Question 670
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A pod runs as a privileged root container with host filesystem mounts for routine application logging. (2) Runtime detections are missing for workloads in a managed Kubernetes cluster despite completed image scanning. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Apply least-privilege container runtime settings and eliminate unnecessary host access. | (2) Include image and dependency scanning for the exact release artifact.
- (1) Require trusted registry sources, image vulnerability checks and provenance verification. | (2) Include image and dependency scanning for the exact release artifact.
- (1) Apply least-privilege container runtime settings and eliminate unnecessary host access. | (2) Add supported container runtime detection and managed-cluster threat protection.
- (1) Require trusted registry sources, image vulnerability checks and provenance verification. | (2) Add supported container runtime detection and managed-cluster threat protection.
Explanation
Correct Answer
C:For requirement (1), Privileged containers expand the impact of an application compromise to the host. For requirement (2), Build-time scanning does not observe malicious behavior after deployment. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (2) is not met: Build-time scanning does not observe malicious behavior after deployment. The substituted action is instead for this different case: A team scans source code but never examines third-party packages shipped in the final container image. The proposed bundle therefore cannot satisfy BOTH stated requirements.
B:Requirement (1) is not met: Privileged containers expand the impact of an application compromise to the host. The substituted action is instead for this different case: Developers deploy container images directly from an unverified personal registry into production. Requirement (2) is not met: Build-time scanning does not observe malicious behavior after deployment. The substituted action is instead for this different case: A team scans source code but never examines third-party packages shipped in the final container image. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: Privileged containers expand the impact of an application compromise to the host. The substituted action is instead for this different case: Developers deploy container images directly from an unverified personal registry into production. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 671
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A team moves a policy assignment into enforcement without testing its effect on existing resources. (2) A workload owner requests a permanent exemption from encryption requirements for a short migration. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Evaluate policy compliance and use a phased enforcement rollout with appropriate exemptions. | (2) Issue a time-bounded exception with justification, compensating safeguards and expiration review.
- (1) Apply reviewed infrastructure-as-code changes and detect configuration drift against the declared baseline. | (2) Issue a time-bounded exception with justification, compensating safeguards and expiration review.
- (1) Evaluate policy compliance and use a phased enforcement rollout with appropriate exemptions. | (2) Manage shared security templates through branch review and controlled pipeline promotion.
- (1) Apply reviewed infrastructure-as-code changes and detect configuration drift against the declared baseline. | (2) Manage shared security templates through branch review and controlled pipeline promotion.
Explanation
Correct Answer
A:For requirement (1), Preventive policy can disrupt existing operations if not assessed first. For requirement (2), Exceptions should not silently become enduring gaps in platform policy. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
B:Requirement (1) is not met: Preventive policy can disrupt existing operations if not assessed first. The substituted action is instead for this different case: Administrators make portal edits in production that drift from approved landing-zone templates. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (2) is not met: Exceptions should not silently become enduring gaps in platform policy. The substituted action is instead for this different case: Two teams edit shared network security definitions concurrently without versioned approval. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: Preventive policy can disrupt existing operations if not assessed first. The substituted action is instead for this different case: Administrators make portal edits in production that drift from approved landing-zone templates. Requirement (2) is not met: Exceptions should not silently become enduring gaps in platform policy. The substituted action is instead for this different case: Two teams edit shared network security definitions concurrently without versioned approval. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 672
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) Existing resources violate a required diagnostic-settings policy, but the team assumes a policy assignment changes them retroactively. (2) A compliance team uses an initiative for common controls but cannot identify which resource failed each policy. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Define remediation tasks and managed identities for supported deployIfNotExists policy effects. | (2) Require scoped Azure Policy exemptions with recorded rationale, owner and end date.
- (1) Use a scoped Azure Policy deny or equivalent enforcement effect for prohibited public storage configuration. | (2) Require scoped Azure Policy exemptions with recorded rationale, owner and end date.
- (1) Define remediation tasks and managed identities for supported deployIfNotExists policy effects. | (2) Review initiative compliance at policy and resource levels and collect supporting configuration evidence.
- (1) Use a scoped Azure Policy deny or equivalent enforcement effect for prohibited public storage configuration. | (2) Review initiative compliance at policy and resource levels and collect supporting configuration evidence.
Explanation
Correct Answer
C:For requirement (1), Assessment and remediation are different actions for already-deployed resources. For requirement (2), Aggregated scores cannot replace specific failed-resource findings. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (2) is not met: Aggregated scores cannot replace specific failed-resource findings. The substituted action is instead for this different case: A production subscription receives a temporary security-policy exemption without business justification or expiry. The proposed bundle therefore cannot satisfy BOTH stated requirements.
B:Requirement (1) is not met: Assessment and remediation are different actions for already-deployed resources. The substituted action is instead for this different case: Security standards require all new storage accounts to disable anonymous public blob access. Requirement (2) is not met: Aggregated scores cannot replace specific failed-resource findings. The substituted action is instead for this different case: A production subscription receives a temporary security-policy exemption without business justification or expiry. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: Assessment and remediation are different actions for already-deployed resources. The substituted action is instead for this different case: Security standards require all new storage accounts to disable anonymous public blob access. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 673
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A SQL team reviews vulnerability recommendations but has no way to investigate suspicious database queries. (2) An architect enables all data threat protection plans without assessing resource coverage and ongoing ingestion cost. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Design Defender for Databases threat detection and database audit correlation. | (2) Correlate Defender storage detections with resource identity, workload owner and activity logs.
- (1) Evaluate Microsoft Defender for Storage protection and supported threat detections for the account. | (2) Correlate Defender storage detections with resource identity, workload owner and activity logs.
- (1) Design Defender for Databases threat detection and database audit correlation. | (2) Select Defender data workload plans based on actual protected services, licensing and risk.
- (1) Evaluate Microsoft Defender for Storage protection and supported threat detections for the account. | (2) Select Defender data workload plans based on actual protected services, licensing and risk.
Explanation
Correct Answer
C:For requirement (1), Data-plane attacks require investigation signals beyond posture findings. For requirement (2), Protection choices should be justified by workload exposure and supported capabilities. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (2) is not met: Protection choices should be justified by workload exposure and supported capabilities. The substituted action is instead for this different case: A storage threat alert identifies a suspicious upload but the SOC cannot map it to a specific application owner. The proposed bundle therefore cannot satisfy BOTH stated requirements.
B:Requirement (1) is not met: Data-plane attacks require investigation signals beyond posture findings. The substituted action is instead for this different case: A security architect turns on Defender for Cloud posture recommendations for storage but expects runtime alerts on malicious blob access automatically. Requirement (2) is not met: Protection choices should be justified by workload exposure and supported capabilities. The substituted action is instead for this different case: A storage threat alert identifies a suspicious upload but the SOC cannot map it to a specific application owner. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: Data-plane attacks require investigation signals beyond posture findings. The substituted action is instead for this different case: A security architect turns on Defender for Cloud posture recommendations for storage but expects runtime alerts on malicious blob access automatically. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 674
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) An automation deletes suspicious users immediately based only on a low-confidence anomaly signal. (2) A SOC cannot explain which playbook isolated a device after several overlapping detections. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Design a Logic Apps playbook triggered by validated Sentinel automation rules. | (2) Design action-center review and approval responsibilities into the response workflow.
- (1) Insert evidence checks, human approval and reversible containment before destructive SOAR actions. | (2) Record playbook run IDs, incident links and action outcomes in the response evidence.
- (1) Design a Logic Apps playbook triggered by validated Sentinel automation rules. | (2) Record playbook run IDs, incident links and action outcomes in the response evidence.
- (1) Insert evidence checks, human approval and reversible containment before destructive SOAR actions. | (2) Design action-center review and approval responsibilities into the response workflow.
Explanation
Correct Answer
B:For requirement (1), Security automation must reflect confidence and potential business disruption. For requirement (2), Automation needs traceability to support review, rollback and accountability. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (1) is not met: Security automation must reflect confidence and potential business disruption. The substituted action is instead for this different case: A Sentinel analytic rule produces hundreds of identical alerts, and analysts manually open tickets for each. Requirement (2) is not met: Automation needs traceability to support review, rollback and accountability. The substituted action is instead for this different case: A Defender XDR automated investigation recommends an action that requires approval, but leadership assumes it already executed. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (1) is not met: Security automation must reflect confidence and potential business disruption. The substituted action is instead for this different case: A Sentinel analytic rule produces hundreds of identical alerts, and analysts manually open tickets for each. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (2) is not met: Automation needs traceability to support review, rollback and accountability. The substituted action is instead for this different case: A Defender XDR automated investigation recommends an action that requires approval, but leadership assumes it already executed. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 675
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) An online store is targeted by repetitive automated login attempts, and the team only considers storage encryption. (2) A web workload has public TLS but uses plaintext connections between its internal service and database. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Design bot, rate-limit and identity-abuse defenses in the application ingress architecture. | (2) Enforce authenticated encryption on internal service-to-database traffic where supported.
- (1) Restrict origin access to trusted reverse proxies and protect the approved ingress path. | (2) Enforce authenticated encryption on internal service-to-database traffic where supported.
- (1) Design bot, rate-limit and identity-abuse defenses in the application ingress architecture. | (2) Separate web, application and data tiers using controlled network segmentation.
- (1) Restrict origin access to trusted reverse proxies and protect the approved ingress path. | (2) Separate web, application and data tiers using controlled network segmentation.
Explanation
Correct Answer
A:For requirement (1), Credential stuffing is an application authentication threat rather than a data-at-rest issue. For requirement (2), Internet TLS does not automatically secure backend service communications. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
B:Requirement (1) is not met: Credential stuffing is an application authentication threat rather than a data-at-rest issue. The substituted action is instead for this different case: A public API accepts traffic directly on its application origin even though the architecture diagram shows an edge firewall. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (2) is not met: Internet TLS does not automatically secure backend service communications. The substituted action is instead for this different case: A multi-tier web app places its database and front end in the same unrestricted subnet. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: Credential stuffing is an application authentication threat rather than a data-at-rest issue. The substituted action is instead for this different case: A public API accepts traffic directly on its application origin even though the architecture diagram shows an edge firewall. Requirement (2) is not met: Internet TLS does not automatically secure backend service communications. The substituted action is instead for this different case: A multi-tier web app places its database and front end in the same unrestricted subnet. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 676
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) The AI governance board approves a model but no one owns evaluations for harmful outputs or data leakage. (2) An autonomous AI agent can call production administration tools with the operator's full credentials. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Assign model risk ownership with preproduction safety, privacy and adversarial evaluation gates. | (2) Design scoped agent identities, approval gates and audited tool authorization.
- (1) Perform AI data classification and access-path discovery before selecting the model architecture. | (2) Design scoped agent identities, approval gates and audited tool authorization.
- (1) Assign model risk ownership with preproduction safety, privacy and adversarial evaluation gates. | (2) Define permitted training and fine-tuning data categories and privacy protections.
- (1) Perform AI data classification and access-path discovery before selecting the model architecture. | (2) Define permitted training and fine-tuning data categories and privacy protections.
Explanation
Correct Answer
A:For requirement (1), Model approval needs measurable evidence and accountable remediation of observed safety failures. For requirement (2), An agent must not inherit unrestricted human powers merely because it is asked to automate tasks. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
B:Requirement (1) is not met: Model approval needs measurable evidence and accountable remediation of observed safety failures. The substituted action is instead for this different case: A company wants to deploy an AI assistant to answer HR questions but has not inventoried the sensitive data sources. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (2) is not met: An agent must not inherit unrestricted human powers merely because it is asked to automate tasks. The substituted action is instead for this different case: A team sends every internal document to model tuning without confirming consent or data minimization rules. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: Model approval needs measurable evidence and accountable remediation of observed safety failures. The substituted action is instead for this different case: A company wants to deploy an AI assistant to answer HR questions but has not inventoried the sensitive data sources. Requirement (2) is not met: An agent must not inherit unrestricted human powers merely because it is asked to automate tasks. The substituted action is instead for this different case: A team sends every internal document to model tuning without confirming consent or data minimization rules. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 677
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A phishing case is closed as resolved after mailbox cleanup although attacker-issued OAuth grants remain active. (2) After a breach, investigators have no process to incorporate lessons into detection coverage. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Establish incident severity criteria, ownership and cross-team escalation procedures. | (2) Require confirmation of containment state and follow-up monitoring in incident playbooks.
- (1) Require persistence, identity and token remediation checks before incident closure. | (2) Add post-incident root-cause analysis and detection engineering follow-up to incident governance.
- (1) Establish incident severity criteria, ownership and cross-team escalation procedures. | (2) Add post-incident root-cause analysis and detection engineering follow-up to incident governance.
- (1) Require persistence, identity and token remediation checks before incident closure. | (2) Require confirmation of containment state and follow-up monitoring in incident playbooks.
Explanation
Correct Answer
B:For requirement (1), Removing an initial artifact does not establish that access mechanisms have been removed. For requirement (2), Repeated attack patterns persist if improvements are not linked to incidents. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (1) is not met: Removing an initial artifact does not establish that access mechanisms have been removed. The substituted action is instead for this different case: A critical incident is assigned to several teams without a named incident commander or escalation owner. Requirement (2) is not met: Repeated attack patterns persist if improvements are not linked to incidents. The substituted action is instead for this different case: Analysts isolate a server but no one validates whether that response action actually completed. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (1) is not met: Removing an initial artifact does not establish that access mechanisms have been removed. The substituted action is instead for this different case: A critical incident is assigned to several teams without a named incident commander or escalation owner. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (2) is not met: Repeated attack patterns persist if improvements are not linked to incidents. The substituted action is instead for this different case: Analysts isolate a server but no one validates whether that response action actually completed. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 678
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) An AI model accesses a document index containing unrelated departments' confidential files. (2) An AI service sends model prompts into logs containing personal identifiers with indefinite retention. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Design user-aware retrieval security and filtered document access in the AI workload. | (2) Treat model input and retrieved text as untrusted, and gate privileged tool execution with policy.
- (1) Require supported authentication and network restrictions for Azure AI service endpoints. | (2) Treat model input and retrieved text as untrusted, and gate privileged tool execution with policy.
- (1) Design user-aware retrieval security and filtered document access in the AI workload. | (2) Apply data minimization, log access restrictions and approved retention for AI prompts and outputs.
- (1) Require supported authentication and network restrictions for Azure AI service endpoints. | (2) Apply data minimization, log access restrictions and approved retention for AI prompts and outputs.
Explanation
Correct Answer
C:For requirement (1), AI applications must respect original data entitlements during retrieval. For requirement (2), AI operational telemetry can itself contain sensitive regulated content. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (2) is not met: AI operational telemetry can itself contain sensitive regulated content. The substituted action is instead for this different case: A prompt-injection attack asks an AI assistant to run a privileged management API call. The proposed bundle therefore cannot satisfy BOTH stated requirements.
B:Requirement (1) is not met: AI applications must respect original data entitlements during retrieval. The substituted action is instead for this different case: An Azure AI service endpoint allows public anonymous queries because its output includes safety moderation. Requirement (2) is not met: AI operational telemetry can itself contain sensitive regulated content. The substituted action is instead for this different case: A prompt-injection attack asks an AI assistant to run a privileged management API call. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: AI applications must respect original data entitlements during retrieval. The substituted action is instead for this different case: An Azure AI service endpoint allows public anonymous queries because its output includes safety moderation. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 679
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A hospital has recovery objectives but has never quantified the maximum permissible data loss for patient scheduling. (2) Executives prioritize systems only by purchase cost, ignoring the operational harm of a manufacturing shutdown. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Perform a business impact analysis and map revenue-critical services to accountable owners and dependencies. | (2) Rank cybersecurity recovery priorities using safety, outage impact and critical business processes rather than asset price alone.
- (1) Define a documented recovery point objective for the scheduling data and validate it against clinical risk. | (2) Build a dependency map and test recovery of the identity, network and data services required by order processing.
- (1) Perform a business impact analysis and map revenue-critical services to accountable owners and dependencies. | (2) Build a dependency map and test recovery of the identity, network and data services required by order processing.
- (1) Define a documented recovery point objective for the scheduling data and validate it against clinical risk. | (2) Rank cybersecurity recovery priorities using safety, outage impact and critical business processes rather than asset price alone.
Explanation
Correct Answer
D:For requirement (1), RPO specifies acceptable data loss and drives backup and replication design rather than merely restoration time. For requirement (2), Criticality reflects consequences for the mission and safety, not only the acquisition cost of hardware. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (1) is not met: RPO specifies acceptable data loss and drives backup and replication design rather than merely restoration time. The substituted action is instead for this different case: A retailer cannot decide which workloads to restore first because all servers have equal priority labels. The proposed bundle therefore cannot satisfy BOTH stated requirements.
B:Requirement (2) is not met: Criticality reflects consequences for the mission and safety, not only the acquisition cost of hardware. The substituted action is instead for this different case: A distribution firm promises one-hour recovery without identifying the network and identity systems its order platform needs. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (1) is not met: RPO specifies acceptable data loss and drives backup and replication design rather than merely restoration time. The substituted action is instead for this different case: A retailer cannot decide which workloads to restore first because all servers have equal priority labels. Requirement (2) is not met: Criticality reflects consequences for the mission and safety, not only the acquisition cost of hardware. The substituted action is instead for this different case: A distribution firm promises one-hour recovery without identifying the network and identity systems its order platform needs. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 680
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A Secure Score rises after a control receives an exception status although the underlying user access configuration is unchanged. (2) The security architect wants to prioritize tenant security improvements but cannot quantify the impact of disrupting daily collaboration. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Distinguish Secure Score acceptance states from verified technical control enforcement. | (2) Rank Microsoft 365 hardening measures by exposure, business dependencies and tested rollout impact.
- (1) Evaluate Microsoft Secure Score recommendations and effective protection for Microsoft 365 workloads. | (2) Rank Microsoft 365 hardening measures by exposure, business dependencies and tested rollout impact.
- (1) Distinguish Secure Score acceptance states from verified technical control enforcement. | (2) Normalize posture assessment for licensed controls, coverage and business-critical workloads.
- (1) Evaluate Microsoft Secure Score recommendations and effective protection for Microsoft 365 workloads. | (2) Normalize posture assessment for licensed controls, coverage and business-critical workloads.
Explanation
Correct Answer
A:For requirement (1), Assessment scores may not prove an unsafe configuration has been repaired. For requirement (2), Security priorities should integrate risk reduction and operating continuity. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
B:Requirement (1) is not met: Assessment scores may not prove an unsafe configuration has been repaired. The substituted action is instead for this different case: A collaboration tenant has several risky sharing settings but leadership only tracks purchased security licenses. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (2) is not met: Security priorities should integrate risk reduction and operating continuity. The substituted action is instead for this different case: An architect compares two Microsoft 365 tenants' security scores without considering their different licensed feature sets. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: Assessment scores may not prove an unsafe configuration has been repaired. The substituted action is instead for this different case: A collaboration tenant has several risky sharing settings but leadership only tracks purchased security licenses. Requirement (2) is not met: Security priorities should integrate risk reduction and operating continuity. The substituted action is instead for this different case: An architect compares two Microsoft 365 tenants' security scores without considering their different licensed feature sets. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Microsoft Cybersecurity Architect (SC-100) Practice Tests