Question 750
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) An investigation labels all mobile-device anomalies as workstation persistence and misroutes response. (2) A team treats a red-team simulation detection as proven coverage for every variant of an ATT&CK technique. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Evaluate mobile-relevant MITRE ATT&CK behaviors and mobile telemetry availability. | (2) Test analytic coverage against representative variations and record the sensor and response assumptions.
- (1) Map detection use cases to MITRE ATT&CK techniques and identify uncovered tactics. | (2) Test analytic coverage against representative variations and record the sensor and response assumptions.
- (1) Evaluate mobile-relevant MITRE ATT&CK behaviors and mobile telemetry availability. | (2) Include appropriate ATT&CK for ICS techniques and industrial event sources in detection design.
- (1) Map detection use cases to MITRE ATT&CK techniques and identify uncovered tactics. | (2) Include appropriate ATT&CK for ICS techniques and industrial event sources in detection design.
Explanation
Correct Answer
A:For requirement (1), Mobile attack techniques and sensors require distinct detection context. For requirement (2), One successful simulated detection does not imply complete technique coverage. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
B:Requirement (1) is not met: Mobile attack techniques and sensors require distinct detection context. The substituted action is instead for this different case: A security dashboard lists alert counts but cannot demonstrate which adversary techniques are detected. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (2) is not met: One successful simulated detection does not imply complete technique coverage. The substituted action is instead for this different case: A factory SOC adopts only enterprise IT ATT&CK techniques while its control networks use industrial protocols. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: Mobile attack techniques and sensors require distinct detection context. The substituted action is instead for this different case: A security dashboard lists alert counts but cannot demonstrate which adversary techniques are detected. Requirement (2) is not met: One successful simulated detection does not imply complete technique coverage. The substituted action is instead for this different case: A factory SOC adopts only enterprise IT ATT&CK techniques while its control networks use industrial protocols. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 751
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A control has been implemented only in the primary region while workloads also serve regulated traffic elsewhere. (2) An engineering team plans to claim continuous compliance from an annual spreadsheet completed by a single administrator. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Assess control coverage across every approved location and execution environment. | (2) Introduce repeatable automated evidence collection and independent control-owner review.
- (1) Define architecture acceptance criteria that include control testing, telemetry and failure-mode verification. | (2) Introduce repeatable automated evidence collection and independent control-owner review.
- (1) Assess control coverage across every approved location and execution environment. | (2) Validate reference recommendations against local prerequisites and record justified design deviations.
- (1) Define architecture acceptance criteria that include control testing, telemetry and failure-mode verification. | (2) Validate reference recommendations against local prerequisites and record justified design deviations.
Explanation
Correct Answer
A:For requirement (1), Partial rollout creates unprotected processing paths even if the primary region passes inspection. For requirement (2), Continuous assurance needs current technical signals and review beyond a one-time questionnaire. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
B:Requirement (1) is not met: Partial rollout creates unprotected processing paths even if the primary region passes inspection. The substituted action is instead for this different case: A security design review accepts a product diagram but lacks evidence of how the proposed controls work under failure. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (2) is not met: Continuous assurance needs current technical signals and review beyond a one-time questionnaire. The substituted action is instead for this different case: An enterprise trusts a vendor reference configuration even though the deployment environment has different identity and network constraints. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: Partial rollout creates unprotected processing paths even if the primary region passes inspection. The substituted action is instead for this different case: A security design review accepts a product diagram but lacks evidence of how the proposed controls work under failure. Requirement (2) is not met: Continuous assurance needs current technical signals and review beyond a one-time questionnaire. The substituted action is instead for this different case: An enterprise trusts a vendor reference configuration even though the deployment environment has different identity and network constraints. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 752
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) An architecture review lists technical threats but excludes vendors and privileged operators from the attack surface. (2) A risk committee receives control gaps without impact, likelihood or remediation ownership. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Include third-party and internal trust relationships in the threat inventory and mitigation plan. | (2) Translate identified control gaps into risk-ranked treatment decisions with accountable owners.
- (1) Prioritize risk and compliance requirements before using posture scores to choose compensating controls. | (2) Translate identified control gaps into risk-ranked treatment decisions with accountable owners.
- (1) Include third-party and internal trust relationships in the threat inventory and mitigation plan. | (2) Establish an agreed source of identity truth and consistent joiner-mover-leaver architecture.
- (1) Prioritize risk and compliance requirements before using posture scores to choose compensating controls. | (2) Establish an agreed source of identity truth and consistent joiner-mover-leaver architecture.
Explanation
Correct Answer
A:For requirement (1), Supply-chain and insider paths can bypass controls designed only for internet attackers. For requirement (2), Prioritization requires business consequences and a named control remediation path. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
B:Requirement (1) is not met: Supply-chain and insider paths can bypass controls designed only for internet attackers. The substituted action is instead for this different case: A cloud project seeks the highest possible Secure Score but ignores regulatory data residency obligations. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (2) is not met: Prioritization requires business consequences and a named control remediation path. The substituted action is instead for this different case: Two business units deploy redundant identity tools that disagree about the authoritative account lifecycle. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: Supply-chain and insider paths can bypass controls designed only for internet attackers. The substituted action is instead for this different case: A cloud project seeks the highest possible Secure Score but ignores regulatory data residency obligations. Requirement (2) is not met: Prioritization requires business consequences and a named control remediation path. The substituted action is instead for this different case: Two business units deploy redundant identity tools that disagree about the authoritative account lifecycle. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 753
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A tenant contains an emergency access identity with ordinary email and browsing enabled. (2) An automation account receives direct permanent Owner permissions on every production subscription. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Establish dedicated monitored emergency access accounts with restricted routine use. | (2) Replace blanket standing ownership with narrow scoped roles and approved elevation paths.
- (1) Separate privileged access tiers and delegate authority only for the required control plane. | (2) Replace blanket standing ownership with narrow scoped roles and approved elevation paths.
- (1) Establish dedicated monitored emergency access accounts with restricted routine use. | (2) Scope supported administrative roles to the subsidiary through appropriate administrative units.
- (1) Separate privileged access tiers and delegate authority only for the required control plane. | (2) Scope supported administrative roles to the subsidiary through appropriate administrative units.
Explanation
Correct Answer
A:For requirement (1), Recovery principals should remain available but not be exposed to everyday application risk. For requirement (2), Reducing excess privilege limits accidental or malicious modification of unrelated workloads. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
B:Requirement (1) is not met: Recovery principals should remain available but not be exposed to everyday application risk. The substituted action is instead for this different case: An engineer proposes that every cloud administrator also hold permanent enterprise domain administrator privileges. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (2) is not met: Reducing excess privilege limits accidental or malicious modification of unrelated workloads. The substituted action is instead for this different case: The help desk needs to reset passwords for one subsidiary but receives tenant-wide user administrator rights. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: Recovery principals should remain available but not be exposed to everyday application risk. The substituted action is instead for this different case: An engineer proposes that every cloud administrator also hold permanent enterprise domain administrator privileges. Requirement (2) is not met: Reducing excess privilege limits accidental or malicious modification of unrelated workloads. The substituted action is instead for this different case: The help desk needs to reset passwords for one subsidiary but receives tenant-wide user administrator rights. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 754
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) Production servers allow local administrator access from standard employee workstations. (2) A container host has healthy runtime workloads but its underlying operating system security updates are months behind. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Restrict privileged management ingress and require approved hardened administrative pathways. | (2) Include host operating-system patching and vulnerability monitoring in the container platform baseline.
- (1) Specify OS-specific endpoint protection and secure configuration standards for the server estate. | (2) Include host operating-system patching and vulnerability monitoring in the container platform baseline.
- (1) Restrict privileged management ingress and require approved hardened administrative pathways. | (2) Plan isolation or migration to a supported platform with documented interim risk controls.
- (1) Specify OS-specific endpoint protection and secure configuration standards for the server estate. | (2) Plan isolation or migration to a supported platform with documented interim risk controls.
Explanation
Correct Answer
A:For requirement (1), Management-plane isolation reduces lateral movement to critical server resources. For requirement (2), Securing containers does not eliminate weaknesses in the host kernel and services. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
B:Requirement (1) is not met: Management-plane isolation reduces lateral movement to critical server resources. The substituted action is instead for this different case: A mixed Windows and Linux server fleet has no consistent detection coverage or local hardening baseline. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (2) is not met: Securing containers does not eliminate weaknesses in the host kernel and services. The substituted action is instead for this different case: An internet-facing Windows server runs an unsupported OS and the team expects ordinary patch deployment to fix it. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: Management-plane isolation reduces lateral movement to critical server resources. The substituted action is instead for this different case: A mixed Windows and Linux server fleet has no consistent detection coverage or local hardening baseline. Requirement (2) is not met: Securing containers does not eliminate weaknesses in the host kernel and services. The substituted action is instead for this different case: An internet-facing Windows server runs an unsupported OS and the team expects ordinary patch deployment to fix it. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 755
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A service is moved behind a private endpoint, yet its old public DNS name continues to resolve to an exposed address. (2) The network team permits all ports between Azure and an acquired private cloud because it does not know the required application flows. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Include monitoring endpoint reachability and firewall telemetry in network security acceptance tests. | (2) Inventory authorized application protocols and enforce narrow hybrid network access rules.
- (1) Validate DNS and public endpoint disablement after the private connectivity migration. | (2) Design appropriate network flow telemetry for internal and cross-region sensitive paths.
- (1) Include monitoring endpoint reachability and firewall telemetry in network security acceptance tests. | (2) Design appropriate network flow telemetry for internal and cross-region sensitive paths.
- (1) Validate DNS and public endpoint disablement after the private connectivity migration. | (2) Inventory authorized application protocols and enforce narrow hybrid network access rules.
Explanation
Correct Answer
D:For requirement (1), Changing one application connection does not necessarily remove the original public attack surface. For requirement (2), Broad interconnects expand blast radius across cloud trust boundaries. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (1) is not met: Changing one application connection does not necessarily remove the original public attack surface. The substituted action is instead for this different case: A branch firewall blocks Azure monitoring traffic after a network redesign, leaving a gap in security telemetry. The proposed bundle therefore cannot satisfy BOTH stated requirements.
B:Requirement (2) is not met: Broad interconnects expand blast radius across cloud trust boundaries. The substituted action is instead for this different case: A cross-region incident requires inspecting east-west application connections but only internet ingress logs are retained. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (1) is not met: Changing one application connection does not necessarily remove the original public attack surface. The substituted action is instead for this different case: A branch firewall blocks Azure monitoring traffic after a network redesign, leaving a gap in security telemetry. Requirement (2) is not met: Broad interconnects expand blast radius across cloud trust boundaries. The substituted action is instead for this different case: A cross-region incident requires inspecting east-west application connections but only internet ingress logs are retained. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 756
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A server build pipeline uses hardened templates but administrators repeatedly override settings after deployment. (2) A compliance report shows that antivirus is installed but its signatures and cloud protection have not updated for weeks. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Pilot platform-specific baseline controls and document justified workload exceptions. | (2) Validate effective disk encryption state rather than relying on policy assignment alone.
- (1) Detect configuration drift and reconcile operational changes against approved hardened baselines. | (2) Include product health, update freshness and telemetry availability in the endpoint assurance standard.
- (1) Pilot platform-specific baseline controls and document justified workload exceptions. | (2) Include product health, update freshness and telemetry availability in the endpoint assurance standard.
- (1) Detect configuration drift and reconcile operational changes against approved hardened baselines. | (2) Validate effective disk encryption state rather than relying on policy assignment alone.
Explanation
Correct Answer
B:For requirement (1), Ongoing assurance must catch unsafe deviations from the initial image. For requirement (2), Installed software alone does not prove current protective capability. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (1) is not met: Ongoing assurance must catch unsafe deviations from the initial image. The substituted action is instead for this different case: A configuration team enables one generic security baseline for every device regardless of application compatibility. Requirement (2) is not met: Installed software alone does not prove current protective capability. The substituted action is instead for this different case: Devices report compliant because a policy was assigned, yet the expected BitLocker protection is absent. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (1) is not met: Ongoing assurance must catch unsafe deviations from the initial image. The substituted action is instead for this different case: A configuration team enables one generic security baseline for every device regardless of application compatibility. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (2) is not met: Installed software alone does not prove current protective capability. The substituted action is instead for this different case: Devices report compliant because a policy was assigned, yet the expected BitLocker protection is absent. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 757
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A release manager cannot associate a production binary with the approved source commit. (2) A team accepts security defects in a release without recording who approved the exception or when it expires. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Require signed or attested release provenance linking build outputs to reviewed source revisions. | (2) Create a documented risk exception path with compensating controls and time-bounded remediation.
- (1) Embed design review, testing and remediation in each phase of the application development lifecycle. | (2) Create a documented risk exception path with compensating controls and time-bounded remediation.
- (1) Require signed or attested release provenance linking build outputs to reviewed source revisions. | (2) Establish software bill of materials and dependency update governance for third-party packages.
- (1) Embed design review, testing and remediation in each phase of the application development lifecycle. | (2) Establish software bill of materials and dependency update governance for third-party packages.
Explanation
Correct Answer
A:For requirement (1), Supply-chain integrity depends on knowing the origin of deployed artifacts. For requirement (2), A controlled exception should preserve accountability for residual application risk. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
B:Requirement (1) is not met: Supply-chain integrity depends on knowing the origin of deployed artifacts. The substituted action is instead for this different case: An engineering group performs security review only after production incidents. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (2) is not met: A controlled exception should preserve accountability for residual application risk. The substituted action is instead for this different case: A production app relies on an unsupported open-source library but developers assume vendor support covers it. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: Supply-chain integrity depends on knowing the origin of deployed artifacts. The substituted action is instead for this different case: An engineering group performs security review only after production incidents. Requirement (2) is not met: A controlled exception should preserve accountability for residual application risk. The substituted action is instead for this different case: A production app relies on an unsupported open-source library but developers assume vendor support covers it. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 758
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A backup operator can both delete immutable backup protection settings and restore data without independent approval. (2) Domain controllers in every region replicate untested privileged group changes during a security incident. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Maintain protected emergency administrative access with monitored, rehearsed recovery procedures. | (2) Replace person-bound privileged automation with a governed workload identity and least-privilege permissions.
- (1) Separate destructive backup administration from ordinary restore permissions and enforce independent approvals. | (2) Include directory recovery, privileged group validation and trusted identity checkpoints in the resilience plan.
- (1) Maintain protected emergency administrative access with monitored, rehearsed recovery procedures. | (2) Include directory recovery, privileged group validation and trusted identity checkpoints in the resilience plan.
- (1) Separate destructive backup administration from ordinary restore permissions and enforce independent approvals. | (2) Replace person-bound privileged automation with a governed workload identity and least-privilege permissions.
Explanation
Correct Answer
B:For requirement (1), Separation of duties reduces the impact of one compromised recovery operator. For requirement (2), The identity plane is a recovery dependency and can propagate harmful changes across otherwise isolated sites. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (1) is not met: Separation of duties reduces the impact of one compromised recovery operator. The substituted action is instead for this different case: Ransomware responders cannot use recovery consoles because the tenant's normal administrator identities were disabled. Requirement (2) is not met: The identity plane is a recovery dependency and can propagate harmful changes across otherwise isolated sites. The substituted action is instead for this different case: Production automation depends on one employee's Global Administrator credential and fails when that account is disabled. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (1) is not met: Separation of duties reduces the impact of one compromised recovery operator. The substituted action is instead for this different case: Ransomware responders cannot use recovery consoles because the tenant's normal administrator identities were disabled. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (2) is not met: The identity plane is a recovery dependency and can propagate harmful changes across otherwise isolated sites. The substituted action is instead for this different case: Production automation depends on one employee's Global Administrator credential and fails when that account is disabled. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 759
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A directory team plans passwordless deployment without assessing which legacy applications support modern authentication. (2) A compromised session remains active after password change and the owner believes password reset alone closes the incident. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Design risk-based verification, containment and credential recovery workflows for compromised accounts. | (2) Design a verified recovery and strong-method re-registration process for lost authenticators.
- (1) Inventory unsupported client protocols and stage their replacement before enforcing passwordless access. | (2) Include session revocation and token investigation in identity compromise response.
- (1) Design risk-based verification, containment and credential recovery workflows for compromised accounts. | (2) Include session revocation and token investigation in identity compromise response.
- (1) Inventory unsupported client protocols and stage their replacement before enforcing passwordless access. | (2) Design a verified recovery and strong-method re-registration process for lost authenticators.
Explanation
Correct Answer
B:For requirement (1), Modern sign-in requires compatible clients and applications; enrollment alone does not update legacy protocols. For requirement (2), Existing sessions may survive a credential update until explicit or policy-driven invalidation. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (1) is not met: Modern sign-in requires compatible clients and applications; enrollment alone does not update legacy protocols. The substituted action is instead for this different case: A high-risk identity appears in Identity Protection and the help desk proposes dismissing it without investigation. Requirement (2) is not met: Existing sessions may survive a credential update until explicit or policy-driven invalidation. The substituted action is instead for this different case: A user replaces a phone and cannot complete MFA, so support plans to disable all MFA enforcement. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (1) is not met: Modern sign-in requires compatible clients and applications; enrollment alone does not update legacy protocols. The substituted action is instead for this different case: A high-risk identity appears in Identity Protection and the help desk proposes dismissing it without investigation. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (2) is not met: Existing sessions may survive a credential update until explicit or policy-driven invalidation. The substituted action is instead for this different case: A user replaces a phone and cannot complete MFA, so support plans to disable all MFA enforcement. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 760
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A software vendor claims SOC reports prove that every custom configuration of its application is secure. (2) A security board authorizes a new application but no one owns future dependency updates. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Validate the application-specific configuration and customer responsibility model separately from vendor assurances. | (2) Prioritize application posture findings by reachable attack paths and regulated data impact.
- (1) Build an application security inventory with criticality, exposure, ownership and identity dependencies. | (2) Prioritize application posture findings by reachable attack paths and regulated data impact.
- (1) Validate the application-specific configuration and customer responsibility model separately from vendor assurances. | (2) Assign application security ownership and a funded vulnerability management lifecycle.
- (1) Build an application security inventory with criticality, exposure, ownership and identity dependencies. | (2) Assign application security ownership and a funded vulnerability management lifecycle.
Explanation
Correct Answer
C:For requirement (1), General vendor audits do not verify the purchaser's unique deployment controls. For requirement (2), Application protection must continue after initial launch and approval. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (2) is not met: Application protection must continue after initial launch and approval. The substituted action is instead for this different case: An application assessment scores a public healthcare API and an internal demo app equally because both lack one HTTP header. The proposed bundle therefore cannot satisfy BOTH stated requirements.
B:Requirement (1) is not met: General vendor audits do not verify the purchaser's unique deployment controls. The substituted action is instead for this different case: A corporation has hundreds of internal apps but no inventory of their hosting, owners or authentication methods. Requirement (2) is not met: Application protection must continue after initial launch and approval. The substituted action is instead for this different case: An application assessment scores a public healthcare API and an internal demo app equally because both lack one HTTP header. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: General vendor audits do not verify the purchaser's unique deployment controls. The substituted action is instead for this different case: A corporation has hundreds of internal apps but no inventory of their hosting, owners or authentication methods. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Microsoft Cybersecurity Architect (SC-100) Practice Tests