Question 740
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A malware campaign changes IP addresses while maintaining the same credential-theft technique. (2) A detection rule catches a false-positive administrative script, and the owner asks for blanket script exclusions. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Design behavioral detections and threat-hunting hypotheses beyond one static indicator. | (2) Use evidence-based narrow tuning and regression tests rather than disabling the broad detection family.
- (1) Enrich external indicators with local telemetry, time context and confidence before escalation. | (2) Use evidence-based narrow tuning and regression tests rather than disabling the broad detection family.
- (1) Design behavioral detections and threat-hunting hypotheses beyond one static indicator. | (2) Normalize security metrics by monitored asset coverage and detection-rule changes.
- (1) Enrich external indicators with local telemetry, time context and confidence before escalation. | (2) Normalize security metrics by monitored asset coverage and detection-rule changes.
Explanation
Correct Answer
A:For requirement (1), Technique-oriented analytics survive changes to attacker infrastructure. For requirement (2), Scoped exceptions limit noise without removing visibility for genuine malicious variants. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
B:Requirement (1) is not met: Technique-oriented analytics survive changes to attacker infrastructure. The substituted action is instead for this different case: A SOC promotes every external threat indicator to a high-severity alert without validating matches against tenant events. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (2) is not met: Scoped exceptions limit noise without removing visibility for genuine malicious variants. The substituted action is instead for this different case: Endpoint detectors become noisy after a new sensor rollout, and leadership believes attacks have doubled. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: Technique-oriented analytics survive changes to attacker infrastructure. The substituted action is instead for this different case: A SOC promotes every external threat indicator to a high-severity alert without validating matches against tenant events. Requirement (2) is not met: Scoped exceptions limit noise without removing visibility for genuine malicious variants. The substituted action is instead for this different case: Endpoint detectors become noisy after a new sensor rollout, and leadership believes attacks have doubled. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 741
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) Mac and Windows employees are assigned the same agent package without checking platform support. (2) Remote workers report that a compliance policy was assigned yet their device sign-ins remain unrestricted. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Select platform-supported Defender protection and configuration methods for each client operating system. | (2) Design app and device access requirements with mobile application protection where supported.
- (1) Require verified endpoint onboarding, protection state and detection telemetry for managed clients. | (2) Design app and device access requirements with mobile application protection where supported.
- (1) Select platform-supported Defender protection and configuration methods for each client operating system. | (2) Verify effective device compliance reporting and Conditional Access enforcement together.
- (1) Require verified endpoint onboarding, protection state and detection telemetry for managed clients. | (2) Verify effective device compliance reporting and Conditional Access enforcement together.
Explanation
Correct Answer
C:For requirement (1), Cross-platform endpoint coverage needs appropriate onboarding and enforcement mechanisms. For requirement (2), Configuration assignment and evaluated access conditions are separate states. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (2) is not met: Configuration assignment and evaluated access conditions are separate states. The substituted action is instead for this different case: A BYOD policy grants unrestricted access to corporate data from unregistered personal phones. The proposed bundle therefore cannot satisfy BOTH stated requirements.
B:Requirement (1) is not met: Cross-platform endpoint coverage needs appropriate onboarding and enforcement mechanisms. The substituted action is instead for this different case: The enterprise enrolls laptops into device management but does not verify Defender endpoint sensor health. Requirement (2) is not met: Configuration assignment and evaluated access conditions are separate states. The substituted action is instead for this different case: A BYOD policy grants unrestricted access to corporate data from unregistered personal phones. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: Cross-platform endpoint coverage needs appropriate onboarding and enforcement mechanisms. The substituted action is instead for this different case: The enterprise enrolls laptops into device management but does not verify Defender endpoint sensor health. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 742
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A fleet of virtual machines needs behavioral threat detection, not only a list of configuration recommendations. (2) An architect enables every Defender plan without evaluating workloads, coverage or operating costs. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Select supported Defender for Servers protection and endpoint integration appropriate to the OS estate. | (2) Evaluate Defender for Containers coverage and deployment prerequisites for the managed cluster.
- (1) Evaluate and enable an appropriate Defender for Databases workload protection plan. | (2) Evaluate Defender for Containers coverage and deployment prerequisites for the managed cluster.
- (1) Select supported Defender for Servers protection and endpoint integration appropriate to the OS estate. | (2) Map protected resource types and threat priorities to eligible workload protection plans.
- (1) Evaluate and enable an appropriate Defender for Databases workload protection plan. | (2) Map protected resource types and threat priorities to eligible workload protection plans.
Explanation
Correct Answer
C:For requirement (1), Runtime server defense is distinct from recommendation-based posture reporting. For requirement (2), Security plans should be chosen from actual risks and supported coverage rather than a blanket toggle. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (2) is not met: Security plans should be chosen from actual risks and supported coverage rather than a blanket toggle. The substituted action is instead for this different case: A Kubernetes cluster is connected to Azure but container runtime threats are absent from security operations. The proposed bundle therefore cannot satisfy BOTH stated requirements.
B:Requirement (1) is not met: Runtime server defense is distinct from recommendation-based posture reporting. The substituted action is instead for this different case: A team enables only configuration assessments for databases but expects runtime SQL threat detections. Requirement (2) is not met: Security plans should be chosen from actual risks and supported coverage rather than a blanket toggle. The substituted action is instead for this different case: A Kubernetes cluster is connected to Azure but container runtime threats are absent from security operations. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: Runtime server defense is distinct from recommendation-based posture reporting. The substituted action is instead for this different case: A team enables only configuration assessments for databases but expects runtime SQL threat detections. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 743
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A critical security patch breaks a legacy application that cannot yet be retired. (2) The organization declares all servers patched after distributing a policy but has not checked their actual installed versions. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Document a time-bounded exception with compensating isolation and a tested remediation deadline. | (2) Verify deployment compliance and observed software versions before closing remediation work.
- (1) Stage security updates through representative rings with rollback criteria and documented maintenance approvals. | (2) Verify deployment compliance and observed software versions before closing remediation work.
- (1) Document a time-bounded exception with compensating isolation and a tested remediation deadline. | (2) Prioritize exploitation evidence and exposed asset criticality over a uniform patch queue.
- (1) Stage security updates through representative rings with rollback criteria and documented maintenance approvals. | (2) Prioritize exploitation evidence and exposed asset criticality over a uniform patch queue.
Explanation
Correct Answer
A:For requirement (1), A compatibility exception should constrain exploitation while preserving accountability for eventual risk removal. For requirement (2), Assignment and successful installation are separate states requiring evidence from target devices. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
B:Requirement (1) is not met: A compatibility exception should constrain exploitation while preserving accountability for eventual risk removal. The substituted action is instead for this different case: Operations proposes patching every endpoint simultaneously during a business-critical production window. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (2) is not met: Assignment and successful installation are separate states requiring evidence from target devices. The substituted action is instead for this different case: An internet-facing appliance has a known exploited vulnerability but the team patches internal low-risk desktops first. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: A compatibility exception should constrain exploitation while preserving accountability for eventual risk removal. The substituted action is instead for this different case: Operations proposes patching every endpoint simultaneously during a business-critical production window. Requirement (2) is not met: Assignment and successful installation are separate states requiring evidence from target devices. The substituted action is instead for this different case: An internet-facing appliance has a known exploited vulnerability but the team patches internal low-risk desktops first. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 744
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A user downloads confidential files from a connected SaaS app on an unmanaged device after a successful sign-in. (2) Several Cloud Apps alerts are triggered by an approved scheduled export and the SOC requests disabling all anomaly detection. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Evaluate Defender for Cloud Apps discovery using supported endpoint or network telemetry. | (2) Tune scoped anomaly policies using validated business behavior and retain broader detection coverage.
- (1) Evaluate Conditional Access App Control session restrictions through Defender for Cloud Apps. | (2) Review OAuth consent grants and require minimum permissions before sanctioning the app.
- (1) Evaluate Defender for Cloud Apps discovery using supported endpoint or network telemetry. | (2) Review OAuth consent grants and require minimum permissions before sanctioning the app.
- (1) Evaluate Conditional Access App Control session restrictions through Defender for Cloud Apps. | (2) Tune scoped anomaly policies using validated business behavior and retain broader detection coverage.
Explanation
Correct Answer
D:For requirement (1), In-session access controls can restrict data movement after authentication succeeds. For requirement (2), Narrow tuning reduces alert fatigue without disabling unrelated risk detection. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (1) is not met: In-session access controls can restrict data movement after authentication succeeds. The substituted action is instead for this different case: A company cannot identify unsanctioned SaaS services accessed by remote workers from company devices. The proposed bundle therefore cannot satisfy BOTH stated requirements.
B:Requirement (2) is not met: Narrow tuning reduces alert fatigue without disabling unrelated risk detection. The substituted action is instead for this different case: A trusted third-party app requests full mailbox read permission though its business function only requires calendar availability. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (1) is not met: In-session access controls can restrict data movement after authentication succeeds. The substituted action is instead for this different case: A company cannot identify unsanctioned SaaS services accessed by remote workers from company devices. Requirement (2) is not met: Narrow tuning reduces alert fatigue without disabling unrelated risk detection. The substituted action is instead for this different case: A trusted third-party app requests full mailbox read permission though its business function only requires calendar availability. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 745
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A platform team assumes that the Cloud Adoption Framework eliminates the need for a security operating model. (2) An acquired company joins the Azure estate with a different regulatory profile and inherits every existing exception. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Define shared platform and workload responsibilities for governance, response and policy lifecycle. | (2) Evaluate and scope governance exceptions to each applicable business or regulatory context.
- (1) Establish CAF governance guardrails and decision authority before large-scale landing-zone deployment. | (2) Evaluate and scope governance exceptions to each applicable business or regulatory context.
- (1) Define shared platform and workload responsibilities for governance, response and policy lifecycle. | (2) Translate business-risk requirements into enforceable cloud policy, identity and monitoring controls.
- (1) Establish CAF governance guardrails and decision authority before large-scale landing-zone deployment. | (2) Translate business-risk requirements into enforceable cloud policy, identity and monitoring controls.
Explanation
Correct Answer
A:For requirement (1), A framework guides organizational responsibilities but cannot assign ownership automatically. For requirement (2), Existing exceptions are not blanket authorization for unrelated subsidiaries or workloads. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
B:Requirement (1) is not met: A framework guides organizational responsibilities but cannot assign ownership automatically. The substituted action is instead for this different case: A cloud migration program starts provisioning production subscriptions before defining policy owners and security exceptions. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (2) is not met: Existing exceptions are not blanket authorization for unrelated subsidiaries or workloads. The substituted action is instead for this different case: The risk register identifies security obligations but has no controls mapped to subscription and data owners. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: A framework guides organizational responsibilities but cannot assign ownership automatically. The substituted action is instead for this different case: A cloud migration program starts provisioning production subscriptions before defining policy owners and security exceptions. Requirement (2) is not met: Existing exceptions are not blanket authorization for unrelated subsidiaries or workloads. The substituted action is instead for this different case: The risk register identifies security obligations but has no controls mapped to subscription and data owners. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 746
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) Production teams assume platform security updates will occur automatically for every IaaS guest operating system. (2) A multi-team deployment is declared complete based only on resource creation even though access controls were not reviewed. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Include operational responsibility, alert routing and log lifecycle in the platform handoff. | (2) Require a deployment acceptance check covering identities, policy compliance and observable protection.
- (1) Document customer-managed guest patch responsibilities separately from provider-managed service components. | (2) Maintain resource tagging and owner mapping that supports incident response routing.
- (1) Include operational responsibility, alert routing and log lifecycle in the platform handoff. | (2) Maintain resource tagging and owner mapping that supports incident response routing.
- (1) Document customer-managed guest patch responsibilities separately from provider-managed service components. | (2) Require a deployment acceptance check covering identities, policy compliance and observable protection.
Explanation
Correct Answer
D:For requirement (1), Shared responsibility varies by service model and determines who must patch each layer. For requirement (2), A resource being created does not show that its security design was successfully enforced. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (1) is not met: Shared responsibility varies by service model and determines who must patch each layer. The substituted action is instead for this different case: A newly deployed landing zone has no defined security response contact or log retention owner. The proposed bundle therefore cannot satisfy BOTH stated requirements.
B:Requirement (2) is not met: A resource being created does not show that its security design was successfully enforced. The substituted action is instead for this different case: An operations team receives Defender alerts but cannot connect them to the application team responsible for the resource. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (1) is not met: Shared responsibility varies by service model and determines who must patch each layer. The substituted action is instead for this different case: A newly deployed landing zone has no defined security response contact or log retention owner. Requirement (2) is not met: A resource being created does not show that its security design was successfully enforced. The substituted action is instead for this different case: An operations team receives Defender alerts but cannot connect them to the application team responsible for the resource. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 747
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A regulated document must be visibly classified and encrypted for approved recipients. (2) A firm needs to stop identified financial account numbers from being shared externally through approved Microsoft 365 workloads. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Design supported Purview sensitivity label protection with audience-specific encryption rights. | (2) Plan scoped Purview eDiscovery preservation and case access controls.
- (1) Use supported Purview content classification and discovery with appropriately scoped analyst roles. | (2) Plan scoped Purview eDiscovery preservation and case access controls.
- (1) Design supported Purview sensitivity label protection with audience-specific encryption rights. | (2) Design a Purview DLP policy using validated sensitive-content detectors and sharing conditions.
- (1) Use supported Purview content classification and discovery with appropriately scoped analyst roles. | (2) Design a Purview DLP policy using validated sensitive-content detectors and sharing conditions.
Explanation
Correct Answer
C:For requirement (1), Labels can express classification and enforce cryptographic access where supported. For requirement (2), DLP applies contextual restrictions to detected sensitive information. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (2) is not met: DLP applies contextual restrictions to detected sensitive information. The substituted action is instead for this different case: Legal staff need to preserve selected correspondence during an active investigation without changing organization-wide retention schedules. The proposed bundle therefore cannot satisfy BOTH stated requirements.
B:Requirement (1) is not met: Labels can express classification and enforce cryptographic access where supported. The substituted action is instead for this different case: A company must discover which SharePoint files contain confidential customer identifiers before designing access controls. Requirement (2) is not met: DLP applies contextual restrictions to detected sensitive information. The substituted action is instead for this different case: Legal staff need to preserve selected correspondence during an active investigation without changing organization-wide retention schedules. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: Labels can express classification and enforce cryptographic access where supported. The substituted action is instead for this different case: A company must discover which SharePoint files contain confidential customer identifiers before designing access controls. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 748
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) An architect treats every identified STRIDE threat as equally likely and refuses to prioritize mitigations. (2) A design review finishes without testing whether its recommended access controls actually reject unauthenticated requests. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Threat-model authorization bypass and business-logic abuse as well as network confidentiality. | (2) Convert threat-model assumptions into concrete negative authorization and misuse test cases.
- (1) Evaluate attack feasibility and business impact to rank threat-model countermeasures. | (2) Document data flows, entry points and trust boundaries using a structured threat-modeling method.
- (1) Threat-model authorization bypass and business-logic abuse as well as network confidentiality. | (2) Document data flows, entry points and trust boundaries using a structured threat-modeling method.
- (1) Evaluate attack feasibility and business impact to rank threat-model countermeasures. | (2) Convert threat-model assumptions into concrete negative authorization and misuse test cases.
Explanation
Correct Answer
D:For requirement (1), Threat discovery needs risk-informed treatment to guide practical implementation. For requirement (2), Security requirements are meaningful only when validated against adversarial behavior. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (1) is not met: Threat discovery needs risk-informed treatment to guide practical implementation. The substituted action is instead for this different case: An API exposes a payment approval function and the design review only checks for encrypted connections. The proposed bundle therefore cannot satisfy BOTH stated requirements.
B:Requirement (2) is not met: Security requirements are meaningful only when validated against adversarial behavior. The substituted action is instead for this different case: A team connects a mobile app to an internal service through a new gateway without updating its trust-boundary diagrams. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (1) is not met: Threat discovery needs risk-informed treatment to guide practical implementation. The substituted action is instead for this different case: An API exposes a payment approval function and the design review only checks for encrypted connections. Requirement (2) is not met: Security requirements are meaningful only when validated against adversarial behavior. The substituted action is instead for this different case: A team connects a mobile app to an internal service through a new gateway without updating its trust-boundary diagrams. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 749
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A data steward sees classification detections but cannot confirm who may access the affected records. (2) A records project classifies historical exports but never updates the catalog when new data pipelines are introduced. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Design automated data discovery and classification across approved storage and database services. | (2) Use content-based classification and business-owner validation instead of relying on naming conventions.
- (1) Link classification findings to effective identities and data-plane permissions. | (2) Integrate classification checks into ingestion and dataset lifecycle workflows.
- (1) Design automated data discovery and classification across approved storage and database services. | (2) Integrate classification checks into ingestion and dataset lifecycle workflows.
- (1) Link classification findings to effective identities and data-plane permissions. | (2) Use content-based classification and business-owner validation instead of relying on naming conventions.
Explanation
Correct Answer
B:For requirement (1), Sensitivity awareness must be combined with access evidence to assess exposure. For requirement (2), Data inventories become stale when changes to data sources are not reassessed. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (1) is not met: Sensitivity awareness must be combined with access evidence to assess exposure. The substituted action is instead for this different case: A global insurer stores confidential information in many subscriptions but has no catalog showing sensitive data locations. Requirement (2) is not met: Data inventories become stale when changes to data sources are not reassessed. The substituted action is instead for this different case: A financial table is labeled confidential by file name only despite containing mixed sensitivity levels. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (1) is not met: Sensitivity awareness must be combined with access evidence to assess exposure. The substituted action is instead for this different case: A global insurer stores confidential information in many subscriptions but has no catalog showing sensitive data locations. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (2) is not met: Data inventories become stale when changes to data sources are not reassessed. The substituted action is instead for this different case: A financial table is labeled confidential by file name only despite containing mixed sensitivity levels. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 750
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) An investigation labels all mobile-device anomalies as workstation persistence and misroutes response. (2) A team treats a red-team simulation detection as proven coverage for every variant of an ATT&CK technique. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Evaluate mobile-relevant MITRE ATT&CK behaviors and mobile telemetry availability. | (2) Test analytic coverage against representative variations and record the sensor and response assumptions.
- (1) Map detection use cases to MITRE ATT&CK techniques and identify uncovered tactics. | (2) Test analytic coverage against representative variations and record the sensor and response assumptions.
- (1) Evaluate mobile-relevant MITRE ATT&CK behaviors and mobile telemetry availability. | (2) Include appropriate ATT&CK for ICS techniques and industrial event sources in detection design.
- (1) Map detection use cases to MITRE ATT&CK techniques and identify uncovered tactics. | (2) Include appropriate ATT&CK for ICS techniques and industrial event sources in detection design.
Explanation
Correct Answer
A:For requirement (1), Mobile attack techniques and sensors require distinct detection context. For requirement (2), One successful simulated detection does not imply complete technique coverage. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
B:Requirement (1) is not met: Mobile attack techniques and sensors require distinct detection context. The substituted action is instead for this different case: A security dashboard lists alert counts but cannot demonstrate which adversary techniques are detected. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (2) is not met: One successful simulated detection does not imply complete technique coverage. The substituted action is instead for this different case: A factory SOC adopts only enterprise IT ATT&CK techniques while its control networks use industrial protocols. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: Mobile attack techniques and sensors require distinct detection context. The substituted action is instead for this different case: A security dashboard lists alert counts but cannot demonstrate which adversary techniques are detected. Requirement (2) is not met: One successful simulated detection does not imply complete technique coverage. The substituted action is instead for this different case: A factory SOC adopts only enterprise IT ATT&CK techniques while its control networks use industrial protocols. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Microsoft Cybersecurity Architect (SC-100) Practice Tests