same agent package without checking platform support. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (1) is not met: Personal devices require clear data boundaries without assuming full corporate device ownership. The substituted action is instead for this different case: The enterprise enrolls laptops into device management but does not verify Defender endpoint sensor health. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (2) is not met: Configuration assignment and evaluated access conditions are separate states. The substituted action is instead for this different case: Mac and Windows employees are assigned the same agent package without checking platform support. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 642
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A Kubernetes cluster is connected to Azure but container runtime threats are absent from security operations. (2) An architect enables every Defender plan without evaluating workloads, coverage or operating costs. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Evaluate Defender for Containers coverage and deployment prerequisites for the managed cluster. | (2) Map protected resource types and threat priorities to eligible workload protection plans.
- (1) Evaluate and enable an appropriate Defender for Databases workload protection plan. | (2) Map protected resource types and threat priorities to eligible workload protection plans.
- (1) Evaluate Defender for Containers coverage and deployment prerequisites for the managed cluster. | (2) Select supported Defender for Servers protection and endpoint integration appropriate to the OS estate.
- (1) Evaluate and enable an appropriate Defender for Databases workload protection plan. | (2) Select supported Defender for Servers protection and endpoint integration appropriate to the OS estate.
Explanation
Correct Answer
A:For requirement (1), Container threat protection requires supported cluster integration beyond generic Azure inventory. For requirement (2), Security plans should be chosen from actual risks and supported coverage rather than a blanket toggle. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
B:Requirement (1) is not met: Container threat protection requires supported cluster integration beyond generic Azure inventory. The substituted action is instead for this different case: A team enables only configuration assessments for databases but expects runtime SQL threat detections. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (2) is not met: Security plans should be chosen from actual risks and supported coverage rather than a blanket toggle. The substituted action is instead for this different case: A fleet of virtual machines needs behavioral threat detection, not only a list of configuration recommendations. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: Container threat protection requires supported cluster integration beyond generic Azure inventory. The substituted action is instead for this different case: A team enables only configuration assessments for databases but expects runtime SQL threat detections. Requirement (2) is not met: Security plans should be chosen from actual risks and supported coverage rather than a blanket toggle. The substituted action is instead for this different case: A fleet of virtual machines needs behavioral threat detection, not only a list of configuration recommendations. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 643
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) An internet-facing appliance has a known exploited vulnerability but the team patches internal low-risk desktops first. (2) The organization declares all servers patched after distributing a policy but has not checked their actual installed versions. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Stage security updates through representative rings with rollback criteria and documented maintenance approvals. | (2) Verify deployment compliance and observed software versions before closing remediation work.
- (1) Prioritize exploitation evidence and exposed asset criticality over a uniform patch queue. | (2) Document a time-bounded exception with compensating isolation and a tested remediation deadline.
- (1) Stage security updates through representative rings with rollback criteria and documented maintenance approvals. | (2) Document a time-bounded exception with compensating isolation and a tested remediation deadline.
- (1) Prioritize exploitation evidence and exposed asset criticality over a uniform patch queue. | (2) Verify deployment compliance and observed software versions before closing remediation work.
Explanation
Correct Answer
D:For requirement (1), Threat-informed sequencing addresses the most reachable and consequential attack paths first. For requirement (2), Assignment and successful installation are separate states requiring evidence from target devices. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (1) is not met: Threat-informed sequencing addresses the most reachable and consequential attack paths first. The substituted action is instead for this different case: Operations proposes patching every endpoint simultaneously during a business-critical production window. The proposed bundle therefore cannot satisfy BOTH stated requirements.
B:Requirement (2) is not met: Assignment and successful installation are separate states requiring evidence from target devices. The substituted action is instead for this different case: A critical security patch breaks a legacy application that cannot yet be retired. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (1) is not met: Threat-informed sequencing addresses the most reachable and consequential attack paths first. The substituted action is instead for this different case: Operations proposes patching every endpoint simultaneously during a business-critical production window. Requirement (2) is not met: Assignment and successful installation are separate states requiring evidence from target devices. The substituted action is instead for this different case: A critical security patch breaks a legacy application that cannot yet be retired. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 644
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A trusted third-party app requests full mailbox read permission though its business function only requires calendar availability. (2) Several Cloud Apps alerts are triggered by an approved scheduled export and the SOC requests disabling all anomaly detection. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Evaluate Defender for Cloud Apps discovery using supported endpoint or network telemetry. | (2) Evaluate Conditional Access App Control session restrictions through Defender for Cloud Apps.
- (1) Review OAuth consent grants and require minimum permissions before sanctioning the app. | (2) Tune scoped anomaly policies using validated business behavior and retain broader detection coverage.
- (1) Evaluate Defender for Cloud Apps discovery using supported endpoint or network telemetry. | (2) Tune scoped anomaly policies using validated business behavior and retain broader detection coverage.
- (1) Review OAuth consent grants and require minimum permissions before sanctioning the app. | (2) Evaluate Conditional Access App Control session restrictions through Defender for Cloud Apps.
Explanation
Correct Answer
B:For requirement (1), Excess app scopes create disproportionate disclosure risk even for approved vendors. For requirement (2), Narrow tuning reduces alert fatigue without disabling unrelated risk detection. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (1) is not met: Excess app scopes create disproportionate disclosure risk even for approved vendors. The substituted action is instead for this different case: A company cannot identify unsanctioned SaaS services accessed by remote workers from company devices. Requirement (2) is not met: Narrow tuning reduces alert fatigue without disabling unrelated risk detection. The substituted action is instead for this different case: A user downloads confidential files from a connected SaaS app on an unmanaged device after a successful sign-in. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (1) is not met: Excess app scopes create disproportionate disclosure risk even for approved vendors. The substituted action is instead for this different case: A company cannot identify unsanctioned SaaS services accessed by remote workers from company devices. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (2) is not met: Narrow tuning reduces alert fatigue without disabling unrelated risk detection. The substituted action is instead for this different case: A user downloads confidential files from a connected SaaS app on an unmanaged device after a successful sign-in. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 645
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) The risk register identifies security obligations but has no controls mapped to subscription and data owners. (2) An acquired company joins the Azure estate with a different regulatory profile and inherits every existing exception. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Translate business-risk requirements into enforceable cloud policy, identity and monitoring controls. | (2) Evaluate and scope governance exceptions to each applicable business or regulatory context.
- (1) Establish CAF governance guardrails and decision authority before large-scale landing-zone deployment. | (2) Evaluate and scope governance exceptions to each applicable business or regulatory context.
- (1) Translate business-risk requirements into enforceable cloud policy, identity and monitoring controls. | (2) Define shared platform and workload responsibilities for governance, response and policy lifecycle.
- (1) Establish CAF governance guardrails and decision authority before large-scale landing-zone deployment. | (2) Define shared platform and workload responsibilities for governance, response and policy lifecycle.
Explanation
Correct Answer
A:For requirement (1), Architecture should connect risk treatment to actual technical enforcement. For requirement (2), Existing exceptions are not blanket authorization for unrelated subsidiaries or workloads. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
B:Requirement (1) is not met: Architecture should connect risk treatment to actual technical enforcement. The substituted action is instead for this different case: A cloud migration program starts provisioning production subscriptions before defining policy owners and security exceptions. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (2) is not met: Existing exceptions are not blanket authorization for unrelated subsidiaries or workloads. The substituted action is instead for this different case: A platform team assumes that the Cloud Adoption Framework eliminates the need for a security operating model. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: Architecture should connect risk treatment to actual technical enforcement. The substituted action is instead for this different case: A cloud migration program starts provisioning production subscriptions before defining policy owners and security exceptions. Requirement (2) is not met: Existing exceptions are not blanket authorization for unrelated subsidiaries or workloads. The substituted action is instead for this different case: A platform team assumes that the Cloud Adoption Framework eliminates the need for a security operating model. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 646
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) An operations team receives Defender alerts but cannot connect them to the application team responsible for the resource. (2) A multi-team deployment is declared complete based only on resource creation even though access controls were not reviewed. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Maintain resource tagging and owner mapping that supports incident response routing. | (2) Document customer-managed guest patch responsibilities separately from provider-managed service components.
- (1) Include operational responsibility, alert routing and log lifecycle in the platform handoff. | (2) Document customer-managed guest patch responsibilities separately from provider-managed service components.
- (1) Maintain resource tagging and owner mapping that supports incident response routing. | (2) Require a deployment acceptance check covering identities, policy compliance and observable protection.
- (1) Include operational responsibility, alert routing and log lifecycle in the platform handoff. | (2) Require a deployment acceptance check covering identities, policy compliance and observable protection.
Explanation
Correct Answer
C:For requirement (1), Ownership metadata enables prompt action on detections affecting specific workloads. For requirement (2), A resource being created does not show that its security design was successfully enforced. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (2) is not met: A resource being created does not show that its security design was successfully enforced. The substituted action is instead for this different case: Production teams assume platform security updates will occur automatically for every IaaS guest operating system. The proposed bundle therefore cannot satisfy BOTH stated requirements.
B:Requirement (1) is not met: Ownership metadata enables prompt action on detections affecting specific workloads. The substituted action is instead for this different case: A newly deployed landing zone has no defined security response contact or log retention owner. Requirement (2) is not met: A resource being created does not show that its security design was successfully enforced. The substituted action is instead for this different case: Production teams assume platform security updates will occur automatically for every IaaS guest operating system. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: Ownership metadata enables prompt action on detections affecting specific workloads. The substituted action is instead for this different case: A newly deployed landing zone has no defined security response contact or log retention owner. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 647
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) Legal staff need to preserve selected correspondence during an active investigation without changing organization-wide retention schedules. (2) A firm needs to stop identified financial account numbers from being shared externally through approved Microsoft 365 workloads. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Use supported Purview content classification and discovery with appropriately scoped analyst roles. | (2) Design a Purview DLP policy using validated sensitive-content detectors and sharing conditions.
- (1) Plan scoped Purview eDiscovery preservation and case access controls. | (2) Design supported Purview sensitivity label protection with audience-specific encryption rights.
- (1) Use supported Purview content classification and discovery with appropriately scoped analyst roles. | (2) Design supported Purview sensitivity label protection with audience-specific encryption rights.
- (1) Plan scoped Purview eDiscovery preservation and case access controls. | (2) Design a Purview DLP policy using validated sensitive-content detectors and sharing conditions.
Explanation
Correct Answer
D:For requirement (1), Case-specific holds can preserve evidence independently of normal lifecycle rules. For requirement (2), DLP applies contextual restrictions to detected sensitive information. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (1) is not met: Case-specific holds can preserve evidence independently of normal lifecycle rules. The substituted action is instead for this different case: A company must discover which SharePoint files contain confidential customer identifiers before designing access controls. The proposed bundle therefore cannot satisfy BOTH stated requirements.
B:Requirement (2) is not met: DLP applies contextual restrictions to detected sensitive information. The substituted action is instead for this different case: A regulated document must be visibly classified and encrypted for approved recipients. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (1) is not met: Case-specific holds can preserve evidence independently of normal lifecycle rules. The substituted action is instead for this different case: A company must discover which SharePoint files contain confidential customer identifiers before designing access controls. Requirement (2) is not met: DLP applies contextual restrictions to detected sensitive information. The substituted action is instead for this different case: A regulated document must be visibly classified and encrypted for approved recipients. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 648
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A team connects a mobile app to an internal service through a new gateway without updating its trust-boundary diagrams. (2) A design review finishes without testing whether its recommended access controls actually reject unauthenticated requests. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Document data flows, entry points and trust boundaries using a structured threat-modeling method. | (2) Convert threat-model assumptions into concrete negative authorization and misuse test cases.
- (1) Threat-model authorization bypass and business-logic abuse as well as network confidentiality. | (2) Convert threat-model assumptions into concrete negative authorization and misuse test cases.
- (1) Document data flows, entry points and trust boundaries using a structured threat-modeling method. | (2) Evaluate attack feasibility and business impact to rank threat-model countermeasures.
- (1) Threat-model authorization bypass and business-logic abuse as well as network confidentiality. | (2) Evaluate attack feasibility and business impact to rank threat-model countermeasures.
Explanation
Correct Answer
A:For requirement (1), New integration edges introduce attack paths that an outdated architecture diagram misses. For requirement (2), Security requirements are meaningful only when validated against adversarial behavior. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
B:Requirement (1) is not met: New integration edges introduce attack paths that an outdated architecture diagram misses. The substituted action is instead for this different case: An API exposes a payment approval function and the design review only checks for encrypted connections. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (2) is not met: Security requirements are meaningful only when validated against adversarial behavior. The substituted action is instead for this different case: An architect treats every identified STRIDE threat as equally likely and refuses to prioritize mitigations. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: New integration edges introduce attack paths that an outdated architecture diagram misses. The substituted action is instead for this different case: An API exposes a payment approval function and the design review only checks for encrypted connections. Requirement (2) is not met: Security requirements are meaningful only when validated against adversarial behavior. The substituted action is instead for this different case: An architect treats every identified STRIDE threat as equally likely and refuses to prioritize mitigations. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 649
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A financial table is labeled confidential by file name only despite containing mixed sensitivity levels. (2) A records project classifies historical exports but never updates the catalog when new data pipelines are introduced. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Use content-based classification and business-owner validation instead of relying on naming conventions. | (2) Link classification findings to effective identities and data-plane permissions.
- (1) Design automated data discovery and classification across approved storage and database services. | (2) Link classification findings to effective identities and data-plane permissions.
- (1) Use content-based classification and business-owner validation instead of relying on naming conventions. | (2) Integrate classification checks into ingestion and dataset lifecycle workflows.
- (1) Design automated data discovery and classification across approved storage and database services. | (2) Integrate classification checks into ingestion and dataset lifecycle workflows.
Explanation
Correct Answer
C:For requirement (1), Labels based on data characteristics support defensible protection decisions. For requirement (2), Data inventories become stale when changes to data sources are not reassessed. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (2) is not met: Data inventories become stale when changes to data sources are not reassessed. The substituted action is instead for this different case: A data steward sees classification detections but cannot confirm who may access the affected records. The proposed bundle therefore cannot satisfy BOTH stated requirements.
B:Requirement (1) is not met: Labels based on data characteristics support defensible protection decisions. The substituted action is instead for this different case: A global insurer stores confidential information in many subscriptions but has no catalog showing sensitive data locations. Requirement (2) is not met: Data inventories become stale when changes to data sources are not reassessed. The substituted action is instead for this different case: A data steward sees classification detections but cannot confirm who may access the affected records. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: Labels based on data characteristics support defensible protection decisions. The substituted action is instead for this different case: A global insurer stores confidential information in many subscriptions but has no catalog showing sensitive data locations. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 650
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A factory SOC adopts only enterprise IT ATT&CK techniques while its control networks use industrial protocols. (2) A team treats a red-team simulation detection as proven coverage for every variant of an ATT&CK technique. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Include appropriate ATT&CK for ICS techniques and industrial event sources in detection design. | (2) Test analytic coverage against representative variations and record the sensor and response assumptions.
- (1) Map detection use cases to MITRE ATT&CK techniques and identify uncovered tactics. | (2) Test analytic coverage against representative variations and record the sensor and response assumptions.
- (1) Include appropriate ATT&CK for ICS techniques and industrial event sources in detection design. | (2) Evaluate mobile-relevant MITRE ATT&CK behaviors and mobile telemetry availability.
- (1) Map detection use cases to MITRE ATT&CK techniques and identify uncovered tactics. | (2) Evaluate mobile-relevant MITRE ATT&CK behaviors and mobile telemetry availability.
Explanation
Correct Answer
A:For requirement (1), Operational technology threats differ from conventional office endpoint behavior. For requirement (2), One successful simulated detection does not imply complete technique coverage. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
B:Requirement (1) is not met: Operational technology threats differ from conventional office endpoint behavior. The substituted action is instead for this different case: A security dashboard lists alert counts but cannot demonstrate which adversary techniques are detected. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (2) is not met: One successful simulated detection does not imply complete technique coverage. The substituted action is instead for this different case: An investigation labels all mobile-device anomalies as workstation persistence and misroutes response. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: Operational technology threats differ from conventional office endpoint behavior. The substituted action is instead for this different case: A security dashboard lists alert counts but cannot demonstrate which adversary techniques are detected. Requirement (2) is not met: One successful simulated detection does not imply complete technique coverage. The substituted action is instead for this different case: An investigation labels all mobile-device anomalies as workstation persistence and misroutes response. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Microsoft Cybersecurity Architect (SC-100) Practice Tests