Question 700
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) An application cannot immediately apply a required patch because its availability architecture has no maintenance window. (2) A security recommendation remains unresolved after the repair team claims the fix was applied. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Sequence fixes by exploitability, business impact and protected resource criticality. | (2) Normalize posture comparisons for coverage, eligibility and differing assessed resource populations.
- (1) Define time-limited compensating controls and a verified service-safe patch schedule. | (2) Verify observed effective configuration and assessment refresh before closing the recommendation.
- (1) Sequence fixes by exploitability, business impact and protected resource criticality. | (2) Verify observed effective configuration and assessment refresh before closing the recommendation.
- (1) Define time-limited compensating controls and a verified service-safe patch schedule. | (2) Normalize posture comparisons for coverage, eligibility and differing assessed resource populations.
Explanation
Correct Answer
B:For requirement (1), Operational constraints can be managed without disregarding the vulnerability. For requirement (2), Remediation is complete only when the target state and evidence reflect the desired control. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (1) is not met: Operational constraints can be managed without disregarding the vulnerability. The substituted action is instead for this different case: A Defender posture report shows hundreds of failed checks but the team lacks a risk-ranked remediation plan. Requirement (2) is not met: Remediation is complete only when the target state and evidence reflect the desired control. The substituted action is instead for this different case: A compliance analyst compares two tenants' Secure Scores without considering different product licenses and monitored assets. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (1) is not met: Operational constraints can be managed without disregarding the vulnerability. The substituted action is instead for this different case: A Defender posture report shows hundreds of failed checks but the team lacks a risk-ranked remediation plan. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (2) is not met: Remediation is complete only when the target state and evidence reflect the desired control. The substituted action is instead for this different case: A compliance analyst compares two tenants' Secure Scores without considering different product licenses and monitored assets. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 701
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A firmware update service accepts unsigned update packages from a writable public bucket. (2) An edge gateway caches sensitive sensor data indefinitely after devices are retired. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Require signed firmware artifacts and restricted update distribution with rollback safeguards. | (2) Authenticate senders and validate command authorization and schema at the IoT service boundary.
- (1) Provision per-device identities and revoke individual compromised devices without changing all peers. | (2) Authenticate senders and validate command authorization and schema at the IoT service boundary.
- (1) Require signed firmware artifacts and restricted update distribution with rollback safeguards. | (2) Define edge-data encryption, retention and secure wipe requirements for IoT decommissioning.
- (1) Provision per-device identities and revoke individual compromised devices without changing all peers. | (2) Define edge-data encryption, retention and secure wipe requirements for IoT decommissioning.
Explanation
Correct Answer
C:For requirement (1), Device trust depends on verifiable software provenance before installing updates. For requirement (2), Device lifecycle includes safeguarding residual local data and credentials. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (2) is not met: Device lifecycle includes safeguarding residual local data and credentials. The substituted action is instead for this different case: A cloud function processes device telemetry without validating which device supplied a command message. The proposed bundle therefore cannot satisfy BOTH stated requirements.
B:Requirement (1) is not met: Device trust depends on verifiable software provenance before installing updates. The substituted action is instead for this different case: IoT devices authenticate to a cloud hub using one credential shared by the full fleet. Requirement (2) is not met: Device lifecycle includes safeguarding residual local data and credentials. The substituted action is instead for this different case: A cloud function processes device telemetry without validating which device supplied a command message. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: Device trust depends on verifiable software provenance before installing updates. The substituted action is instead for this different case: IoT devices authenticate to a cloud hub using one credential shared by the full fleet. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 702
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A Cloud Sync design omits agent redundancy even though on-premises directory provisioning is business-critical. (2) The team moves user objects between source OUs without assessing deletion effects in the cloud directory. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Define authoritative identity source and matching rules before enabling hybrid provisioning. | (2) Validate synchronization scope changes and accidental-delete protections before exporting.
- (1) Design supported redundant provisioning agents and monitor synchronization health. | (2) Federate workload administration to governed identities and enforce provider-specific least privilege.
- (1) Define authoritative identity source and matching rules before enabling hybrid provisioning. | (2) Federate workload administration to governed identities and enforce provider-specific least privilege.
- (1) Design supported redundant provisioning agents and monitor synchronization health. | (2) Validate synchronization scope changes and accidental-delete protections before exporting.
Explanation
Correct Answer
D:For requirement (1), Identity lifecycle resilience depends on the availability of the provisioning pathway. For requirement (2), Moving objects out of scope can trigger unintentional cloud deprovisioning. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (1) is not met: Identity lifecycle resilience depends on the availability of the provisioning pathway. The substituted action is instead for this different case: A hybrid organization creates cloud identities independently of local AD and users appear twice after synchronization. The proposed bundle therefore cannot satisfy BOTH stated requirements.
B:Requirement (2) is not met: Moving objects out of scope can trigger unintentional cloud deprovisioning. The substituted action is instead for this different case: A multicloud team reuses one shared cloud administrator password across AWS and Azure consoles. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (1) is not met: Identity lifecycle resilience depends on the availability of the provisioning pathway. The substituted action is instead for this different case: A hybrid organization creates cloud identities independently of local AD and users appear twice after synchronization. Requirement (2) is not met: Moving objects out of scope can trigger unintentional cloud deprovisioning. The substituted action is instead for this different case: A multicloud team reuses one shared cloud administrator password across AWS and Azure consoles. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 703
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A multicloud program needs comparable cloud-security assessments across AWS and Azure but has only onboarded Azure. (2) A control's compliance state changes after the security team modifies its underlying cloud policy but never reviews effects. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Evaluate Defender for Cloud regulatory compliance standards and their mapped assessment evidence. | (2) Track compliance trends and reassess benchmark mapping after changes to policy or resource scope.
- (1) Design eligible Defender for Cloud multicloud connectors and verify assessment coverage per account. | (2) Validate manual procedures, application responsibilities and excluded assets alongside automated assessments.
- (1) Evaluate Defender for Cloud regulatory compliance standards and their mapped assessment evidence. | (2) Validate manual procedures, application responsibilities and excluded assets alongside automated assessments.
- (1) Design eligible Defender for Cloud multicloud connectors and verify assessment coverage per account. | (2) Track compliance trends and reassess benchmark mapping after changes to policy or resource scope.
Explanation
Correct Answer
D:For requirement (1), Unconnected environments create blind spots in consolidated regulatory monitoring. For requirement (2), Control evaluation results depend on the active baseline and monitored inventory. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (1) is not met: Unconnected environments create blind spots in consolidated regulatory monitoring. The substituted action is instead for this different case: A bank wants a view of cloud resources aligned to a particular benchmark across Azure subscriptions. The proposed bundle therefore cannot satisfy BOTH stated requirements.
B:Requirement (2) is not met: Control evaluation results depend on the active baseline and monitored inventory. The substituted action is instead for this different case: The audit team mistakes a green Defender for Cloud regulatory dashboard for a guarantee of legal compliance. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (1) is not met: Unconnected environments create blind spots in consolidated regulatory monitoring. The substituted action is instead for this different case: A bank wants a view of cloud resources aligned to a particular benchmark across Azure subscriptions. Requirement (2) is not met: Control evaluation results depend on the active baseline and monitored inventory. The substituted action is instead for this different case: The audit team mistakes a green Defender for Cloud regulatory dashboard for a guarantee of legal compliance. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 704
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) The SOC wants to preserve forensic evidence while operations teams demand an immediate full wipe of affected systems. (2) A site failover test reports success because a VM boots, yet user authentication and dependent APIs remain inaccessible. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Validate backup recovery points and restore in an isolated clean environment before reconnecting workloads. | (2) Add business reconciliation and integrity checks before declaring financial service recovery complete.
- (1) Coordinate forensic preservation and priority restoration using segregated evidence and recovery environments. | (2) Define end-to-end application recovery acceptance tests including identity, network and dependent service calls.
- (1) Validate backup recovery points and restore in an isolated clean environment before reconnecting workloads. | (2) Define end-to-end application recovery acceptance tests including identity, network and dependent service calls.
- (1) Coordinate forensic preservation and priority restoration using segregated evidence and recovery environments. | (2) Add business reconciliation and integrity checks before declaring financial service recovery complete.
Explanation
Correct Answer
B:For requirement (1), Recovery planning should prevent unnecessary evidence destruction while allowing essential services to resume. For requirement (2), A virtual machine startup alone cannot validate an end-user recovery objective. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (1) is not met: Recovery planning should prevent unnecessary evidence destruction while allowing essential services to resume. The substituted action is instead for this different case: Backups contain executable images from the period when attackers already had domain administrator access. Requirement (2) is not met: A virtual machine startup alone cannot validate an end-user recovery objective. The substituted action is instead for this different case: A critical financial workload is restored but no one compares its ledger balance to the last trusted state. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (1) is not met: Recovery planning should prevent unnecessary evidence destruction while allowing essential services to resume. The substituted action is instead for this different case: Backups contain executable images from the period when attackers already had domain administrator access. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (2) is not met: A virtual machine startup alone cannot validate an end-user recovery objective. The substituted action is instead for this different case: A critical financial workload is restored but no one compares its ledger balance to the last trusted state. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 705
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A legal records system has a five-year retention policy, and its owner assumes that policy is equivalent to point-in-time backups. (2) A hybrid estate needs protection from a cloud-region failure while avoiding backups confined to that same region. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Specify independent backup and restoration controls in addition to legal retention enforcement. | (2) Place recovery data in approved geographically independent locations and validate regional-failover dependencies.
- (1) Design isolated, access-restricted and immutable backup copies with independent administration. | (2) Place recovery data in approved geographically independent locations and validate regional-failover dependencies.
- (1) Specify independent backup and restoration controls in addition to legal retention enforcement. | (2) Schedule integrity-checked recovery tests that measure actual restore time and application consistency.
- (1) Design isolated, access-restricted and immutable backup copies with independent administration. | (2) Schedule integrity-checked recovery tests that measure actual restore time and application consistency.
Explanation
Correct Answer
A:For requirement (1), Compliance retention preserves governed records while recoverable versions and tested restore workflows address operational failure. For requirement (2), Regional fault isolation requires recovery resources that do not share the unavailable location's failure domain. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
B:Requirement (1) is not met: Compliance retention preserves governed records while recoverable versions and tested restore workflows address operational failure. The substituted action is instead for this different case: A company stores daily backups under the same highly privileged credentials as production and ransomware encrypts both. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (2) is not met: Regional fault isolation requires recovery resources that do not share the unavailable location's failure domain. The substituted action is instead for this different case: A cloud storage backup exists but no administrator has successfully restored a sample application. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: Compliance retention preserves governed records while recoverable versions and tested restore workflows address operational failure. The substituted action is instead for this different case: A company stores daily backups under the same highly privileged credentials as production and ransomware encrypts both. Requirement (2) is not met: Regional fault isolation requires recovery resources that do not share the unavailable location's failure domain. The substituted action is instead for this different case: A cloud storage backup exists but no administrator has successfully restored a sample application. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 706
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A compliance board assumes prompt safety filters prevent leakage from an over-permissioned document corpus. (2) A security architect cannot explain which user actions and protected data sources Copilot accessed during an incident. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Separate AI content safety from underlying data permission and labeling governance. | (2) Design supported Copilot audit and activity-monitoring evidence with privacy-aware access.
- (1) Remediate excessive SharePoint and Microsoft 365 content permissions before broad Copilot rollout. | (2) Design supported Copilot audit and activity-monitoring evidence with privacy-aware access.
- (1) Separate AI content safety from underlying data permission and labeling governance. | (2) Evaluate supported Microsoft Purview DLP and information-protection controls for Copilot interactions.
- (1) Remediate excessive SharePoint and Microsoft 365 content permissions before broad Copilot rollout. | (2) Evaluate supported Microsoft Purview DLP and information-protection controls for Copilot interactions.
Explanation
Correct Answer
A:For requirement (1), Safety filters do not replace ACLs on retrieved business documents. For requirement (2), Investigations require traceability while restricting access to sensitive interaction logs. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
B:Requirement (1) is not met: Safety filters do not replace ACLs on retrieved business documents. The substituted action is instead for this different case: A Copilot user can summarize files the organization did not intend to share because SharePoint site permissions are broad. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (2) is not met: Investigations require traceability while restricting access to sensitive interaction logs. The substituted action is instead for this different case: An organization deploys Copilot without deciding whether confidential prompts and generated responses belong in its DLP scope. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: Safety filters do not replace ACLs on retrieved business documents. The substituted action is instead for this different case: A Copilot user can summarize files the organization did not intend to share because SharePoint site permissions are broad. Requirement (2) is not met: Investigations require traceability while restricting access to sensitive interaction logs. The substituted action is instead for this different case: An organization deploys Copilot without deciding whether confidential prompts and generated responses belong in its DLP scope. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 707
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A workload needs cryptographic operations while the application operators must not be able to export the master key. (2) A multicloud application shares the same encryption key material broadly between unrelated environments. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Evaluate managed or hardware-protected key custody with separate key administration roles. | (2) Define independent keys, access scopes and rotation policies per workload and trust boundary.
- (1) Use Azure Key Vault or an equivalent managed secret service with controlled rotation and access policies. | (2) Define independent keys, access scopes and rotation policies per workload and trust boundary.
- (1) Evaluate managed or hardware-protected key custody with separate key administration roles. | (2) Establish certificate inventory, expiry monitoring and tested renewal procedures for trust-critical services.
- (1) Use Azure Key Vault or an equivalent managed secret service with controlled rotation and access policies. | (2) Establish certificate inventory, expiry monitoring and tested renewal procedures for trust-critical services.
Explanation
Correct Answer
A:For requirement (1), Nonexportable key control and separation of duties reduce the blast radius of app compromise. For requirement (2), Distinct cryptographic domains prevent one breach from revealing unrelated protected data. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
B:Requirement (1) is not met: Nonexportable key control and separation of duties reduce the blast radius of app compromise. The substituted action is instead for this different case: A cloud application stores long-lived client secrets in a code repository and rotates them only when employees leave. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (2) is not met: Distinct cryptographic domains prevent one breach from revealing unrelated protected data. The substituted action is instead for this different case: A service certificate expires and causes an identity federation outage across the enterprise. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: Nonexportable key control and separation of duties reduce the blast radius of app compromise. The substituted action is instead for this different case: A cloud application stores long-lived client secrets in a code repository and rotates them only when employees leave. Requirement (2) is not met: Distinct cryptographic domains prevent one breach from revealing unrelated protected data. The substituted action is instead for this different case: A service certificate expires and causes an identity federation outage across the enterprise. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 708
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A group owner assumes removal from a Teams channel automatically revokes every separate application assignment. (2) A sensitive application allows broad guest onboarding with no evidence of who approved the initial grant. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Inventory direct, group-based and application grants when evaluating effective access. | (2) Require approval records and access-package ownership for external resource entitlements.
- (1) Use access packages with approval, expiration and review controls where supported. | (2) Require approval records and access-package ownership for external resource entitlements.
- (1) Inventory direct, group-based and application grants when evaluating effective access. | (2) Schedule sponsor-backed access reviews and remove no-longer-justified assignments.
- (1) Use access packages with approval, expiration and review controls where supported. | (2) Schedule sponsor-backed access reviews and remove no-longer-justified assignments.
Explanation
Correct Answer
A:For requirement (1), User access can come from multiple independent authorization paths. For requirement (2), Authorization should be tied to a named sponsor and approved business need. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
B:Requirement (1) is not met: User access can come from multiple independent authorization paths. The substituted action is instead for this different case: External employees receive SharePoint and app grants through many manual requests without expiry dates. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (2) is not met: Authorization should be tied to a named sponsor and approved business need. The substituted action is instead for this different case: A project manager approves access packages but cannot determine who still has access when a project closes. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: User access can come from multiple independent authorization paths. The substituted action is instead for this different case: External employees receive SharePoint and app grants through many manual requests without expiry dates. Requirement (2) is not met: Authorization should be tied to a named sponsor and approved business need. The substituted action is instead for this different case: A project manager approves access packages but cannot determine who still has access when a project closes. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 709
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A private app is published but an authorized user cannot reach its service hostname through the client. (2) A team migrates from VPN and assumes private access removes the need for server-side authorization. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Validate private access app segments, DNS resolution and forwarding policy for the target. | (2) Keep backend application authentication and resource permission checks under the Private Access architecture.
- (1) Evaluate Microsoft Entra Private Access with published application segments and scoped user grants. | (2) Keep backend application authentication and resource permission checks under the Private Access architecture.
- (1) Validate private access app segments, DNS resolution and forwarding policy for the target. | (2) Design supported connector redundancy and verify private application availability during failure.
- (1) Evaluate Microsoft Entra Private Access with published application segments and scoped user grants. | (2) Design supported connector redundancy and verify private application availability during failure.
Explanation
Correct Answer
A:For requirement (1), A user grant alone does not establish name resolution or routing to the application. For requirement (2), Network path authorization complements but does not replace app-level access control. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
B:Requirement (1) is not met: A user grant alone does not establish name resolution or routing to the application. The substituted action is instead for this different case: Employees need access to an internal application without being connected to a broad network-level VPN. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (2) is not met: Network path authorization complements but does not replace app-level access control. The substituted action is instead for this different case: An application connector is deployed in only one location and becomes unavailable during routine maintenance. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: A user grant alone does not establish name resolution or routing to the application. The substituted action is instead for this different case: Employees need access to an internal application without being connected to a broad network-level VPN. Requirement (2) is not met: Network path authorization complements but does not replace app-level access control. The substituted action is instead for this different case: An application connector is deployed in only one location and becomes unavailable during routine maintenance. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 710
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A tenant allows external collaboration but no one reviews guests after their projects end. (2) A Microsoft 365 compliance dashboard shows no incidents, but several workloads are not licensed or connected for security signals. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Implement guest lifecycle and sponsor-backed entitlement reviews across supported workloads. | (2) Design Microsoft 365 network optimization alongside appropriate identity and data security policies.
- (1) Correlate Office 365 detections with Defender XDR cross-workload incidents. | (2) Design Microsoft 365 network optimization alongside appropriate identity and data security policies.
- (1) Implement guest lifecycle and sponsor-backed entitlement reviews across supported workloads. | (2) Verify monitoring coverage and telemetry health before interpreting low alert counts as low risk.
- (1) Correlate Office 365 detections with Defender XDR cross-workload incidents. | (2) Verify monitoring coverage and telemetry health before interpreting low alert counts as low risk.
Explanation
Correct Answer
C:For requirement (1), External collaboration risk persists when access remains after legitimate need ends. For requirement (2), Missing detection evidence cannot prove the environment is safe because unmonitored services may conceal otherwise detectable threats. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (2) is not met: Missing detection evidence cannot prove the environment is safe because unmonitored services may conceal otherwise detectable threats. The substituted action is instead for this different case: A network team proposes exempting all Teams traffic from every security control to resolve poor call quality. The proposed bundle therefore cannot satisfy BOTH stated requirements.
B:Requirement (1) is not met: External collaboration risk persists when access remains after legitimate need ends. The substituted action is instead for this different case: A SOC investigates user phishing incidents without checking related endpoint and identity alerts. Requirement (2) is not met: Missing detection evidence cannot prove the environment is safe because unmonitored services may conceal otherwise detectable threats. The substituted action is instead for this different case: A network team proposes exempting all Teams traffic from every security control to resolve poor call quality. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: External collaboration risk persists when access remains after legitimate need ends. The substituted action is instead for this different case: A SOC investigates user phishing incidents without checking related endpoint and identity alerts. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Microsoft Cybersecurity Architect (SC-100) Practice Tests