Question 760
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A software vendor claims SOC reports prove that every custom configuration of its application is secure. (2) A security board authorizes a new application but no one owns future dependency updates. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Validate the application-specific configuration and customer responsibility model separately from vendor assurances. | (2) Prioritize application posture findings by reachable attack paths and regulated data impact.
- (1) Build an application security inventory with criticality, exposure, ownership and identity dependencies. | (2) Prioritize application posture findings by reachable attack paths and regulated data impact.
- (1) Validate the application-specific configuration and customer responsibility model separately from vendor assurances. | (2) Assign application security ownership and a funded vulnerability management lifecycle.
- (1) Build an application security inventory with criticality, exposure, ownership and identity dependencies. | (2) Assign application security ownership and a funded vulnerability management lifecycle.
Explanation
Correct Answer
C:For requirement (1), General vendor audits do not verify the purchaser's unique deployment controls. For requirement (2), Application protection must continue after initial launch and approval. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (2) is not met: Application protection must continue after initial launch and approval. The substituted action is instead for this different case: An application assessment scores a public healthcare API and an internal demo app equally because both lack one HTTP header. The proposed bundle therefore cannot satisfy BOTH stated requirements.
B:Requirement (1) is not met: General vendor audits do not verify the purchaser's unique deployment controls. The substituted action is instead for this different case: A corporation has hundreds of internal apps but no inventory of their hosting, owners or authentication methods. Requirement (2) is not met: Application protection must continue after initial launch and approval. The substituted action is instead for this different case: An application assessment scores a public healthcare API and an internal demo app equally because both lack one HTTP header. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: General vendor audits do not verify the purchaser's unique deployment controls. The substituted action is instead for this different case: A corporation has hundreds of internal apps but no inventory of their hosting, owners or authentication methods. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 761
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A PaaS application team disables authentication because the underlying service platform already uses encryption. (2) The same baseline is applied without adaptation to Kubernetes nodes, managed SQL and Microsoft 365. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Define customer-owned SaaS identity, sharing and data-protection configuration requirements. | (2) Allocate customer responsibility for guest OS and application security under the IaaS service model.
- (1) Require application identity, authorization and secret controls for PaaS workloads. | (2) Create service-model-specific control profiles anchored in shared enterprise security requirements.
- (1) Define customer-owned SaaS identity, sharing and data-protection configuration requirements. | (2) Create service-model-specific control profiles anchored in shared enterprise security requirements.
- (1) Require application identity, authorization and secret controls for PaaS workloads. | (2) Allocate customer responsibility for guest OS and application security under the IaaS service model.
Explanation
Correct Answer
B:For requirement (1), Provider platform safeguards do not authenticate application users or authorize data access. For requirement (2), IaaS, PaaS and SaaS expose different customer-configurable control surfaces. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (1) is not met: Provider platform safeguards do not authenticate application users or authorize data access. The substituted action is instead for this different case: A workload team assumes a SaaS provider automatically controls which internal employees can export confidential files. Requirement (2) is not met: IaaS, PaaS and SaaS expose different customer-configurable control surfaces. The substituted action is instead for this different case: An Azure VM owner assumes Microsoft patches every custom application installed inside the guest. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (1) is not met: Provider platform safeguards do not authenticate application users or authorize data access. The substituted action is instead for this different case: A workload team assumes a SaaS provider automatically controls which internal employees can export confidential files. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (2) is not met: IaaS, PaaS and SaaS expose different customer-configurable control surfaces. The substituted action is instead for this different case: An Azure VM owner assumes Microsoft patches every custom application installed inside the guest. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 762
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A vendor requests unrestricted production database access to provide temporary support. (2) A project retires a cloud application but leaves external vendors with active keys to its archived data. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Approve time-limited narrowly scoped vendor access with monitored sessions and expiry. | (2) Evaluate cross-border data movement restrictions and design approved transfer controls before exporting.
- (1) Conduct third-party data-processing due diligence and define contractual security obligations. | (2) Evaluate cross-border data movement restrictions and design approved transfer controls before exporting.
- (1) Approve time-limited narrowly scoped vendor access with monitored sessions and expiry. | (2) Include credential revocation and third-party access closure in the data decommissioning plan.
- (1) Conduct third-party data-processing due diligence and define contractual security obligations. | (2) Include credential revocation and third-party access closure in the data decommissioning plan.
Explanation
Correct Answer
C:For requirement (1), Contracted support does not justify enduring broad access to regulated records. For requirement (2), Retired workloads can retain accessible sensitive data if external grants persist. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (2) is not met: Retired workloads can retain accessible sensitive data if external grants persist. The substituted action is instead for this different case: A database export crosses a legal jurisdiction without a documented business purpose or residency assessment. The proposed bundle therefore cannot satisfy BOTH stated requirements.
B:Requirement (1) is not met: Contracted support does not justify enduring broad access to regulated records. The substituted action is instead for this different case: A SaaS supplier will process regulated customer data but the security team has not assessed its subcontractors. Requirement (2) is not met: Retired workloads can retain accessible sensitive data if external grants persist. The substituted action is instead for this different case: A database export crosses a legal jurisdiction without a documented business purpose or residency assessment. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: Contracted support does not justify enduring broad access to regulated records. The substituted action is instead for this different case: A SaaS supplier will process regulated customer data but the security team has not assessed its subcontractors. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 763
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A chatbot sends sensitive prompts to a third-party service without documenting retention or residency terms. (2) An AI team enables broad model endpoint access because it assumes safety filters also restrict callers. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Establish AI data-handling requirements for storage, processing locations and vendor agreements before approval. | (2) Include prompt-injection threat modeling and policy-enforced tool and data boundaries around the model.
- (1) Restrict retrieval to user-authorized content and enforce data-plane access controls in the AI pipeline. | (2) Include prompt-injection threat modeling and policy-enforced tool and data boundaries around the model.
- (1) Establish AI data-handling requirements for storage, processing locations and vendor agreements before approval. | (2) Enforce model endpoint authentication, authorization and logging independently of content safety controls.
- (1) Restrict retrieval to user-authorized content and enforce data-plane access controls in the AI pipeline. | (2) Enforce model endpoint authentication, authorization and logging independently of content safety controls.
Explanation
Correct Answer
C:For requirement (1), Secure AI adoption includes privacy and contractual data processing controls, not only model accuracy. For requirement (2), Content filtering evaluates outputs but does not substitute for access control to model resources. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (2) is not met: Content filtering evaluates outputs but does not substitute for access control to model resources. The substituted action is instead for this different case: A model deployment accepts unfiltered user prompts that may cause the assistant to reveal privileged system instructions. The proposed bundle therefore cannot satisfy BOTH stated requirements.
B:Requirement (1) is not met: Secure AI adoption includes privacy and contractual data processing controls, not only model accuracy. The substituted action is instead for this different case: A generative AI application can read unrelated customer records through its retrieval index. Requirement (2) is not met: Content filtering evaluates outputs but does not substitute for access control to model resources. The substituted action is instead for this different case: A model deployment accepts unfiltered user prompts that may cause the assistant to reveal privileged system instructions. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: Secure AI adoption includes privacy and contractual data processing controls, not only model accuracy. The substituted action is instead for this different case: A generative AI application can read unrelated customer records through its retrieval index. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 764
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A security program wants to track whether strategic exposure-reduction initiatives improve over several months. (2) Two teams independently patch the same low-impact issue while a high-risk identity-to-server path remains open. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Design a measurable exposure-management initiative review with consistent scope and trend baselines. | (2) Distinguish modeled exposure relationships from confirmed compromise telemetry and incident evidence.
- (1) Use Security Exposure Management attack paths and asset criticality to prioritize the chained risk. | (2) Distinguish modeled exposure relationships from confirmed compromise telemetry and incident evidence.
- (1) Design a measurable exposure-management initiative review with consistent scope and trend baselines. | (2) Coordinate remediation priorities across endpoint and identity owners using attack-path analysis.
- (1) Use Security Exposure Management attack paths and asset criticality to prioritize the chained risk. | (2) Coordinate remediation priorities across endpoint and identity owners using attack-path analysis.
Explanation
Correct Answer
C:For requirement (1), Trend assessment requires stable coverage and explicit outcomes, not only one dashboard snapshot. For requirement (2), Cross-domain attack paths require joint mitigation rather than isolated asset queues. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (2) is not met: Cross-domain attack paths require joint mitigation rather than isolated asset queues. The substituted action is instead for this different case: The exposure team treats every modeled attack path as evidence that an adversary has already traversed it. The proposed bundle therefore cannot satisfy BOTH stated requirements.
B:Requirement (1) is not met: Trend assessment requires stable coverage and explicit outcomes, not only one dashboard snapshot. The substituted action is instead for this different case: A vulnerable workstation links to a privileged service account, but teams prioritize only by its standalone CVSS number. Requirement (2) is not met: Cross-domain attack paths require joint mitigation rather than isolated asset queues. The substituted action is instead for this different case: The exposure team treats every modeled attack path as evidence that an adversary has already traversed it. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: Trend assessment requires stable coverage and explicit outcomes, not only one dashboard snapshot. The substituted action is instead for this different case: A vulnerable workstation links to a privileged service account, but teams prioritize only by its standalone CVSS number. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 765
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A former contractor remains eligible for Global Administrator role activation months after their project ends. (2) The SOC cannot identify who activated a privileged role just before suspicious tenant configuration changes. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Review PIM eligibility periodically and revoke assignments without current business sponsorship. | (2) Configure approval and justification in the applicable PIM activation policy.
- (1) Use Entra Privileged Identity Management eligible assignments with time-bounded activation. | (2) Configure approval and justification in the applicable PIM activation policy.
- (1) Review PIM eligibility periodically and revoke assignments without current business sponsorship. | (2) Use PIM activation and directory audit history to reconstruct the elevation timeline.
- (1) Use Entra Privileged Identity Management eligible assignments with time-bounded activation. | (2) Use PIM activation and directory audit history to reconstruct the elevation timeline.
Explanation
Correct Answer
C:For requirement (1), Eligible assignments are still an access risk even when not activated. For requirement (2), Traceable activation events connect privileged authority to specific actions and dates. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (2) is not met: Traceable activation events connect privileged authority to specific actions and dates. The substituted action is instead for this different case: A privileged role activation proceeds without approval even though high-impact changes require a second person. The proposed bundle therefore cannot satisfy BOTH stated requirements.
B:Requirement (1) is not met: Eligible assignments are still an access risk even when not activated. The substituted action is instead for this different case: A security engineer needs elevated directory permissions for one maintenance window but currently holds them permanently. Requirement (2) is not met: Traceable activation events connect privileged authority to specific actions and dates. The substituted action is instead for this different case: A privileged role activation proceeds without approval even though high-impact changes require a second person. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: Eligible assignments are still an access risk even when not activated. The substituted action is instead for this different case: A security engineer needs elevated directory permissions for one maintenance window but currently holds them permanently. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 766
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A model training job copies regulated customer records into a globally shared temporary storage account. (2) A generative AI team logs raw confidential prompts for debugging but cannot define who is permitted to access them. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Apply data minimization, restricted processing locations and controlled storage to training datasets. | (2) Limit AI prompt telemetry, mask sensitive fields and enforce approved retention and audit permissions.
- (1) Enforce user-context data authorization before returning retrieved passages to the model. | (2) Limit AI prompt telemetry, mask sensitive fields and enforce approved retention and audit permissions.
- (1) Apply data minimization, restricted processing locations and controlled storage to training datasets. | (2) Design prompt-injection defenses with explicit tool permission and output-data boundaries.
- (1) Enforce user-context data authorization before returning retrieved passages to the model. | (2) Design prompt-injection defenses with explicit tool permission and output-data boundaries.
Explanation
Correct Answer
A:For requirement (1), AI development pipelines require the same confidentiality and residency safeguards as production systems. For requirement (2), Generated and submitted content can contain regulated information needing protective handling. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
B:Requirement (1) is not met: AI development pipelines require the same confidentiality and residency safeguards as production systems. The substituted action is instead for this different case: A retrieval AI assistant indexes confidential board documents for all employees without honoring SharePoint permissions. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (2) is not met: Generated and submitted content can contain regulated information needing protective handling. The substituted action is instead for this different case: A prompt contains untrusted instructions telling a tool-using model to disclose the full hidden customer dataset. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: AI development pipelines require the same confidentiality and residency safeguards as production systems. The substituted action is instead for this different case: A retrieval AI assistant indexes confidential board documents for all employees without honoring SharePoint permissions. Requirement (2) is not met: Generated and submitted content can contain regulated information needing protective handling. The substituted action is instead for this different case: A prompt contains untrusted instructions telling a tool-using model to disclose the full hidden customer dataset. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 767
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) An externally accessible test API contains a stale authentication endpoint, but no business owner is listed. (2) A business removes a legacy service but external scanners still find the previous endpoint. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Link discovered internet-facing assets to application owners and prioritize exposed authentication surfaces. | (2) Reconcile EASM findings with decommissioning and verify public DNS and hosting retirement.
- (1) Use Defender External Attack Surface Management discovery to inventory internet-visible assets. | (2) Reconcile EASM findings with decommissioning and verify public DNS and hosting retirement.
- (1) Link discovered internet-facing assets to application owners and prioritize exposed authentication surfaces. | (2) Validate attribution and ownership before treating discovered infrastructure as an enterprise asset.
- (1) Use Defender External Attack Surface Management discovery to inventory internet-visible assets. | (2) Validate attribution and ownership before treating discovered infrastructure as an enterprise asset.
Explanation
Correct Answer
A:For requirement (1), Unknown ownership delays remediation of publicly reachable sensitive interfaces. For requirement (2), Internet-facing exposure can persist after internal retirement records say a service is gone. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
B:Requirement (1) is not met: Unknown ownership delays remediation of publicly reachable sensitive interfaces. The substituted action is instead for this different case: The security team knows internal IP addresses but not the public domains and hosts registered by acquired subsidiaries. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (2) is not met: Internet-facing exposure can persist after internal retirement records say a service is gone. The substituted action is instead for this different case: An exposure report shows an unknown domain and administrators assume the organization owns it. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: Unknown ownership delays remediation of publicly reachable sensitive interfaces. The substituted action is instead for this different case: The security team knows internal IP addresses but not the public domains and hosts registered by acquired subsidiaries. Requirement (2) is not met: Internet-facing exposure can persist after internal retirement records say a service is gone. The substituted action is instead for this different case: An exposure report shows an unknown domain and administrators assume the organization owns it. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 768
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A Linux estate appears Arc-connected but security extensions are missing on half the servers. (2) An application team assumes Arc-enabled machines automatically become full Azure virtual machines for every control. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Validate desired extension deployment and policy compliance across Arc-enabled resource groups. | (2) Confirm feature support and shared operational responsibilities for Arc-enabled non-Azure servers.
- (1) Connect eligible non-Azure machines using Azure Arc-enabled servers and approved onboarding methods. | (2) Confirm feature support and shared operational responsibilities for Arc-enabled non-Azure servers.
- (1) Validate desired extension deployment and policy compliance across Arc-enabled resource groups. | (2) Use a controlled onboarding identity and rotate bootstrap credentials with least-privilege permissions.
- (1) Connect eligible non-Azure machines using Azure Arc-enabled servers and approved onboarding methods. | (2) Use a controlled onboarding identity and rotate bootstrap credentials with least-privilege permissions.
Explanation
Correct Answer
A:For requirement (1), Registration alone does not prove that each required protection component is installed. For requirement (2), Azure Arc extends selected management capabilities without replacing the original hosting environment. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
B:Requirement (1) is not met: Registration alone does not prove that each required protection component is installed. The substituted action is instead for this different case: On-premises Linux servers are excluded from Azure inventory and policy compliance checks. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (2) is not met: Azure Arc extends selected management capabilities without replacing the original hosting environment. The substituted action is instead for this different case: An Arc deployment script embeds a long-lived tenant secret with unrestricted resource creation rights. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (1) is not met: Registration alone does not prove that each required protection component is installed. The substituted action is instead for this different case: On-premises Linux servers are excluded from Azure inventory and policy compliance checks. Requirement (2) is not met: Azure Arc extends selected management capabilities without replacing the original hosting environment. The substituted action is instead for this different case: An Arc deployment script embeds a long-lived tenant secret with unrestricted resource creation rights. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 769
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A regional team wants to deploy controls without identifying the owner responsible for operating them. (2) A merger introduces a new cloud estate but the reference architecture has not mapped its administrative trust boundaries. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Map security requirements to Microsoft Cybersecurity Reference Architectures capabilities before selecting products. | (2) Design defense in depth with distinct controls across identities, devices, applications, network and data.
- (1) Assign control owners, measurable assurance evidence and escalation paths for each architecture capability. | (2) Extend trust-boundary diagrams to cover both organizations and their cross-tenant connections.
- (1) Map security requirements to Microsoft Cybersecurity Reference Architectures capabilities before selecting products. | (2) Extend trust-boundary diagrams to cover both organizations and their cross-tenant connections.
- (1) Assign control owners, measurable assurance evidence and escalation paths for each architecture capability. | (2) Design defense in depth with distinct controls across identities, devices, applications, network and data.
Explanation
Correct Answer
B:For requirement (1), Control ownership makes an architectural recommendation maintainable and auditable after rollout. For requirement (2), Security architecture must represent newly introduced identity boundaries and lateral-movement paths. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (1) is not met: Control ownership makes an architectural recommendation maintainable and auditable after rollout. The substituted action is instead for this different case: An enterprise compares two security tool purchases without first defining which identity, network and data threats must be covered. Requirement (2) is not met: Security architecture must represent newly introduced identity boundaries and lateral-movement paths. The substituted action is instead for this different case: A program proposes one global firewall as a substitute for application, identity and data security controls. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (1) is not met: Control ownership makes an architectural recommendation maintainable and auditable after rollout. The substituted action is instead for this different case: An enterprise compares two security tool purchases without first defining which identity, network and data threats must be covered. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (2) is not met: Security architecture must represent newly introduced identity boundaries and lateral-movement paths. The substituted action is instead for this different case: A program proposes one global firewall as a substitute for application, identity and data security controls. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Question 770
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) A team scans source code but never examines third-party packages shipped in the final container image. (2) Runtime detections are missing for workloads in a managed Kubernetes cluster despite completed image scanning. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
- (1) Require trusted registry sources, image vulnerability checks and provenance verification. | (2) Apply least-privilege container runtime settings and eliminate unnecessary host access.
- (1) Include image and dependency scanning for the exact release artifact. | (2) Add supported container runtime detection and managed-cluster threat protection.
- (1) Require trusted registry sources, image vulnerability checks and provenance verification. | (2) Add supported container runtime detection and managed-cluster threat protection.
- (1) Include image and dependency scanning for the exact release artifact. | (2) Apply least-privilege container runtime settings and eliminate unnecessary host access.
Explanation
Correct Answer
B:For requirement (1), The deployed container can contain vulnerable components absent from source scans. For requirement (2), Build-time scanning does not observe malicious behavior after deployment. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
A:Requirement (1) is not met: The deployed container can contain vulnerable components absent from source scans. The substituted action is instead for this different case: Developers deploy container images directly from an unverified personal registry into production. Requirement (2) is not met: Build-time scanning does not observe malicious behavior after deployment. The substituted action is instead for this different case: A pod runs as a privileged root container with host filesystem mounts for routine application logging. The proposed bundle therefore cannot satisfy BOTH stated requirements.
C:Requirement (1) is not met: The deployed container can contain vulnerable components absent from source scans. The substituted action is instead for this different case: Developers deploy container images directly from an unverified personal registry into production. The proposed bundle therefore cannot satisfy BOTH stated requirements.
D:Requirement (2) is not met: Build-time scanning does not observe malicious behavior after deployment. The substituted action is instead for this different case: A pod runs as a privileged root container with host filesystem mounts for routine application logging. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Microsoft Cybersecurity Architect (SC-100) Practice Tests