Question 660
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) An application assessment scores a public healthcare API and an internal demo app equally because both lack one HTTP header. (2) A security board authorizes a new application but no one owns future dependency updates. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Prioritize application posture findings by reachable attack paths and regulated data impact. | (2) Assign application security ownership and a funded vulnerability management lifecycle.
- (1) Build an application security inventory with criticality, exposure, ownership and identity dependencies. | (2) Assign application security ownership and a funded vulnerability management lifecycle.
- (1) Prioritize application posture findings by reachable attack paths and regulated data impact. | (2) Validate the application-specific configuration and customer responsibility model separately from vendor assurances.
- (1) Build an application security inventory with criticality, exposure, ownership and identity dependencies. | (2) Validate the application-specific configuration and customer responsibility model separately from vendor assurances.
Explanation
Correct Answer
A:For requirement (1), Contextual risk matters more than equal treatment of every checklist failure. For requirement (2), Application protection must continue after initial launch and approval. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
B:Requirement (1) is not met: Contextual risk matters more than equal treatment of every checklist failure. The substituted action is instead for this different case: A corporation has hundreds of internal apps but no inventory of their hosting, owners or authentication methods. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (2) is not met: Application protection must continue after initial launch and approval. The substituted action is instead for this different case: A software vendor claims SOC reports prove that every custom configuration of its application is secure. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: Contextual risk matters more than equal treatment of every checklist failure. The substituted action is instead for this different case: A corporation has hundreds of internal apps but no inventory of their hosting, owners or authentication methods. Requirement (2) is not met: Application protection must continue after initial launch and approval. The substituted action is instead for this different case: A software vendor claims SOC reports prove that every custom configuration of its application is secure. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 661
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) An Azure VM owner assumes Microsoft patches every custom application installed inside the guest. (2) The same baseline is applied without adaptation to Kubernetes nodes, managed SQL and Microsoft 365. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Define customer-owned SaaS identity, sharing and data-protection configuration requirements. | (2) Create service-model-specific control profiles anchored in shared enterprise security requirements.
- (1) Allocate customer responsibility for guest OS and application security under the IaaS service model. | (2) Require application identity, authorization and secret controls for PaaS workloads.
- (1) Define customer-owned SaaS identity, sharing and data-protection configuration requirements. | (2) Require application identity, authorization and secret controls for PaaS workloads.
- (1) Allocate customer responsibility for guest OS and application security under the IaaS service model. | (2) Create service-model-specific control profiles anchored in shared enterprise security requirements.
Explanation
Correct Answer
D:For requirement (1), IaaS customers remain responsible for many workload and software controls. For requirement (2), IaaS, PaaS and SaaS expose different customer-configurable control surfaces. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (1) is not met: IaaS customers remain responsible for many workload and software controls. The substituted action is instead for this different case: A workload team assumes a SaaS provider automatically controls which internal employees can export confidential files. The proposed bundle therefore cannot satisfy BOTH stated requirements.
B:Requirement (2) is not met: IaaS, PaaS and SaaS expose different customer-configurable control surfaces. The substituted action is instead for this different case: A PaaS application team disables authentication because the underlying service platform already uses encryption. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (1) is not met: IaaS customers remain responsible for many workload and software controls. The substituted action is instead for this different case: A workload team assumes a SaaS provider automatically controls which internal employees can export confidential files. Requirement (2) is not met: IaaS, PaaS and SaaS expose different customer-configurable control surfaces. The substituted action is instead for this different case: A PaaS application team disables authentication because the underlying service platform already uses encryption. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 662
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A database export crosses a legal jurisdiction without a documented business purpose or residency assessment. (2) A project retires a cloud application but leaves external vendors with active keys to its archived data. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Conduct third-party data-processing due diligence and define contractual security obligations. | (2) Include credential revocation and third-party access closure in the data decommissioning plan.
- (1) Evaluate cross-border data movement restrictions and design approved transfer controls before exporting. | (2) Approve time-limited narrowly scoped vendor access with monitored sessions and expiry.
- (1) Conduct third-party data-processing due diligence and define contractual security obligations. | (2) Approve time-limited narrowly scoped vendor access with monitored sessions and expiry.
- (1) Evaluate cross-border data movement restrictions and design approved transfer controls before exporting. | (2) Include credential revocation and third-party access closure in the data decommissioning plan.
Explanation
Correct Answer
D:For requirement (1), Data transfers may trigger obligations that network encryption alone cannot satisfy. For requirement (2), Retired workloads can retain accessible sensitive data if external grants persist. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (1) is not met: Data transfers may trigger obligations that network encryption alone cannot satisfy. The substituted action is instead for this different case: A SaaS supplier will process regulated customer data but the security team has not assessed its subcontractors. The proposed bundle therefore cannot satisfy BOTH stated requirements.
B:Requirement (2) is not met: Retired workloads can retain accessible sensitive data if external grants persist. The substituted action is instead for this different case: A vendor requests unrestricted production database access to provide temporary support. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (1) is not met: Data transfers may trigger obligations that network encryption alone cannot satisfy. The substituted action is instead for this different case: A SaaS supplier will process regulated customer data but the security team has not assessed its subcontractors. Requirement (2) is not met: Retired workloads can retain accessible sensitive data if external grants persist. The substituted action is instead for this different case: A vendor requests unrestricted production database access to provide temporary support. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 663
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A model deployment accepts unfiltered user prompts that may cause the assistant to reveal privileged system instructions. (2) An AI team enables broad model endpoint access because it assumes safety filters also restrict callers. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Include prompt-injection threat modeling and policy-enforced tool and data boundaries around the model. | (2) Establish AI data-handling requirements for storage, processing locations and vendor agreements before approval.
- (1) Restrict retrieval to user-authorized content and enforce data-plane access controls in the AI pipeline. | (2) Establish AI data-handling requirements for storage, processing locations and vendor agreements before approval.
- (1) Include prompt-injection threat modeling and policy-enforced tool and data boundaries around the model. | (2) Enforce model endpoint authentication, authorization and logging independently of content safety controls.
- (1) Restrict retrieval to user-authorized content and enforce data-plane access controls in the AI pipeline. | (2) Enforce model endpoint authentication, authorization and logging independently of content safety controls.
Explanation
Correct Answer
C:For requirement (1), Untrusted prompts must not be treated as authority to use privileged tools or disclose protected context. For requirement (2), Content filtering evaluates outputs but does not substitute for access control to model resources. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (2) is not met: Content filtering evaluates outputs but does not substitute for access control to model resources. The substituted action is instead for this different case: A chatbot sends sensitive prompts to a third-party service without documenting retention or residency terms. The proposed bundle therefore cannot satisfy BOTH stated requirements.
B:Requirement (1) is not met: Untrusted prompts must not be treated as authority to use privileged tools or disclose protected context. The substituted action is instead for this different case: A generative AI application can read unrelated customer records through its retrieval index. Requirement (2) is not met: Content filtering evaluates outputs but does not substitute for access control to model resources. The substituted action is instead for this different case: A chatbot sends sensitive prompts to a third-party service without documenting retention or residency terms. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: Untrusted prompts must not be treated as authority to use privileged tools or disclose protected context. The substituted action is instead for this different case: A generative AI application can read unrelated customer records through its retrieval index. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 664
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) The exposure team treats every modeled attack path as evidence that an adversary has already traversed it. (2) Two teams independently patch the same low-impact issue while a high-risk identity-to-server path remains open. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Use Security Exposure Management attack paths and asset criticality to prioritize the chained risk. | (2) Design a measurable exposure-management initiative review with consistent scope and trend baselines.
- (1) Distinguish modeled exposure relationships from confirmed compromise telemetry and incident evidence. | (2) Coordinate remediation priorities across endpoint and identity owners using attack-path analysis.
- (1) Use Security Exposure Management attack paths and asset criticality to prioritize the chained risk. | (2) Coordinate remediation priorities across endpoint and identity owners using attack-path analysis.
- (1) Distinguish modeled exposure relationships from confirmed compromise telemetry and incident evidence. | (2) Design a measurable exposure-management initiative review with consistent scope and trend baselines.
Explanation
Correct Answer
B:For requirement (1), Risk graph edges show possible paths, not proof of actual execution. For requirement (2), Cross-domain attack paths require joint mitigation rather than isolated asset queues. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (1) is not met: Risk graph edges show possible paths, not proof of actual execution. The substituted action is instead for this different case: A vulnerable workstation links to a privileged service account, but teams prioritize only by its standalone CVSS number. Requirement (2) is not met: Cross-domain attack paths require joint mitigation rather than isolated asset queues. The substituted action is instead for this different case: A security program wants to track whether strategic exposure-reduction initiatives improve over several months. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (1) is not met: Risk graph edges show possible paths, not proof of actual execution. The substituted action is instead for this different case: A vulnerable workstation links to a privileged service account, but teams prioritize only by its standalone CVSS number. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (2) is not met: Cross-domain attack paths require joint mitigation rather than isolated asset queues. The substituted action is instead for this different case: A security program wants to track whether strategic exposure-reduction initiatives improve over several months. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 665
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A privileged role activation proceeds without approval even though high-impact changes require a second person. (2) The SOC cannot identify who activated a privileged role just before suspicious tenant configuration changes. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Configure approval and justification in the applicable PIM activation policy. | (2) Review PIM eligibility periodically and revoke assignments without current business sponsorship.
- (1) Use Entra Privileged Identity Management eligible assignments with time-bounded activation. | (2) Review PIM eligibility periodically and revoke assignments without current business sponsorship.
- (1) Configure approval and justification in the applicable PIM activation policy. | (2) Use PIM activation and directory audit history to reconstruct the elevation timeline.
- (1) Use Entra Privileged Identity Management eligible assignments with time-bounded activation. | (2) Use PIM activation and directory audit history to reconstruct the elevation timeline.
Explanation
Correct Answer
C:For requirement (1), Privilege elevation can be gated on accountable independent authorization. For requirement (2), Traceable activation events connect privileged authority to specific actions and dates. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (2) is not met: Traceable activation events connect privileged authority to specific actions and dates. The substituted action is instead for this different case: A former contractor remains eligible for Global Administrator role activation months after their project ends. The proposed bundle therefore cannot satisfy BOTH stated requirements.
B:Requirement (1) is not met: Privilege elevation can be gated on accountable independent authorization. The substituted action is instead for this different case: A security engineer needs elevated directory permissions for one maintenance window but currently holds them permanently. Requirement (2) is not met: Traceable activation events connect privileged authority to specific actions and dates. The substituted action is instead for this different case: A former contractor remains eligible for Global Administrator role activation months after their project ends. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: Privilege elevation can be gated on accountable independent authorization. The substituted action is instead for this different case: A security engineer needs elevated directory permissions for one maintenance window but currently holds them permanently. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 666
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A prompt contains untrusted instructions telling a tool-using model to disclose the full hidden customer dataset. (2) A generative AI team logs raw confidential prompts for debugging but cannot define who is permitted to access them. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Design prompt-injection defenses with explicit tool permission and output-data boundaries. | (2) Limit AI prompt telemetry, mask sensitive fields and enforce approved retention and audit permissions.
- (1) Enforce user-context data authorization before returning retrieved passages to the model. | (2) Limit AI prompt telemetry, mask sensitive fields and enforce approved retention and audit permissions.
- (1) Design prompt-injection defenses with explicit tool permission and output-data boundaries. | (2) Apply data minimization, restricted processing locations and controlled storage to training datasets.
- (1) Enforce user-context data authorization before returning retrieved passages to the model. | (2) Apply data minimization, restricted processing locations and controlled storage to training datasets.
Explanation
Correct Answer
A:For requirement (1), Model instruction filters cannot replace independent enforcement on protected data tools. For requirement (2), Generated and submitted content can contain regulated information needing protective handling. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
B:Requirement (1) is not met: Model instruction filters cannot replace independent enforcement on protected data tools. The substituted action is instead for this different case: A retrieval AI assistant indexes confidential board documents for all employees without honoring SharePoint permissions. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (2) is not met: Generated and submitted content can contain regulated information needing protective handling. The substituted action is instead for this different case: A model training job copies regulated customer records into a globally shared temporary storage account. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: Model instruction filters cannot replace independent enforcement on protected data tools. The substituted action is instead for this different case: A retrieval AI assistant indexes confidential board documents for all employees without honoring SharePoint permissions. Requirement (2) is not met: Generated and submitted content can contain regulated information needing protective handling. The substituted action is instead for this different case: A model training job copies regulated customer records into a globally shared temporary storage account. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 667
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) An exposure report shows an unknown domain and administrators assume the organization owns it. (2) A business removes a legacy service but external scanners still find the previous endpoint. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Use Defender External Attack Surface Management discovery to inventory internet-visible assets. | (2) Reconcile EASM findings with decommissioning and verify public DNS and hosting retirement.
- (1) Validate attribution and ownership before treating discovered infrastructure as an enterprise asset. | (2) Link discovered internet-facing assets to application owners and prioritize exposed authentication surfaces.
- (1) Use Defender External Attack Surface Management discovery to inventory internet-visible assets. | (2) Link discovered internet-facing assets to application owners and prioritize exposed authentication surfaces.
- (1) Validate attribution and ownership before treating discovered infrastructure as an enterprise asset. | (2) Reconcile EASM findings with decommissioning and verify public DNS and hosting retirement.
Explanation
Correct Answer
D:For requirement (1), Discovery signals require evidence before responsibility or remediation is assigned. For requirement (2), Internet-facing exposure can persist after internal retirement records say a service is gone. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (1) is not met: Discovery signals require evidence before responsibility or remediation is assigned. The substituted action is instead for this different case: The security team knows internal IP addresses but not the public domains and hosts registered by acquired subsidiaries. The proposed bundle therefore cannot satisfy BOTH stated requirements.
B:Requirement (2) is not met: Internet-facing exposure can persist after internal retirement records say a service is gone. The substituted action is instead for this different case: An externally accessible test API contains a stale authentication endpoint, but no business owner is listed. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (1) is not met: Discovery signals require evidence before responsibility or remediation is assigned. The substituted action is instead for this different case: The security team knows internal IP addresses but not the public domains and hosts registered by acquired subsidiaries. Requirement (2) is not met: Internet-facing exposure can persist after internal retirement records say a service is gone. The substituted action is instead for this different case: An externally accessible test API contains a stale authentication endpoint, but no business owner is listed. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 668
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) An Arc deployment script embeds a long-lived tenant secret with unrestricted resource creation rights. (2) An application team assumes Arc-enabled machines automatically become full Azure virtual machines for every control. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Connect eligible non-Azure machines using Azure Arc-enabled servers and approved onboarding methods. | (2) Confirm feature support and shared operational responsibilities for Arc-enabled non-Azure servers.
- (1) Use a controlled onboarding identity and rotate bootstrap credentials with least-privilege permissions. | (2) Validate desired extension deployment and policy compliance across Arc-enabled resource groups.
- (1) Connect eligible non-Azure machines using Azure Arc-enabled servers and approved onboarding methods. | (2) Validate desired extension deployment and policy compliance across Arc-enabled resource groups.
- (1) Use a controlled onboarding identity and rotate bootstrap credentials with least-privilege permissions. | (2) Confirm feature support and shared operational responsibilities for Arc-enabled non-Azure servers.
Explanation
Correct Answer
D:For requirement (1), Hybrid management agents must not create an uncontrolled credential exposure path. For requirement (2), Azure Arc extends selected management capabilities without replacing the original hosting environment. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (1) is not met: Hybrid management agents must not create an uncontrolled credential exposure path. The substituted action is instead for this different case: On-premises Linux servers are excluded from Azure inventory and policy compliance checks. The proposed bundle therefore cannot satisfy BOTH stated requirements.
B:Requirement (2) is not met: Azure Arc extends selected management capabilities without replacing the original hosting environment. The substituted action is instead for this different case: A Linux estate appears Arc-connected but security extensions are missing on half the servers. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (1) is not met: Hybrid management agents must not create an uncontrolled credential exposure path. The substituted action is instead for this different case: On-premises Linux servers are excluded from Azure inventory and policy compliance checks. Requirement (2) is not met: Azure Arc extends selected management capabilities without replacing the original hosting environment. The substituted action is instead for this different case: A Linux estate appears Arc-connected but security extensions are missing on half the servers. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 669
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A program proposes one global firewall as a substitute for application, identity and data security controls. (2) A merger introduces a new cloud estate but the reference architecture has not mapped its administrative trust boundaries. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Design defense in depth with distinct controls across identities, devices, applications, network and data. | (2) Extend trust-boundary diagrams to cover both organizations and their cross-tenant connections.
- (1) Map security requirements to Microsoft Cybersecurity Reference Architectures capabilities before selecting products. | (2) Extend trust-boundary diagrams to cover both organizations and their cross-tenant connections.
- (1) Design defense in depth with distinct controls across identities, devices, applications, network and data. | (2) Assign control owners, measurable assurance evidence and escalation paths for each architecture capability.
- (1) Map security requirements to Microsoft Cybersecurity Reference Architectures capabilities before selecting products. | (2) Assign control owners, measurable assurance evidence and escalation paths for each architecture capability.
Explanation
Correct Answer
A:For requirement (1), No single perimeter control replaces workload-specific authorization and protection. For requirement (2), Security architecture must represent newly introduced identity boundaries and lateral-movement paths. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
B:Requirement (1) is not met: No single perimeter control replaces workload-specific authorization and protection. The substituted action is instead for this different case: An enterprise compares two security tool purchases without first defining which identity, network and data threats must be covered. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (2) is not met: Security architecture must represent newly introduced identity boundaries and lateral-movement paths. The substituted action is instead for this different case: A regional team wants to deploy controls without identifying the owner responsible for operating them. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: No single perimeter control replaces workload-specific authorization and protection. The substituted action is instead for this different case: An enterprise compares two security tool purchases without first defining which identity, network and data threats must be covered. Requirement (2) is not met: Security architecture must represent newly introduced identity boundaries and lateral-movement paths. The substituted action is instead for this different case: A regional team wants to deploy controls without identifying the owner responsible for operating them. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 670
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A pod runs as a privileged root container with host filesystem mounts for routine application logging. (2) Runtime detections are missing for workloads in a managed Kubernetes cluster despite completed image scanning. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Apply least-privilege container runtime settings and eliminate unnecessary host access. | (2) Include image and dependency scanning for the exact release artifact.
- (1) Require trusted registry sources, image vulnerability checks and provenance verification. | (2) Include image and dependency scanning for the exact release artifact.
- (1) Apply least-privilege container runtime settings and eliminate unnecessary host access. | (2) Add supported container runtime detection and managed-cluster threat protection.
- (1) Require trusted registry sources, image vulnerability checks and provenance verification. | (2) Add supported container runtime detection and managed-cluster threat protection.
Explanation
Correct Answer
C:For requirement (1), Privileged containers expand the impact of an application compromise to the host. For requirement (2), Build-time scanning does not observe malicious behavior after deployment. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (2) is not met: Build-time scanning does not observe malicious behavior after deployment. The substituted action is instead for this different case: A team scans source code but never examines third-party packages shipped in the final container image. The proposed bundle therefore cannot satisfy BOTH stated requirements.
B:Requirement (1) is not met: Privileged containers expand the impact of an application compromise to the host. The substituted action is instead for this different case: Developers deploy container images directly from an unverified personal registry into production. Requirement (2) is not met: Build-time scanning does not observe malicious behavior after deployment. The substituted action is instead for this different case: A team scans source code but never examines third-party packages shipped in the final container image. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: Privileged containers expand the impact of an application compromise to the host. The substituted action is instead for this different case: Developers deploy container images directly from an unverified personal registry into production. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Microsoft Cybersecurity Architect (SC-100) Practice Tests