Question 650
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A factory SOC adopts only enterprise IT ATT&CK techniques while its control networks use industrial protocols. (2) A team treats a red-team simulation detection as proven coverage for every variant of an ATT&CK technique. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Include appropriate ATT&CK for ICS techniques and industrial event sources in detection design. | (2) Test analytic coverage against representative variations and record the sensor and response assumptions.
- (1) Map detection use cases to MITRE ATT&CK techniques and identify uncovered tactics. | (2) Test analytic coverage against representative variations and record the sensor and response assumptions.
- (1) Include appropriate ATT&CK for ICS techniques and industrial event sources in detection design. | (2) Evaluate mobile-relevant MITRE ATT&CK behaviors and mobile telemetry availability.
- (1) Map detection use cases to MITRE ATT&CK techniques and identify uncovered tactics. | (2) Evaluate mobile-relevant MITRE ATT&CK behaviors and mobile telemetry availability.
Explanation
Correct Answer
A:For requirement (1), Operational technology threats differ from conventional office endpoint behavior. For requirement (2), One successful simulated detection does not imply complete technique coverage. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
B:Requirement (1) is not met: Operational technology threats differ from conventional office endpoint behavior. The substituted action is instead for this different case: A security dashboard lists alert counts but cannot demonstrate which adversary techniques are detected. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (2) is not met: One successful simulated detection does not imply complete technique coverage. The substituted action is instead for this different case: An investigation labels all mobile-device anomalies as workstation persistence and misroutes response. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: Operational technology threats differ from conventional office endpoint behavior. The substituted action is instead for this different case: A security dashboard lists alert counts but cannot demonstrate which adversary techniques are detected. Requirement (2) is not met: One successful simulated detection does not imply complete technique coverage. The substituted action is instead for this different case: An investigation labels all mobile-device anomalies as workstation persistence and misroutes response. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 651
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) An enterprise trusts a vendor reference configuration even though the deployment environment has different identity and network constraints. (2) An engineering team plans to claim continuous compliance from an annual spreadsheet completed by a single administrator. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Validate reference recommendations against local prerequisites and record justified design deviations. | (2) Assess control coverage across every approved location and execution environment.
- (1) Define architecture acceptance criteria that include control testing, telemetry and failure-mode verification. | (2) Assess control coverage across every approved location and execution environment.
- (1) Validate reference recommendations against local prerequisites and record justified design deviations. | (2) Introduce repeatable automated evidence collection and independent control-owner review.
- (1) Define architecture acceptance criteria that include control testing, telemetry and failure-mode verification. | (2) Introduce repeatable automated evidence collection and independent control-owner review.
Explanation
Correct Answer
C:For requirement (1), Reusable architecture patterns still require environment-specific engineering decisions. For requirement (2), Continuous assurance needs current technical signals and review beyond a one-time questionnaire. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (2) is not met: Continuous assurance needs current technical signals and review beyond a one-time questionnaire. The substituted action is instead for this different case: A control has been implemented only in the primary region while workloads also serve regulated traffic elsewhere. The proposed bundle therefore cannot satisfy BOTH stated requirements.
B:Requirement (1) is not met: Reusable architecture patterns still require environment-specific engineering decisions. The substituted action is instead for this different case: A security design review accepts a product diagram but lacks evidence of how the proposed controls work under failure. Requirement (2) is not met: Continuous assurance needs current technical signals and review beyond a one-time questionnaire. The substituted action is instead for this different case: A control has been implemented only in the primary region while workloads also serve regulated traffic elsewhere. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: Reusable architecture patterns still require environment-specific engineering decisions. The substituted action is instead for this different case: A security design review accepts a product diagram but lacks evidence of how the proposed controls work under failure. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 652
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) Two business units deploy redundant identity tools that disagree about the authoritative account lifecycle. (2) A risk committee receives control gaps without impact, likelihood or remediation ownership. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Establish an agreed source of identity truth and consistent joiner-mover-leaver architecture. | (2) Translate identified control gaps into risk-ranked treatment decisions with accountable owners.
- (1) Prioritize risk and compliance requirements before using posture scores to choose compensating controls. | (2) Translate identified control gaps into risk-ranked treatment decisions with accountable owners.
- (1) Establish an agreed source of identity truth and consistent joiner-mover-leaver architecture. | (2) Include third-party and internal trust relationships in the threat inventory and mitigation plan.
- (1) Prioritize risk and compliance requirements before using posture scores to choose compensating controls. | (2) Include third-party and internal trust relationships in the threat inventory and mitigation plan.
Explanation
Correct Answer
A:For requirement (1), Competing identity authorities produce access drift despite strong individual controls. For requirement (2), Prioritization requires business consequences and a named control remediation path. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
B:Requirement (1) is not met: Competing identity authorities produce access drift despite strong individual controls. The substituted action is instead for this different case: A cloud project seeks the highest possible Secure Score but ignores regulatory data residency obligations. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (2) is not met: Prioritization requires business consequences and a named control remediation path. The substituted action is instead for this different case: An architecture review lists technical threats but excludes vendors and privileged operators from the attack surface. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: Competing identity authorities produce access drift despite strong individual controls. The substituted action is instead for this different case: A cloud project seeks the highest possible Secure Score but ignores regulatory data residency obligations. Requirement (2) is not met: Prioritization requires business consequences and a named control remediation path. The substituted action is instead for this different case: An architecture review lists technical threats but excludes vendors and privileged operators from the attack surface. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 653
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) The help desk needs to reset passwords for one subsidiary but receives tenant-wide user administrator rights. (2) An automation account receives direct permanent Owner permissions on every production subscription. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Scope supported administrative roles to the subsidiary through appropriate administrative units. | (2) Establish dedicated monitored emergency access accounts with restricted routine use.
- (1) Separate privileged access tiers and delegate authority only for the required control plane. | (2) Establish dedicated monitored emergency access accounts with restricted routine use.
- (1) Scope supported administrative roles to the subsidiary through appropriate administrative units. | (2) Replace blanket standing ownership with narrow scoped roles and approved elevation paths.
- (1) Separate privileged access tiers and delegate authority only for the required control plane. | (2) Replace blanket standing ownership with narrow scoped roles and approved elevation paths.
Explanation
Correct Answer
C:For requirement (1), Delegated scope limits which directory objects an operator may modify. For requirement (2), Reducing excess privilege limits accidental or malicious modification of unrelated workloads. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (2) is not met: Reducing excess privilege limits accidental or malicious modification of unrelated workloads. The substituted action is instead for this different case: A tenant contains an emergency access identity with ordinary email and browsing enabled. The proposed bundle therefore cannot satisfy BOTH stated requirements.
B:Requirement (1) is not met: Delegated scope limits which directory objects an operator may modify. The substituted action is instead for this different case: An engineer proposes that every cloud administrator also hold permanent enterprise domain administrator privileges. Requirement (2) is not met: Reducing excess privilege limits accidental or malicious modification of unrelated workloads. The substituted action is instead for this different case: A tenant contains an emergency access identity with ordinary email and browsing enabled. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: Delegated scope limits which directory objects an operator may modify. The substituted action is instead for this different case: An engineer proposes that every cloud administrator also hold permanent enterprise domain administrator privileges. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 654
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) An internet-facing Windows server runs an unsupported OS and the team expects ordinary patch deployment to fix it. (2) A container host has healthy runtime workloads but its underlying operating system security updates are months behind. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Specify OS-specific endpoint protection and secure configuration standards for the server estate. | (2) Restrict privileged management ingress and require approved hardened administrative pathways.
- (1) Plan isolation or migration to a supported platform with documented interim risk controls. | (2) Include host operating-system patching and vulnerability monitoring in the container platform baseline.
- (1) Specify OS-specific endpoint protection and secure configuration standards for the server estate. | (2) Include host operating-system patching and vulnerability monitoring in the container platform baseline.
- (1) Plan isolation or migration to a supported platform with documented interim risk controls. | (2) Restrict privileged management ingress and require approved hardened administrative pathways.
Explanation
Correct Answer
B:For requirement (1), Unsupported systems cannot be assumed protected by nonexistent vendor updates. For requirement (2), Securing containers does not eliminate weaknesses in the host kernel and services. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (1) is not met: Unsupported systems cannot be assumed protected by nonexistent vendor updates. The substituted action is instead for this different case: A mixed Windows and Linux server fleet has no consistent detection coverage or local hardening baseline. Requirement (2) is not met: Securing containers does not eliminate weaknesses in the host kernel and services. The substituted action is instead for this different case: Production servers allow local administrator access from standard employee workstations. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (1) is not met: Unsupported systems cannot be assumed protected by nonexistent vendor updates. The substituted action is instead for this different case: A mixed Windows and Linux server fleet has no consistent detection coverage or local hardening baseline. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (2) is not met: Securing containers does not eliminate weaknesses in the host kernel and services. The substituted action is instead for this different case: Production servers allow local administrator access from standard employee workstations. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 655
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A cross-region incident requires inspecting east-west application connections but only internet ingress logs are retained. (2) The network team permits all ports between Azure and an acquired private cloud because it does not know the required application flows. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Design appropriate network flow telemetry for internal and cross-region sensitive paths. | (2) Inventory authorized application protocols and enforce narrow hybrid network access rules.
- (1) Include monitoring endpoint reachability and firewall telemetry in network security acceptance tests. | (2) Inventory authorized application protocols and enforce narrow hybrid network access rules.
- (1) Design appropriate network flow telemetry for internal and cross-region sensitive paths. | (2) Validate DNS and public endpoint disablement after the private connectivity migration.
- (1) Include monitoring endpoint reachability and firewall telemetry in network security acceptance tests. | (2) Validate DNS and public endpoint disablement after the private connectivity migration.
Explanation
Correct Answer
A:For requirement (1), Lateral movement can occur without ever traversing the public perimeter. For requirement (2), Broad interconnects expand blast radius across cloud trust boundaries. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
B:Requirement (1) is not met: Lateral movement can occur without ever traversing the public perimeter. The substituted action is instead for this different case: A branch firewall blocks Azure monitoring traffic after a network redesign, leaving a gap in security telemetry. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (2) is not met: Broad interconnects expand blast radius across cloud trust boundaries. The substituted action is instead for this different case: A service is moved behind a private endpoint, yet its old public DNS name continues to resolve to an exposed address. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: Lateral movement can occur without ever traversing the public perimeter. The substituted action is instead for this different case: A branch firewall blocks Azure monitoring traffic after a network redesign, leaving a gap in security telemetry. Requirement (2) is not met: Broad interconnects expand blast radius across cloud trust boundaries. The substituted action is instead for this different case: A service is moved behind a private endpoint, yet its old public DNS name continues to resolve to an exposed address. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 656
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) Devices report compliant because a policy was assigned, yet the expected BitLocker protection is absent. (2) A compliance report shows that antivirus is installed but its signatures and cloud protection have not updated for weeks. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Validate effective disk encryption state rather than relying on policy assignment alone. | (2) Include product health, update freshness and telemetry availability in the endpoint assurance standard.
- (1) Pilot platform-specific baseline controls and document justified workload exceptions. | (2) Include product health, update freshness and telemetry availability in the endpoint assurance standard.
- (1) Validate effective disk encryption state rather than relying on policy assignment alone. | (2) Detect configuration drift and reconcile operational changes against approved hardened baselines.
- (1) Pilot platform-specific baseline controls and document justified workload exceptions. | (2) Detect configuration drift and reconcile operational changes against approved hardened baselines.
Explanation
Correct Answer
A:For requirement (1), A deployed intention is not evidence of the required endpoint state. For requirement (2), Installed software alone does not prove current protective capability. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
B:Requirement (1) is not met: A deployed intention is not evidence of the required endpoint state. The substituted action is instead for this different case: A configuration team enables one generic security baseline for every device regardless of application compatibility. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (2) is not met: Installed software alone does not prove current protective capability. The substituted action is instead for this different case: A server build pipeline uses hardened templates but administrators repeatedly override settings after deployment. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: A deployed intention is not evidence of the required endpoint state. The substituted action is instead for this different case: A configuration team enables one generic security baseline for every device regardless of application compatibility. Requirement (2) is not met: Installed software alone does not prove current protective capability. The substituted action is instead for this different case: A server build pipeline uses hardened templates but administrators repeatedly override settings after deployment. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 657
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A production app relies on an unsupported open-source library but developers assume vendor support covers it. (2) A team accepts security defects in a release without recording who approved the exception or when it expires. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Embed design review, testing and remediation in each phase of the application development lifecycle. | (2) Require signed or attested release provenance linking build outputs to reviewed source revisions.
- (1) Establish software bill of materials and dependency update governance for third-party packages. | (2) Create a documented risk exception path with compensating controls and time-bounded remediation.
- (1) Embed design review, testing and remediation in each phase of the application development lifecycle. | (2) Create a documented risk exception path with compensating controls and time-bounded remediation.
- (1) Establish software bill of materials and dependency update governance for third-party packages. | (2) Require signed or attested release provenance linking build outputs to reviewed source revisions.
Explanation
Correct Answer
B:For requirement (1), Dependency provenance and maintenance are application-owner responsibilities. For requirement (2), A controlled exception should preserve accountability for residual application risk. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (1) is not met: Dependency provenance and maintenance are application-owner responsibilities. The substituted action is instead for this different case: An engineering group performs security review only after production incidents. Requirement (2) is not met: A controlled exception should preserve accountability for residual application risk. The substituted action is instead for this different case: A release manager cannot associate a production binary with the approved source commit. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (1) is not met: Dependency provenance and maintenance are application-owner responsibilities. The substituted action is instead for this different case: An engineering group performs security review only after production incidents. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (2) is not met: A controlled exception should preserve accountability for residual application risk. The substituted action is instead for this different case: A release manager cannot associate a production binary with the approved source commit. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 658
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) Production automation depends on one employee's Global Administrator credential and fails when that account is disabled. (2) Domain controllers in every region replicate untested privileged group changes during a security incident. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Maintain protected emergency administrative access with monitored, rehearsed recovery procedures. | (2) Include directory recovery, privileged group validation and trusted identity checkpoints in the resilience plan.
- (1) Replace person-bound privileged automation with a governed workload identity and least-privilege permissions. | (2) Separate destructive backup administration from ordinary restore permissions and enforce independent approvals.
- (1) Maintain protected emergency administrative access with monitored, rehearsed recovery procedures. | (2) Separate destructive backup administration from ordinary restore permissions and enforce independent approvals.
- (1) Replace person-bound privileged automation with a governed workload identity and least-privilege permissions. | (2) Include directory recovery, privileged group validation and trusted identity checkpoints in the resilience plan.
Explanation
Correct Answer
D:For requirement (1), Nonhuman service continuity should not depend on an individual's account lifecycle or standing tenant-wide privilege. For requirement (2), The identity plane is a recovery dependency and can propagate harmful changes across otherwise isolated sites. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (1) is not met: Nonhuman service continuity should not depend on an individual's account lifecycle or standing tenant-wide privilege. The substituted action is instead for this different case: Ransomware responders cannot use recovery consoles because the tenant's normal administrator identities were disabled. The proposed bundle therefore cannot satisfy BOTH stated requirements.
B:Requirement (2) is not met: The identity plane is a recovery dependency and can propagate harmful changes across otherwise isolated sites. The substituted action is instead for this different case: A backup operator can both delete immutable backup protection settings and restore data without independent approval. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (1) is not met: Nonhuman service continuity should not depend on an individual's account lifecycle or standing tenant-wide privilege. The substituted action is instead for this different case: Ransomware responders cannot use recovery consoles because the tenant's normal administrator identities were disabled. Requirement (2) is not met: The identity plane is a recovery dependency and can propagate harmful changes across otherwise isolated sites. The substituted action is instead for this different case: A backup operator can both delete immutable backup protection settings and restore data without independent approval. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 659
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A user replaces a phone and cannot complete MFA, so support plans to disable all MFA enforcement. (2) A compromised session remains active after password change and the owner believes password reset alone closes the incident. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Design a verified recovery and strong-method re-registration process for lost authenticators. | (2) Include session revocation and token investigation in identity compromise response.
- (1) Design risk-based verification, containment and credential recovery workflows for compromised accounts. | (2) Include session revocation and token investigation in identity compromise response.
- (1) Design a verified recovery and strong-method re-registration process for lost authenticators. | (2) Inventory unsupported client protocols and stage their replacement before enforcing passwordless access.
- (1) Design risk-based verification, containment and credential recovery workflows for compromised accounts. | (2) Inventory unsupported client protocols and stage their replacement before enforcing passwordless access.
Explanation
Correct Answer
A:For requirement (1), Recovery must not create a weaker bypass around the identity controls it restores. For requirement (2), Existing sessions may survive a credential update until explicit or policy-driven invalidation. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
B:Requirement (1) is not met: Recovery must not create a weaker bypass around the identity controls it restores. The substituted action is instead for this different case: A high-risk identity appears in Identity Protection and the help desk proposes dismissing it without investigation. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (2) is not met: Existing sessions may survive a credential update until explicit or policy-driven invalidation. The substituted action is instead for this different case: A directory team plans passwordless deployment without assessing which legacy applications support modern authentication. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: Recovery must not create a weaker bypass around the identity controls it restores. The substituted action is instead for this different case: A high-risk identity appears in Identity Protection and the help desk proposes dismissing it without investigation. Requirement (2) is not met: Existing sessions may survive a credential update until explicit or policy-driven invalidation. The substituted action is instead for this different case: A directory team plans passwordless deployment without assessing which legacy applications support modern authentication. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 660
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) An application assessment scores a public healthcare API and an internal demo app equally because both lack one HTTP header. (2) A security board authorizes a new application but no one owns future dependency updates. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Prioritize application posture findings by reachable attack paths and regulated data impact. | (2) Assign application security ownership and a funded vulnerability management lifecycle.
- (1) Build an application security inventory with criticality, exposure, ownership and identity dependencies. | (2) Assign application security ownership and a funded vulnerability management lifecycle.
- (1) Prioritize application posture findings by reachable attack paths and regulated data impact. | (2) Validate the application-specific configuration and customer responsibility model separately from vendor assurances.
- (1) Build an application security inventory with criticality, exposure, ownership and identity dependencies. | (2) Validate the application-specific configuration and customer responsibility model separately from vendor assurances.
Explanation
Correct Answer
A:For requirement (1), Contextual risk matters more than equal treatment of every checklist failure. For requirement (2), Application protection must continue after initial launch and approval. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
B:Requirement (1) is not met: Contextual risk matters more than equal treatment of every checklist failure. The substituted action is instead for this different case: A corporation has hundreds of internal apps but no inventory of their hosting, owners or authentication methods. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (2) is not met: Application protection must continue after initial launch and approval. The substituted action is instead for this different case: A software vendor claims SOC reports prove that every custom configuration of its application is secure. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: Contextual risk matters more than equal treatment of every checklist failure. The substituted action is instead for this different case: A corporation has hundreds of internal apps but no inventory of their hosting, owners or authentication methods. Requirement (2) is not met: Application protection must continue after initial launch and approval. The substituted action is instead for this different case: A software vendor claims SOC reports prove that every custom configuration of its application is secure. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Microsoft Cybersecurity Architect (SC-100) Practice Tests