Question 720
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A security review finds administrative role changes with no change ticket or recorded business purpose. (2) A security team wants to test emergency access without leaving a highly privileged account active in daily workflows. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Revoke and rotate the exposed credential, then investigate its use and effective grants. | (2) Revoke active sessions and review delegated app tokens in addition to disabling the account.
- (1) Correlate role audit events to approvals and investigate unexplained elevation. | (2) Rehearse emergency access under controlled monitoring and document safe credential custody.
- (1) Revoke and rotate the exposed credential, then investigate its use and effective grants. | (2) Rehearse emergency access under controlled monitoring and document safe credential custody.
- (1) Correlate role audit events to approvals and investigate unexplained elevation. | (2) Revoke active sessions and review delegated app tokens in addition to disabling the account.
Explanation
Correct Answer
B:For requirement (1), Privileged authorization needs traceability between approvals and actual assignment. For requirement (2), Recovery readiness depends on tested access and careful operational protection. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (1) is not met: Privileged authorization needs traceability between approvals and actual assignment. The substituted action is instead for this different case: A high-privilege application credential appears in a public repository and the response team plans only to delete the commit. Requirement (2) is not met: Recovery readiness depends on tested access and careful operational protection. The substituted action is instead for this different case: An incident commander suspends a compromised administrator but leaves an active privileged cloud session untouched. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (1) is not met: Privileged authorization needs traceability between approvals and actual assignment. The substituted action is instead for this different case: A high-privilege application credential appears in a public repository and the response team plans only to delete the commit. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (2) is not met: Recovery readiness depends on tested access and careful operational protection. The substituted action is instead for this different case: An incident commander suspends a compromised administrator but leaves an active privileged cloud session untouched. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 721
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A contractor's access remains active after their approved business engagement ends. (2) A supply-chain incident compromises a trusted vendor integration that has tenant-wide API permissions. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Combine least-privilege data roles, sensitive-data monitoring and governed exfiltration controls. | (2) Design phishing-resistant MFA and context-aware Conditional Access for sensitive operations.
- (1) Implement time-bound entitlements with periodic access reviews and automatic deprovisioning. | (2) Scope third-party application permissions and establish rapid revocation and monitoring of delegated grants.
- (1) Combine least-privilege data roles, sensitive-data monitoring and governed exfiltration controls. | (2) Scope third-party application permissions and establish rapid revocation and monitoring of delegated grants.
- (1) Implement time-bound entitlements with periodic access reviews and automatic deprovisioning. | (2) Design phishing-resistant MFA and context-aware Conditional Access for sensitive operations.
Explanation
Correct Answer
B:For requirement (1), External identity access must track business sponsorship and contract lifecycle. For requirement (2), Vendor compromise impact depends on the permissions and persistence granted to the integration. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (1) is not met: External identity access must track business sponsorship and contract lifecycle. The substituted action is instead for this different case: A privileged insider can export an entire regulated dataset despite only needing aggregate reports. Requirement (2) is not met: Vendor compromise impact depends on the permissions and persistence granted to the integration. The substituted action is instead for this different case: An external attacker obtains one employee password and can access several administrative interfaces without a new check. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (1) is not met: External identity access must track business sponsorship and contract lifecycle. The substituted action is instead for this different case: A privileged insider can export an entire regulated dataset despite only needing aggregate reports. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (2) is not met: Vendor compromise impact depends on the permissions and persistence granted to the integration. The substituted action is instead for this different case: An external attacker obtains one employee password and can access several administrative interfaces without a new check. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 722
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A Kubernetes pod receives cluster admin privileges to access one Azure Key Vault secret. (2) A service-to-service request succeeds with an OAuth token that belongs to the wrong audience. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Design supported workload identity federation and Key Vault data permissions for that pod. | (2) Validate token audience, issuer and intended resource authorization in the application trust design.
- (1) Grant its managed identity scoped Azure RBAC for the required storage data operations. | (2) Validate token audience, issuer and intended resource authorization in the application trust design.
- (1) Design supported workload identity federation and Key Vault data permissions for that pod. | (2) Move workload authentication to supported federated credentials or managed identity with controlled rotation.
- (1) Grant its managed identity scoped Azure RBAC for the required storage data operations. | (2) Move workload authentication to supported federated credentials or managed identity with controlled rotation.
Explanation
Correct Answer
A:For requirement (1), Access to a cloud secret does not require Kubernetes control-plane administration. For requirement (2), A valid token for one API does not authorize access to a different service. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
B:Requirement (1) is not met: Access to a cloud secret does not require Kubernetes control-plane administration. The substituted action is instead for this different case: An Azure Function needs to read a single storage container but currently stores the account access key. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (2) is not met: A valid token for one API does not authorize access to a different service. The substituted action is instead for this different case: A scheduled job authenticates with a certificate embedded inside a container image copied to every environment. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: Access to a cloud secret does not require Kubernetes control-plane administration. The substituted action is instead for this different case: An Azure Function needs to read a single storage container but currently stores the account access key. Requirement (2) is not met: A valid token for one API does not authorize access to a different service. The substituted action is instead for this different case: A scheduled job authenticates with a certificate embedded inside a container image copied to every environment. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 723
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) The organization requires suspicious attachments analyzed before employees open them. (2) A SOC can identify malicious email but lacks a governed process to remove matching messages from other mailboxes. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Evaluate Safe Attachments detonation and disposition policy for protected recipient groups. | (2) Include Defender for Office 365 Safe Links time-of-click protection for eligible workloads.
- (1) Design targeted anti-phishing impersonation protection using Defender for Office 365. | (2) Include Defender for Office 365 Safe Links time-of-click protection for eligible workloads.
- (1) Evaluate Safe Attachments detonation and disposition policy for protected recipient groups. | (2) Design approved Threat Explorer investigation and scoped post-delivery remediation workflows.
- (1) Design targeted anti-phishing impersonation protection using Defender for Office 365. | (2) Design approved Threat Explorer investigation and scoped post-delivery remediation workflows.
Explanation
Correct Answer
C:For requirement (1), Dynamic attachment analysis can detect threats that simple filename or signature checks miss. For requirement (2), Campaign-level investigation should lead to controlled response across actual affected recipients. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (2) is not met: Campaign-level investigation should lead to controlled response across actual affected recipients. The substituted action is instead for this different case: Employees often click links that become malicious after a message was delivered. The proposed bundle therefore cannot satisfy BOTH stated requirements.
B:Requirement (1) is not met: Dynamic attachment analysis can detect threats that simple filename or signature checks miss. The substituted action is instead for this different case: A financial services tenant receives executive impersonation messages and only basic bulk-spam filtering is configured. Requirement (2) is not met: Campaign-level investigation should lead to controlled response across actual affected recipients. The substituted action is instead for this different case: Employees often click links that become malicious after a message was delivered. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: Dynamic attachment analysis can detect threats that simple filename or signature checks miss. The substituted action is instead for this different case: A financial services tenant receives executive impersonation messages and only basic bulk-spam filtering is configured. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 724
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) An attacker disables endpoint telemetry, and the operations team interprets no alerts as no compromise. (2) A client malware alert is closed when the process exits but persistence tasks remain installed. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Alert on missing sensor check-in and integrity anomalies as security signals. | (2) Define remediation verification that inspects persistence and related credential compromise.
- (1) Design containment verification and an alternate response path for unreachable devices. | (2) Define remediation verification that inspects persistence and related credential compromise.
- (1) Alert on missing sensor check-in and integrity anomalies as security signals. | (2) Reconcile device identities and retire stale endpoint records using supported lifecycle procedures.
- (1) Design containment verification and an alternate response path for unreachable devices. | (2) Reconcile device identities and retire stale endpoint records using supported lifecycle procedures.
Explanation
Correct Answer
A:For requirement (1), Telemetry loss can hide attacks and should itself be investigated. For requirement (2), A stopped process does not prove a threat is fully eradicated if persistence mechanisms and related identities remain compromised. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
B:Requirement (1) is not met: Telemetry loss can hide attacks and should itself be investigated. The substituted action is instead for this different case: A SOC tries to isolate a compromised endpoint but the device has been offline since yesterday. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (2) is not met: A stopped process does not prove a threat is fully eradicated if persistence mechanisms and related identities remain compromised. The substituted action is instead for this different case: A reimaged laptop appears under three device records and skews threat inventory counts. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: Telemetry loss can hide attacks and should itself be investigated. The substituted action is instead for this different case: A SOC tries to isolate a compromised endpoint but the device has been offline since yesterday. Requirement (2) is not met: A stopped process does not prove a threat is fully eradicated if persistence mechanisms and related identities remain compromised. The substituted action is instead for this different case: A reimaged laptop appears under three device records and skews threat inventory counts. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 725
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A team wants to rely on a verifiable credential to attest a training qualification without copying the holder's complete identity file. (2) A security architect assumes that verification of an external credential automatically grants access to every company application. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Evaluate supported verifiable credential issuance and presentation with minimum disclosed claims. | (2) Automate guest access expiration and sponsor-backed access reviews across effective memberships.
- (1) Use a governed Microsoft Entra B2B cross-tenant collaboration design with scoped resource grants. | (2) Automate guest access expiration and sponsor-backed access reviews across effective memberships.
- (1) Evaluate supported verifiable credential issuance and presentation with minimum disclosed claims. | (2) Separate identity proof verification from application authorization and Conditional Access evaluation.
- (1) Use a governed Microsoft Entra B2B cross-tenant collaboration design with scoped resource grants. | (2) Separate identity proof verification from application authorization and Conditional Access evaluation.
Explanation
Correct Answer
C:For requirement (1), Decentralized credentials can convey attestations without unnecessary personal-data transfer. For requirement (2), Proving an attribute does not override resource-specific permissions. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (2) is not met: Proving an attribute does not override resource-specific permissions. The substituted action is instead for this different case: A vendor engagement ends, but B2B guest users remain members of multiple security groups. The proposed bundle therefore cannot satisfy BOTH stated requirements.
B:Requirement (1) is not met: Decentralized credentials can convey attestations without unnecessary personal-data transfer. The substituted action is instead for this different case: A partner organization needs access to one project application but should retain its own identity administration. Requirement (2) is not met: Proving an attribute does not override resource-specific permissions. The substituted action is instead for this different case: A vendor engagement ends, but B2B guest users remain members of multiple security groups. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: Decentralized credentials can convey attestations without unnecessary personal-data transfer. The substituted action is instead for this different case: A partner organization needs access to one project application but should retain its own identity administration. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 726
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A hybrid application requires private connectivity but its on-premises network cannot resolve the private endpoint's DNS name. (2) An enterprise deploys two regional hubs but forgets to validate asymmetric return traffic through inspection appliances. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Include private DNS resolution and forwarding in the hybrid network design. | (2) Segment workloads with least-privilege network security group and firewall rules.
- (1) Design private endpoints and controlled network routing for the database service. | (2) Segment workloads with least-privilege network security group and firewall rules.
- (1) Include private DNS resolution and forwarding in the hybrid network design. | (2) Test effective routing symmetry and firewall state handling for hub-and-spoke inspection.
- (1) Design private endpoints and controlled network routing for the database service. | (2) Test effective routing symmetry and firewall state handling for hub-and-spoke inspection.
Explanation
Correct Answer
C:For requirement (1), Private connectivity depends on routing and correct name resolution together. For requirement (2), Inconsistent forward and return paths can break stateful filtering or bypass expected controls. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (2) is not met: Inconsistent forward and return paths can break stateful filtering or bypass expected controls. The substituted action is instead for this different case: Multiple application tiers use a single broad network security group allowing all east-west traffic. The proposed bundle therefore cannot satisfy BOTH stated requirements.
B:Requirement (1) is not met: Private connectivity depends on routing and correct name resolution together. The substituted action is instead for this different case: A regulated database is directly exposed to internet clients despite only internal applications needing connections. Requirement (2) is not met: Inconsistent forward and return paths can break stateful filtering or bypass expected controls. The substituted action is instead for this different case: Multiple application tiers use a single broad network security group allowing all east-west traffic. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: Private connectivity depends on routing and correct name resolution together. The substituted action is instead for this different case: A regulated database is directly exposed to internet clients despite only internal applications needing connections. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 727
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A managed identity can change production network routing despite only needing to read telemetry. (2) The security team sees role assignments but cannot tell whether users actually exercise their entitlements. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Review effective cloud entitlements and remove unnecessary standing role grants. | (2) Normalize entitlement risk across providers while retaining provider-specific authorization evaluation.
- (1) Reduce its effective permissions to diagnostics-read operations at the smallest practical resource scope. | (2) Incorporate activity evidence and resource criticality into cloud entitlement reviews.
- (1) Review effective cloud entitlements and remove unnecessary standing role grants. | (2) Incorporate activity evidence and resource criticality into cloud entitlement reviews.
- (1) Reduce its effective permissions to diagnostics-read operations at the smallest practical resource scope. | (2) Normalize entitlement risk across providers while retaining provider-specific authorization evaluation.
Explanation
Correct Answer
B:For requirement (1), Workload identity privileges should be aligned to functions rather than environment ownership. For requirement (2), Permission presence and actual use both inform the risk of persistent access. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (1) is not met: Workload identity privileges should be aligned to functions rather than environment ownership. The substituted action is instead for this different case: An Azure subscription has hundreds of unused Owner roles assigned to service principals. Requirement (2) is not met: Permission presence and actual use both inform the risk of persistent access. The substituted action is instead for this different case: A project uses identical privilege reports for Azure and AWS while ignoring provider-specific permission semantics. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (1) is not met: Workload identity privileges should be aligned to functions rather than environment ownership. The substituted action is instead for this different case: An Azure subscription has hundreds of unused Owner roles assigned to service principals. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (2) is not met: Permission presence and actual use both inform the risk of persistent access. The substituted action is instead for this different case: A project uses identical privilege reports for Azure and AWS while ignoring provider-specific permission semantics. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 728
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) Recovery tests meet infrastructure RTOs but fail business-user sign-off because downstream reports lack recent data. (2) A business continuity plan has no schedule to re-test after the organization moves its primary data platform to another cloud. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Assign incident recovery decision rights and approval gates for sensitive data access. | (2) Establish a single incident command workflow with explicit containment and recovery handoffs.
- (1) Include business-process owners and freshness acceptance criteria in disaster-recovery testing. | (2) Trigger resilience reassessment after material architecture changes and maintain current runbooks.
- (1) Assign incident recovery decision rights and approval gates for sensitive data access. | (2) Trigger resilience reassessment after material architecture changes and maintain current runbooks.
- (1) Include business-process owners and freshness acceptance criteria in disaster-recovery testing. | (2) Establish a single incident command workflow with explicit containment and recovery handoffs.
Explanation
Correct Answer
B:For requirement (1), Resilience success requires restored business outcomes, not solely server availability. For requirement (2), Recovery documentation becomes unreliable when topology and dependencies evolve without corresponding drills. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (1) is not met: Resilience success requires restored business outcomes, not solely server availability. The substituted action is instead for this different case: A tabletop exercise tests backup retrieval but never identifies who can authorize a regulated-data restoration. Requirement (2) is not met: Recovery documentation becomes unreliable when topology and dependencies evolve without corresponding drills. The substituted action is instead for this different case: Two response teams execute contradictory network isolation and service restoration commands during the same ransomware drill. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (1) is not met: Resilience success requires restored business outcomes, not solely server availability. The substituted action is instead for this different case: A tabletop exercise tests backup retrieval but never identifies who can authorize a regulated-data restoration. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (2) is not met: Recovery documentation becomes unreliable when topology and dependencies evolve without corresponding drills. The substituted action is instead for this different case: Two response teams execute contradictory network isolation and service restoration commands during the same ransomware drill. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 729
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) An IoT fleet cannot be patched remotely and no one has documented expected service life or retirement. (2) A retail sensor network shares routing with payment processing servers despite no operational dependency. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Require unique device identity, credential provisioning and asset inventory for IoT onboarding. | (2) Design authenticated encrypted transport and gateway authorization for IoT telemetry.
- (1) Specify secure update capability and controlled end-of-life replacement for embedded devices. | (2) Segment IoT networks and limit gateway-to-enterprise traffic to defined protocols.
- (1) Require unique device identity, credential provisioning and asset inventory for IoT onboarding. | (2) Segment IoT networks and limit gateway-to-enterprise traffic to defined protocols.
- (1) Specify secure update capability and controlled end-of-life replacement for embedded devices. | (2) Design authenticated encrypted transport and gateway authorization for IoT telemetry.
Explanation
Correct Answer
B:For requirement (1), Unpatchable devices accumulate risk that must be managed through lifecycle planning. For requirement (2), Network isolation reduces lateral movement from less-managed devices to sensitive services. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (1) is not met: Unpatchable devices accumulate risk that must be managed through lifecycle planning. The substituted action is instead for this different case: Facilities deploy thousands of smart building sensors with default passwords and no central device registry. Requirement (2) is not met: Network isolation reduces lateral movement from less-managed devices to sensitive services. The substituted action is instead for this different case: A device gateway accepts unencrypted readings from field sensors across untrusted networks. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (1) is not met: Unpatchable devices accumulate risk that must be managed through lifecycle planning. The substituted action is instead for this different case: Facilities deploy thousands of smart building sensors with default passwords and no central device registry. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (2) is not met: Network isolation reduces lateral movement from less-managed devices to sensitive services. The substituted action is instead for this different case: A device gateway accepts unencrypted readings from field sensors across untrusted networks. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 730
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) An architect publishes an API without a revision or version policy, breaking all consumers when its contract changes. (2) A gateway logs full bearer tokens and sensitive request payloads to an unrestricted workspace. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Design governed API versioning and staged deprecation for breaking changes. | (2) Configure appropriate API Management rate and quota limits aligned to business contracts.
- (1) Design authenticated partner identities and per-API authorization in Azure API Management. | (2) Configure appropriate API Management rate and quota limits aligned to business contracts.
- (1) Design governed API versioning and staged deprecation for breaking changes. | (2) Redact credentials and personal content in API telemetry and restrict diagnostic access.
- (1) Design authenticated partner identities and per-API authorization in Azure API Management. | (2) Redact credentials and personal content in API telemetry and restrict diagnostic access.
Explanation
Correct Answer
C:For requirement (1), Explicit version lifecycle protects dependent applications during interface evolution. For requirement (2), Observability should not leak the secrets and data it is intended to protect. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (2) is not met: Observability should not leak the secrets and data it is intended to protect. The substituted action is instead for this different case: An API gateway accepts unlimited requests from every subscription and the backend repeatedly exhausts capacity. The proposed bundle therefore cannot satisfy BOTH stated requirements.
B:Requirement (1) is not met: Explicit version lifecycle protects dependent applications during interface evolution. The substituted action is instead for this different case: A partner API receives legitimate requests but cannot distinguish which partner is allowed to call a sensitive operation. Requirement (2) is not met: Observability should not leak the secrets and data it is intended to protect. The substituted action is instead for this different case: An API gateway accepts unlimited requests from every subscription and the backend repeatedly exhausts capacity. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: Explicit version lifecycle protects dependent applications during interface evolution. The substituted action is instead for this different case: A partner API receives legitimate requests but cannot distinguish which partner is allowed to call a sensitive operation. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Microsoft Cybersecurity Architect (SC-100) Practice Tests