Question 780
An enterprise security architecture project has TWO distinct requirements in the same workstream: (1) An architect compares two Microsoft 365 tenants' security scores without considering their different licensed feature sets. (2) The security architect wants to prioritize tenant security improvements but cannot quantify the impact of disrupting daily collaboration. Which paired set of recommendations satisfies BOTH requirements without substituting a control intended for another risk?
Explanation
Correct Answer
For requirement (1), Raw score comparison may be misleading when the set of eligible assessed controls differs. For requirement (2), Security priorities should integrate risk reduction and operating continuity. Both controls are required to meet the paired risks without substituting for each other.
Incorrect Answers
Requirement (1) is not met: Raw score comparison may be misleading when the set of eligible assessed controls differs. The substituted action is instead for this different case: A collaboration tenant has several risky sharing settings but leadership only tracks purchased security licenses. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Requirement (2) is not met: Security priorities should integrate risk reduction and operating continuity. The substituted action is instead for this different case: A Secure Score rises after a control receives an exception status although the underlying user access configuration is unchanged. The proposed bundle therefore cannot satisfy BOTH stated requirements.
Requirement (1) is not met: Raw score comparison may be misleading when the set of eligible assessed controls differs. The substituted action is instead for this different case: A collaboration tenant has several risky sharing settings but leadership only tracks purchased security licenses. Requirement (2) is not met: Security priorities should integrate risk reduction and operating continuity. The substituted action is instead for this different case: A Secure Score rises after a control receives an exception status although the underlying user access configuration is unchanged. The proposed bundle therefore cannot satisfy BOTH stated requirements.






Microsoft Cybersecurity Architect (SC-100) Practice Tests