Practice exam 1
60 questions
Open this course’s practice exams →Microsoft cybersecurity architecture · Public course · v1.0.1
SC-100: Microsoft Cybersecurity Architect
810 focused flashcards and 498 original practice questions covering all 81 SC-100 assessment objectives effective 21 October 2026, with six non-overlapping 60-question practice exams.
810 flashcards · 498 practice questions
Open study modesLearn IT smarter. Your progress stays in your browser.
Choose topics, then use Flashcards, Learn, Write, Match, Practice Questions or Mock Exam when the course has suitable content.
Unofficial study material. Not affiliated with or endorsed by Microsoft. These are original learning questions, not actual exam questions. Product capabilities and exam objectives can change; verify current Microsoft documentation. Practice scores do not predict or guarantee an exam result.
Topics in this course
Business resilience and ransomwareMCRA MCSB and Zero TrustCAF Well Architected and secure adoptionSecurity operations detection and responseIdentity authentication and accessPrivileged access and governanceRegulatory compliance and controlsHybrid multicloud posture and exposureServer client IoT and OT securitySaaS PaaS IaaS containers and AI servicesNetwork security and Security Service EdgeMicrosoft 365 Intune Purview and CopilotApplication lifecycle workload identities and APIsData classification encryption databases and storagePractice exams
Fixed question sets within this course. Open study modes to take an exam and save results in your browser.
Practice exam 2
60 questions
Open this course’s practice exams →Practice exam 3
60 questions
Open this course’s practice exams →Practice exam 4
60 questions
Open this course’s practice exams →Practice exam 5
60 questions
Open this course’s practice exams →Practice exam 6
60 questions
Open this course’s practice exams →Flashcards
What makes an asset business-critical?
Business resilience and ransomware
Its compromise would materially damage the organization through loss of revenue, mission, safety, operations, reputation, or sensitive information. Technical size and replacement cost alone do not establish criticality.
Why can a privileged identity be as critical as the application it administers?
Business resilience and ransomware
The identity can control the high-value application, its permissions, configuration, or recovery. Protect privileged access at the same level or above the assets it can influence.
What should a critical-asset dependency map include?
Business resilience and ransomware
Include identity services, DNS, networks, keys, certificates, data stores, deployment systems, suppliers, people, and recovery documentation. A dependency can prevent a business service from operating even when its primary compute is healthy.
How does an integrity failure differ from an availability failure?
Business resilience and ransomware
Integrity failure is unauthorized or incorrect modification, such as changed payment instructions. Availability failure prevents timely authorized use. A system can remain online while an integrity attack causes severe business loss.
What is the purpose of a business impact analysis?
Business resilience and ransomware
Identify the consequences of disrupting each business process, its dependencies, and acceptable recovery targets. Use business impact to justify priorities and investment rather than treating all systems equally.
Recovery targets require business agreement.
What distinguishes a threat from a vulnerability?
Business resilience and ransomware
A threat is a potential cause of harm, such as a credential-stealing adversary. A vulnerability is a weakness that can be exploited, such as excessive service-account permissions. Risk considers the resulting likelihood and business impact.
Why should vulnerability severity be combined with exposure and asset criticality?
Business resilience and ransomware
Severity describes a weakness, while exposure, exploitability, attack paths, existing controls, and asset value determine practical risk. An exposed path to a critical identity system can outweigh an isolated higher-severity issue.
Who should accept residual cybersecurity risk?
Business resilience and ransomware
An accountable business risk owner, informed by security expertise, should accept it explicitly within organizational authority. Record the rationale, scope, compensating controls, review conditions, and time limit.
Acceptance is a governance decision, not an unattended technical exception.
Why does buying cyber insurance not replace resilience controls?
Business resilience and ransomware
Insurance can transfer some financial consequences. It does not restore systems, prevent exfiltration, recover keys, or remove an attacker. Maintain technical prevention, containment, and tested recovery.
What evidence shows a critical-asset protection program is working?
Business resilience and ransomware
Demonstrate that high-value assets and their administrative paths are identified, access is constrained, relevant attacks are detected, and recovery tests meet agreed business targets. A purchased license or high aggregate score alone is insufficient.
What does recovery point objective measure?
Business resilience and ransomware
RPO measures the maximum acceptable data loss expressed as time. Compare it with the age of the latest usable recovery point at the incident time, including application consistency and recoverability.
What does recovery time objective measure?
Business resilience and ransomware
RTO is the maximum acceptable time to restore business operations after disruption. Include detection and recovery decisions as defined by the plan, infrastructure restoration, dependencies, application validation, and usable service.
How does business continuity extend beyond disaster recovery?
Business resilience and ransomware
Business continuity preserves essential processes, including people, communications, suppliers, and alternate procedures. Disaster recovery restores the technology supporting those processes.
Why is replication insufficient for recovery from destructive data changes?
Business resilience and ransomware
Replication can reproduce corruption or encryption in the secondary environment. Keep protected historical recovery points and a validated process for restoring a known-good state.
What distinguishes high availability from historical backup?
Business resilience and ransomware
High availability keeps a service running through component failures. Historical backup enables restoration to an earlier state after deletion or corruption. One does not automatically provide the other.
Why should recovery tests include application transactions?
Business resilience and ransomware
A successful disk or database restore can still leave identity, configuration, keys, or dependencies broken. Validated business transactions demonstrate that the recovered service actually works.
What is the recovery tradeoff between cold and warm standby?
Business resilience and ransomware
Cold standby minimizes running infrastructure but requires more deployment during recovery. Warm standby maintains some ready capacity and can reduce restoration time at additional operating cost.
What should be verified before choosing cross-region recovery?
Business resilience and ransomware
Verify supported recovery mechanisms, regional capacity, identity and network dependencies, data residency, backup availability, and restoration time. A second region alone does not prove a usable recovery path.
Why must encryption keys be included in recovery planning?
Business resilience and ransomware
Encrypted recovery data can be unusable if keys, key permissions, or required historical versions are unavailable. Protect the key lifecycle and test retrieval during recovery.
How should a hybrid or multicloud recovery strategy be unified?
Business resilience and ransomware
Set common business targets, security requirements, ownership, monitoring, and test expectations while using supported platform-specific backup and recovery mechanisms. Do not assume one Azure feature protects every service in every cloud.
What is the first priority in Microsoft urgent ransomware guidance?
Business resilience and ransomware
Prepare recovery so the organization can survive an attack: protect backups and essential dependencies and test restoration. The guidance uses assume breach to minimize business impact.
What is the second priority in urgent ransomware guidance?
Business resilience and ransomware
Limit the scope of damage by securing privileged access. Protect identities, workstations, and management systems that can control multiple critical assets.
What is the third priority in urgent ransomware guidance?
Business resilience and ransomware
Make initial access harder through controls such as secure remote access, phishing defenses, modern authentication, endpoint protection, and patching. These tasks must not delay recovery and privileged-access priorities.
Does the ransomware priority order prohibit parallel work?
Business resilience and ransomware
No. Separate teams can work in parallel and complete quick improvements earlier. The order expresses business-risk urgency, rather than a strict technical dependency chain.
Why do recoverable backups not eliminate data-extortion risk?
Business resilience and ransomware
Attackers can steal sensitive data before encrypting systems and threaten disclosure. Recovery addresses restoration; access controls, data protection, monitoring, and exfiltration controls address disclosure risk.
What does an immutable backup vault prevent?
Business resilience and ransomware
It blocks operations that could cause recovery-point loss before allowed retention ends. Locking immutability makes the setting irreversible, so validate retention and operational needs before locking.
What is the difference between enabled and locked vault immutability?
Business resilience and ransomware
Enabled immutability can still be disabled. Locked immutability cannot be reversed. The decision to lock therefore requires careful validation of the supported workload and required retention.
What does Resource Guard add to Azure Backup?
Business resilience and ransomware
It provides an additional authorization boundary for configured critical vault operations. The normal vault administrator should not already possess Resource Guard permissions that satisfy those checks.
Why is an isolated clean-restore environment useful after ransomware?
Business resilience and ransomware
It lets responders validate recovered data, credentials, configurations, and business functions before reconnecting the service. Restoring directly into a still-compromised environment can reinfect the recovered workload.
What is the scope limit of Resource Guard protection?
Business resilience and ransomware
MUA protects listed, configured operations on vaulted backups. It does not govern every operation directly on the original data source or automatically make ordinary production permissions safe.
What environments does Azure Update Manager help manage?
Business resilience and ransomware
It assesses and manages updates for supported Windows and Linux servers in Azure and for supported on-premises or other-cloud servers connected through Azure Arc.
Does Azure Update Manager require an Azure Automation account or Log Analytics workspace?
Business resilience and ransomware
No. The current service uses native Azure VM and Arc capabilities and Azure Resource Manager operations; it does not depend on the retired Automation-based Update Management architecture.
Why are update assessment and installation separate checks?
Business resilience and ransomware
Assessment identifies available or missing updates. Installation attempts the selected updates, and post-installation verification establishes actual compliance and workload health. Finding an update does not prove it was installed.
What does an update maintenance window control?
Business resilience and ransomware
It defines the allowed time for scheduled patching. Design it around application dependencies, safe restart behavior, recovery capacity, and the time needed to validate the workload.
Why should security updates use progressive rollout?
Business resilience and ransomware
A small initial population reveals failures before wider exposure. Expand only after health and security checks pass, and halt or recover when failures appear.
What should an emergency patch process retain?
Business resilience and ransomware
Keep explicit authority, targeted validation, monitoring, and a recovery plan while shortening the normal rollout when active exploitation justifies urgency. Emergency status does not remove deployment risk.
Why should patch priority consider exploitability and business impact?
Business resilience and ransomware
A reachable actively exploited weakness on a critical path can deserve faster treatment than an isolated issue. Use vulnerability severity alongside exposure, dependencies, available mitigations, and operational risk.
What is a safe interim treatment for a system that cannot yet be patched?
Business resilience and ransomware
Record a time-bound exception, reduce exposure, restrict access, segment the workload, monitor relevant threats, and plan an approved update or replacement. Compensating controls reduce risk without repairing the vulnerable code.
Why are patch-management permissions security-sensitive?
Business resilience and ransomware
A patching or deployment identity can execute changes across many machines. Scope its authority to necessary resources, protect its credentials, and audit changes to avoid turning management infrastructure into an attack path.
What should be checked after a scheduled patch deployment?
Business resilience and ransomware
Confirm installation results, required reboots, remaining vulnerabilities, and application health. Investigate failed or skipped machines rather than treating the presence of a schedule as evidence of compliance.
What is the main architectural purpose of MCRA?
MCRA MCSB and Zero Trust
MCRA describes end-to-end cybersecurity capabilities and integration across hybrid, multicloud, legacy IT, IoT, OT, and AI. Use it to define and compare an enterprise security target state.
When is MCSB the most appropriate reference?
MCRA MCSB and Zero Trust
Use MCSB when selecting prescriptive cloud security controls, service baselines, and posture requirements. It provides guidance across Azure and multicloud environments rather than a single application quality review.
How does CAF differ from MCRA?
MCRA MCSB and Zero Trust
CAF organizes cloud adoption, operating models, governance, and the platform foundation. MCRA maps cybersecurity capabilities and integrations across the broader enterprise estate.
How does the Well-Architected Framework differ from MCRA?
MCRA MCSB and Zero Trust
Well-Architected evaluates an individual workload across reliability, security, cost, operations, and performance. MCRA helps plan integrated security capabilities across the enterprise.
What should a comparison against MCRA identify?
MCRA MCSB and Zero Trust
Identify capability gaps, overlapping tools, missing integrations, and controls that exist but are not effectively implemented. Owning a depicted product does not prove the corresponding security outcome.
Why must a reference architecture be adapted before implementation?
MCRA MCSB and Zero Trust
Business requirements, existing systems, risks, responsibilities, and supported technology differ between organizations. A reference supplies a starting target architecture, not a universal configuration script.
What are the current major additions in MCSB v2?
MCRA MCSB and Zero Trust
The preview introduces an AI Security domain with seven recommendations, expanded Azure Policy mappings, and detailed risk- and threat-based implementation guidance. Verify preview status and service support when applying it.
Why is an MCSB control mapping not a compliance attestation?
MCRA MCSB and Zero Trust
A mapping helps organize relevant control guidance and assessment evidence. Compliance also depends on correct implementation, scope, operating processes, validation, and applicable legal or contractual requirements.
How should a required security capability be selected?
MCRA MCSB and Zero Trust
Start with the required outcome and threat, map the control to supported technology, assign an owner, and test the result. Selecting products first can leave gaps between controls and operational responsibilities.
Why is integration part of security architecture rather than a cosmetic diagram?
MCRA MCSB and Zero Trust
Signals, identity decisions, data protection, response authority, and recovery must work together. A disconnected deployment can collect evidence without enforcing the control or response needed to stop an attack.
Why do insider threats require more than an internet perimeter?
MCRA MCSB and Zero Trust
An insider may already have valid credentials and legitimate network access. Constrain privileges, protect sensitive data, audit activity, and govern investigations rather than relying only on external traffic filtering.
What kinds of insider activity does Purview Insider Risk Management address?
MCRA MCSB and Zero Trust
It correlates signals for potential malicious and inadvertent insider risks, including data leakage, intellectual-property theft, and security violations. A risk signal requires investigation rather than automatically proving intent.
Which privacy safeguards are built into Insider Risk Management?
MCRA MCSB and Zero Trust
Users are pseudonymized by default, and role-based access controls and audit logs help protect privacy. Govern who can investigate and reveal identities within an approved process.
What distinguishes phishing prevention from ransomware recovery?
MCRA MCSB and Zero Trust
Anti-phishing controls address deceptive entry messages. They do not decrypt data or restore services after encryption; a separate incident response and recovery capability remains necessary.
Why should external identity attacks be met with several control layers?
MCRA MCSB and Zero Trust
A stolen credential or session can bypass a single preventive layer. Combine strong authentication, contextual access, least privilege, data authorization, monitoring, and response to reduce the resulting impact.
What makes a development pipeline part of the software supply-chain attack surface?
MCRA MCSB and Zero Trust
Repositories, dependencies, build runners, artifact stores, and deployment credentials can influence code delivered to production. Compromise before deployment can bypass protections focused only on running applications.
What does verifying a software artifact signature establish?
MCRA MCSB and Zero Trust
It can establish integrity and provenance relative to a trusted signer and verification process. It does not prove that the signed code has no vulnerabilities or that the signer has never been compromised.
Why should build and deployment privileges be separated?
MCRA MCSB and Zero Trust
Untrusted build inputs should not automatically gain production deployment authority. Scope identities to their stage, protect release approvals, and isolate execution contexts to limit supply-chain compromise.
What does defense in depth add when an authorized account is compromised?
MCRA MCSB and Zero Trust
Separate resource authorization, segmentation, scoped privileges, monitoring, and containment can still restrict the attacker. Successful authentication should not grant unrestricted access to all resources.
Why should threat coverage be connected to business-critical attack paths?
MCRA MCSB and Zero Trust
Controls should prevent, detect, or contain the ways an adversary can affect valuable assets. A long tool inventory can still miss a path through privileged identities, suppliers, or data access.
What is the purpose of MCSB AI-1 approved-model guidance?
MCRA MCSB and Zero Trust
Deploy models that have passed a trusted review and approval process. Maintain model provenance, validation results, authorized deployment paths, and approval history to reduce supply-chain risk.
What does MCSB AI-2 layered filtering address?
MCRA MCSB and Zero Trust
Validate prompts, external content, processing, and outputs through appropriate layers. A single prompt filter does not cover every route for harmful content, data leakage, or adversarial manipulation.
What is the role of MCSB AI-3 safety meta-prompts?
MCRA MCSB and Zero Trust
System instructions guide intended behavior and add a defensive layer against misuse. They do not replace independently enforced permissions, input validation, or authorization on tools and data.
What does MCSB AI-4 recommend for agent functions?
MCRA MCSB and Zero Trust
Give tools or plugins only the capabilities, resources, and permissions needed for their approved tasks. Enforce these restrictions in the application or downstream system, not only in natural-language instructions.
What is the purpose of MCSB AI-5 human-in-the-loop?
MCRA MCSB and Zero Trust
Require accountable human review or approval for critical decisions and actions, especially when they affect sensitive data or external systems. Place the approval checkpoint before the consequential action.
What should MCSB AI-6 monitoring make possible?
MCRA MCSB and Zero Trust
Detect suspicious AI activity and risky data access, investigate misuse and jailbreak attempts, and support containment. Protect monitoring data because prompts, responses, and logs can themselves contain sensitive information.
What does MCSB AI-7 continuous red teaming test?
MCRA MCSB and Zero Trust
Use adversarial exercises to discover harmful outcomes, prompt injection, model or data manipulation, and unsafe tool paths. Reassess after relevant model, prompt, data, or capability changes.
Why does AI security still need ordinary platform controls?
MCRA MCSB and Zero Trust
AI models, data, tools, identities, networks, and hosts remain valuable IT assets. Apply identity, network, encryption, logging, and recovery controls alongside AI-specific safeguards.
Why can a grounding document be a security threat?
MCRA MCSB and Zero Trust
External content can contain indirect prompt injection that attempts to override intended behavior. Treat retrieved content as untrusted data and independently authorize retrieval and tool actions.
What qualification applies to MCSB v2 AI recommendations?
MCRA MCSB and Zero Trust
MCSB v2 is preview guidance and is not a certification or compliance attestation. Check the current status and supported implementation of each control; not every recommendation is a universally available automated feature.
What are the three Zero Trust principles?
MCRA MCSB and Zero Trust
Verify explicitly, use least privilege, and assume breach. Apply them to access, security controls, detection, response, and recovery across the environment.
What does verify explicitly require?
MCRA MCSB and Zero Trust
Authenticate and authorize requests using available context such as identity, device, location, behavior, and risk. Internal network origin is not sufficient evidence of trust.
What are the scope and duration dimensions of least privilege?
MCRA MCSB and Zero Trust
Give identities only the actions and resources needed, for the required time. Avoid unnecessary standing privileges and continually govern whether access remains justified.
What does assume breach change in architecture?
MCRA MCSB and Zero Trust
Design for an attacker who gets inside: segment access, limit administrative influence, collect useful telemetry, support containment, and preserve recoverability instead of relying on prevention alone.
Which six common technology areas need Zero Trust coverage?
MCRA MCSB and Zero Trust
Identity, endpoints, applications, data, infrastructure, and networks. Controls across one area do not automatically establish protection across the others.
Why does Zero Trust adoption require executive sponsorship?
MCRA MCSB and Zero Trust
It changes operating processes, responsibilities, user access, investment, and priorities across the organization. Business leaders must align the change with measurable outcomes and support adoption.
How should a Zero Trust roadmap be prioritized?
MCRA MCSB and Zero Trust
Identify business scenarios and current maturity, select achievable high-impact initiatives, assign owners, implement in phases, and measure results. Do not use a product list as the entire adoption plan.
What is a useful Zero Trust adoption metric?
MCRA MCSB and Zero Trust
Measure outcomes such as protected privileged access, reduced critical attack paths, effective access enforcement, healthy detection coverage, and tested recovery. License counts and policy counts alone do not prove effectiveness.
Why is a compliant endpoint not unlimited authorization?
MCRA MCSB and Zero Trust
Device posture is one access signal. The identity still needs appropriate resource and action permissions, and application or data controls must enforce the requested scope.
Why must session reevaluation be validated for the chosen applications?
MCRA MCSB and Zero Trust
Continuous verification is the architectural goal, but actual enforcement depends on supported clients, resources, protocols, and policies. Test revocation and changed-risk behavior rather than assuming all sessions react identically.
Verify actual application behavior and service support.
What should precede selecting an AI model for organizational adoption?
CAF Well Architected and secure adoption
Define the approved business use case, data classification, potential impact, and accountable owners. These determine model, platform, access, evaluation, and governance requirements.
Why should an AI knowledge assistant and an autonomous payment agent have different controls?
CAF Well Architected and secure adoption
The agent can change business state and creates additional tool and transaction risks. Its approved autonomy, permissions, human oversight, and recovery mechanisms must match that impact.
How should organizational AI model approval be governed?
CAF Well Architected and secure adoption
Evaluate the model provider, model provenance, security requirements, and intended use before approval. Apply additional scrutiny to external or community models and reassess material changes.
What identity pattern reduces stored credentials when AI services support it?
CAF Well Architected and secure adoption
Use Microsoft Entra identity-based authentication and governed identities for agents and downstream calls. Grant only required permissions; protect and rotate keys where keys remain necessary.
How should a retrieval application prevent access to data outside its approved scope?
CAF Well Architected and secure adoption
Enforce data boundaries through identity and data-access controls at retrieval and downstream services. Prompts cannot independently authorize access to a document or database.
Why does private connectivity not complete AI security?
CAF Well Architected and secure adoption
It limits supported network paths but does not decide whether a user or agent may read data or execute tools. Identity, authorization, model safeguards, and monitoring are also required.
How does Prompt Shields support secure AI adoption?
CAF Well Architected and secure adoption
It detects prompt-injection attempts in user inputs and external content. Configure supported guardrails and combine them with independent data and tool authorization.
What are the six Microsoft responsible AI principles?
CAF Well Architected and secure adoption
Fairness; reliability and safety; privacy and security; inclusiveness; transparency; and accountability. Evaluate them against the use case rather than treating security alone as complete responsible AI.
When should an AI adoption risk assessment be repeated?
CAF Well Architected and secure adoption
Reassess when the model, data sources, connectors, prompts, permissions, or allowed autonomy change, and when monitoring reveals new risks. Approval is tied to the evaluated system and use case.
What evidence should an AI pilot produce before broad adoption?
CAF Well Architected and secure adoption
Evidence that authorized retrieval, tool restrictions, prompt-injection protections, output evaluation, monitoring, and consequential-action oversight work for the intended use case. Record unresolved risks and accountable decisions.
Which seven phases organize the current Cloud Adoption Framework?
CAF Well Architected and secure adoption
Strategy, Plan, Ready, Adopt, Govern, Secure, and Manage. Governance, security, and management continue during operation rather than ending when migration finishes.
What decision does the CAF Strategy phase address?
CAF Well Architected and secure adoption
Define what Azure adoption should look like and align investments with business outcomes. This establishes direction for the operating model, platform, and subsequent adoption decisions.
What decision does the CAF Plan phase address?
CAF Well Architected and secure adoption
Determine how the organization will prepare for Azure adoption, including the people, work, and readiness needed to execute the strategy.
What is the main outcome of the CAF Ready phase?
CAF Well Architected and secure adoption
An Azure landing zone designed around organizational requirements. It provides the foundation and guardrails in which workload teams can deploy and operate.
How do CAF and Well-Architected assessments complement each other?
CAF Well Architected and secure adoption
CAF guides organizational adoption, operating standards, and the platform foundation. Well-Architected assesses individual workloads against five quality pillars. Use both to connect enterprise guardrails with workload decisions.
What are the five Azure Well-Architected pillars?
CAF Well Architected and secure adoption
Reliability, Security, Cost Optimization, Operational Excellence, and Performance Efficiency. An assessment should examine tradeoffs across them rather than optimizing one in isolation.
What evidence should a security and governance strategy assessment examine?
CAF Well Architected and secure adoption
Compare business requirements and threats with assigned responsibilities, implemented controls, operating evidence, exceptions, and remediation ownership. A written strategy alone does not prove effective enforcement.
Why should a governance strategy assign both platform and workload responsibilities?
CAF Well Architected and secure adoption
Central teams supply shared standards and capabilities, while workload teams secure and operate their resources within those guardrails. Gaps arise when each assumes the other owns a control.
How should a workload security recommendation account for other quality pillars?
CAF Well Architected and secure adoption
Identify the security benefit and its effect on reliability, cost, performance, and operations. Choose a documented tradeoff that satisfies the required business and security outcomes.
Why is cloud security strategy continuously evaluated?
CAF Well Architected and secure adoption
Workloads, threats, organizational obligations, and technologies change. Ongoing governance, security, and management validate whether the foundation and workload controls still meet requirements.
Which feedback loop should a CAF-aligned governance design include after a security incident?
CAF Well Architected and secure adoption
Feed lessons from security operations into improvements to security standards, controls, and governance processes, using business goals and risk to guide the changes.
When is an Azure Policy initiative useful?
CAF Well Architected and secure adoption
An initiative groups related policy definitions into a single assignment, supporting consistent deployment and assessment of a set of governance requirements.
What is the difference between Azure Policy audit and deny effects?
CAF Well Architected and secure adoption
Audit records noncompliance without blocking the operation. Deny blocks matching noncompliant resource requests when the policy applies. Audit results alone do not demonstrate preventive enforcement.
Why does assigning a deployIfNotExists policy not guarantee immediate remediation of existing resources?
CAF Well Architected and secure adoption
The effect can deploy related configuration under its conditions, but existing resources generally require a remediation task. Configure the assignment identity and required permissions and verify remediation results.
How should policy scope support enterprise governance?
CAF Well Architected and secure adoption
Assign common requirements at suitable management-group or subscription scopes so applicable descendants inherit them. Tailor narrower assignments and governed exemptions to justified workload needs.
How should a legitimate policy exception be governed?
CAF Well Architected and secure adoption
Document scope, justification, risk owner, compensating controls, and expiry or review. Use an appropriate scoped exemption and review it instead of weakening the baseline for every workload.
Why must security policy changes be staged before broad enforcement?
CAF Well Architected and secure adoption
A deny rule or remediation can affect deployments and existing dependencies. Test representative resources, assess impact, and use an approved rollout and recovery process.
Which capability helps identify and prioritize cloud security posture gaps?
CAF Well Architected and secure adoption
Microsoft Defender for Cloud supplies security posture recommendations and assessment. Use them with business risk and control ownership rather than treating a score as complete assurance.
What is the purpose of a workload security baseline within CAF governance?
CAF Well Architected and secure adoption
Translate organizational requirements into repeatable workload controls and implementation guidance. Pair the baseline with deployment automation, ownership, monitoring, and a governed exception process.
Why should governance recommendations specify validation evidence?
CAF Well Architected and secure adoption
A control must be shown to work. Define the configuration assessment, access test, collected logs, remediation evidence, or operational exercise that demonstrates the expected result.
What are the two components of an Azure landing zone?
CAF Well Architected and secure adoption
The platform landing zone provides the centralized foundation, governance, security, and shared resources. Workload landing zones host workload-owned resources within platform guardrails.
How does a workload landing zone organize development, test, and production?
CAF Well Architected and secure adoption
A workload has a workload landing zone containing its required environments. Each environment uses one or more subscriptions according to workload requirements, ownership boundaries, and platform limits.
What is the security purpose of a landing-zone management-group hierarchy?
CAF Well Architected and secure adoption
It organizes subscriptions and applies inherited governance standards consistently. Separate platform and workload resources while avoiding unnecessary hierarchy complexity.
Which shared capabilities may a platform landing zone centralize?
CAF Well Architected and secure adoption
Connectivity and networking, security monitoring, identity services, and management services. Centralize capabilities when they provide clear governance, operational, or economic benefits.
What is subscription vending?
CAF Well Architected and secure adoption
A repeatable process for requesting, creating, and distributing governed workload subscriptions. Automation applies organizational security and governance baselines consistently as demand grows.
Why should workload permissions be scoped separately from platform administration?
CAF Well Architected and secure adoption
Workload teams need authority over their own resources without unrestricted control over shared security, connectivity, or governance. Narrow scope limits the effect of compromised workload credentials.
What does a landing-zone accelerator provide?
CAF Well Architected and secure adoption
Microsoft-provided infrastructure-as-code deployment patterns that implement recommended platform or workload architectures. Adapt and validate them against organizational requirements rather than treating deployment as complete assurance.
How do landing zones support adoption of AI workloads?
CAF Well Architected and secure adoption
Deploy AI resources within workload landing zones and update central governance and security standards for new requirements. AI data, model, and agent controls extend the foundation rather than removing its guardrails.
Why does hub-and-spoke connectivity still require explicit traffic inspection design?
CAF Well Architected and secure adoption
Peering or central placement of a firewall does not by itself prove that all required paths traverse inspection. Validate routing, DNS, segmentation, and allowed access for the selected architecture.
What should security onboarding verify when a workload subscription is vended?
CAF Well Architected and secure adoption
Check inherited policy and appropriate RBAC, approved connectivity, security monitoring, relevant Defender coverage, ownership, and required operational controls. Verify outcomes rather than only subscription creation.
What does DevSecOps change about security responsibility?
CAF Well Architected and secure adoption
Security is integrated into design, development, build, release, and operations, with development ownership supported by security expertise and reusable platform standards.
Why should threat modeling happen before implementation?
CAF Well Architected and secure adoption
It identifies assets, trust boundaries, threats, and required mitigations while design changes are easier. Update the model when interfaces, data flows, or privileges materially change.
How do SAST, SCA, and DAST differ?
CAF Well Architected and secure adoption
SAST inspects code, SCA assesses components and dependencies, and DAST exercises a running application. Their findings complement one another rather than proving the same security property.
What does secret scanning detect in a delivery process?
CAF Well Architected and secure adoption
Potential exposed credentials or secrets in supported code and workflow locations. Detection must trigger revocation or rotation and remediation; deleting visible text alone does not invalidate a leaked credential.
How should deployment automation avoid persistent high-privilege secrets?
CAF Well Architected and secure adoption
Prefer supported scoped workload identity federation or managed identity, restrict the workflow or environment that may obtain access, and grant only the deployment permissions required.
Why must source-control and branch protections be part of cloud security?
CAF Well Architected and secure adoption
An attacker who changes code or release workflows can compromise the deployed system. Peer review, controlled merges, protected identities, and security checks protect the path to production.
Why maintain a software bill of materials in DevSecOps?
CAF Well Architected and secure adoption
An SBOM identifies the components and dependencies used in development, build, integration, and deployment. Use it to track affected software and prioritize remediation when a dependency vulnerability is disclosed.
How should production and test pipeline privileges be separated?
CAF Well Architected and secure adoption
Use separate environments and scoped identities or connections; prevent test workflows from obtaining production authority. Apply independent approval where production impact warrants it.
What makes a security release gate effective?
CAF Well Architected and secure adoption
Risk-based criteria, actionable findings, clear owners, and a governed exception process. A routinely bypassed or untriaged gate does not deliver its intended control.
Why does DevSecOps continue after deployment?
CAF Well Architected and secure adoption
Runtime monitoring, vulnerability response, incident handling, recovery, and lessons from production feed back into the backlog and secure design. Pre-release tests cannot detect every future weakness.
What does XDR correlate?
Security operations detection and response
Related security signals across endpoints, identities, email, and applications into incidents that describe attacks.
When does a SOC add SIEM to XDR?
Security operations detection and response
When it needs third-party or multicloud logs, custom detection, and enterprise-wide investigation beyond the XDR product domains.
What investigation context does a Defender XDR incident carry into Sentinel?
Security operations detection and response
Its associated alerts, entities, and relevant context for triage and investigation.
Which incident fields support bidirectional Sentinel–Defender XDR synchronization?
Security operations detection and response
Status, owner, and closing reason synchronize between the paired incidents.
Why disable overlapping Microsoft incident-creation rules during XDR integration?
Security operations detection and response
They can create duplicate incidents for alerts already correlated by Defender XDR.
Why should incident-title-based automation be reviewed after XDR integration?
Security operations detection and response
The Defender XDR correlation engine chooses incident titles; stable tags or other suitable conditions are safer.
Does a Defender advanced hunting table appearing in Sentinel prove its data is ingested?
Security operations detection and response
No. Some tables, including TVM tables, appear in the schema without their data being ingested.
What is the role of raw advanced hunting event ingestion?
Security operations detection and response
It supplies selected event-level data for Sentinel queries; incident integration alone does not prove all raw tables are available.
How can Defender for Cloud incidents arrive without their alert details?
Security operations detection and response
Incident integration is enabled but the required Defender for Cloud alert/entity connector is missing.
What does unified security operations bring together?
Security operations detection and response
Sentinel enterprise and third-party data with Defender incidents and security signals in the Defender portal.
What does Microsoft Purview Audit record?
Security operations detection and response
Audited user and administrator operations across supported Microsoft services for forensic and compliance investigation.
What is the current default Audit Standard retention for newly generated records?
Security operations detection and response
180 days; the older 90-day default applies to records generated before 17 October 2023.
Which Audit Premium workloads receive one-year default retention?
Security operations detection and response
Microsoft Entra ID, Exchange, OneDrive, and SharePoint audit records for appropriately licensed users.
What extra requirement supports ten-year retention of user audit records?
Security operations detection and response
The per-user ten-year retention add-on plus an appropriate retention policy; the policy is not retroactive.
How are non-user-entity audit records retained under the documented rule?
Security operations detection and response
A fixed one year; custom audit retention policies do not apply to those non-user records.
Which properties can scope custom audit retention policies?
Security operations detection and response
The service, audited activities, and users generating the records.
Why is Audit Premium not equivalent to one-year retention for every activity?
Security operations detection and response
Other activities retain their default period unless an applicable custom policy extends retention.
How can organizations retrieve audit records for a SIEM?
Security operations detection and response
Use supported access such as the Office 365 Management Activity API, with planned permissions and collection.
What investigative advantage do Audit Premium intelligent insights provide?
Security operations detection and response
Higher-value activity details, including mail access and searches, that can help establish compromise scope.
Why must audit-search access be delegated separately from ordinary content access?
Security operations detection and response
Audit records are sensitive evidence; only investigators with necessary audit permissions should search them.
How can Azure Monitor collect guest telemetry from non-Azure VMs?
Security operations detection and response
Use Azure Arc-enabled servers with Azure Monitor Agent and appropriate data collection rules.
What defines the guest events Azure Monitor Agent collects?
Security operations detection and response
Data collection rules specify the intended telemetry and destinations.
Which logs establish AWS and GCP administrative activity?
Security operations detection and response
AWS CloudTrail and GCP Cloud Audit Logs, ingested through suitable Sentinel connectors.
Does installing an agent on an EC2 instance collect all AWS account audit events?
Security operations detection and response
No. Guest telemetry and cloud-provider control-plane audit logs require different collection paths.
What service combines Azure, AWS, and GCP audit logs for security analysis?
Security operations detection and response
Microsoft Sentinel can consolidate them in a Log Analytics workspace through suitable connectors.
Which Azure Monitor capability instruments applications running on any host?
Security operations detection and response
Application Insights with the appropriate SDKs.
How can custom REST-source logs enter Log Analytics?
Security operations detection and response
Use the Azure Monitor Logs Ingestion API with the appropriate collection configuration.
Which monitoring technologies support EKS or GKE telemetry?
Security operations detection and response
Appropriate Container insights or managed Prometheus collection, including Arc or remote-write paths.
Why distinguish monitoring from patching for Arc servers?
Security operations detection and response
Azure Update Manager assesses and installs updates independently of Azure Monitor log collection.
What should a multicloud telemetry inventory distinguish?
Security operations detection and response
Guest OS, applications, cloud control plane, containers, and custom sources, with an explicit collection path for each.
What are Sentinel automation rules for?
Security operations detection and response
Centrally coordinate incident handling and trigger playbooks based on supported events and conditions.
Which events can trigger Sentinel automation rules?
Security operations detection and response
Incident creation, incident update, or alert creation, subject to configured conditions.
Which simple incident actions can automation rules perform directly?
Security operations detection and response
Assign owners, change status, add tags or tasks, and close incidents with reasons.
What executes complex cross-service Sentinel response workflows?
Security operations detection and response
Playbooks built on Azure Logic Apps.
How does a playbook differ from an analytics rule?
Security operations detection and response
An analytics rule detects threats; a playbook executes a response workflow.
Why evaluate playbook permissions separately from investigator permissions?
Security operations detection and response
The workflow identity needs narrowly scoped rights for its connector actions.
Why include approval before high-impact containment?
Security operations detection and response
It reduces unintended business disruption when automatic action could disable a critical service.
What does automation-rule ordering control?
Security operations detection and response
The order in which configured rules and actions execute for a matching event.
Why protect against repeated incident-update execution?
Security operations detection and response
A workflow can change an incident that triggers further updates; conditions must prevent unintended repeated action.
What response evidence should a playbook retain?
Security operations detection and response
Actions attempted, results, failures, and relevant approval context for investigation and recovery.
What starts a proactive threat hunt?
Security operations detection and response
A testable hypothesis about an undetected threat or malicious behavior.
How does hunting differ from waiting for alerts?
Security operations detection and response
It searches available evidence proactively, including behavior that existing detections may miss.
What can a Sentinel-specific hunting bookmark preserve?
Security operations detection and response
Selected query results, the query, annotations, and relevant entity context.
How should a finding that warrants formal investigation be escalated?
Security operations detection and response
Create or enrich an incident with relevant hunting evidence.
What marks the completion of a hypothesis investigation?
Security operations detection and response
Record whether the evidence validates or invalidates the hypothesis and document the reasoning.
Which outputs can improve defenses after a hunt?
Security operations detection and response
New analytics rules, threat indicators, and incidents based on validated findings.
What does the hunt status represent?
Security operations detection and response
The operational state of the hunt; it is distinct from whether its hypothesis was validated.
Why avoid alerting on every uncommon process?
Security operations detection and response
An uncommon process can be legitimate; investigate context before creating a high-noise detector.
Which hunt metrics measure tangible outcomes?
Security operations detection and response
Validated hypotheses, incidents created, and new analytics rules.
Are Sentinel bookmarks available in unified Advanced hunting?
Security operations detection and response
No. They remain in the Sentinel-specific hunting experience; use appropriate alternatives in Advanced hunting.
What does an ATT&CK tactic describe?
Security operations detection and response
An adversary’s objective; a technique describes how that objective is pursued.
What does Sentinel’s MITRE map visualize?
Security operations detection and response
ATT&CK technique coverage from active analytics and relevant available detection content.
The current Microsoft Learn page marks Sentinel MITRE ATT&CK coverage as preview. Verify current availability; coverage mappings are not proof that every relevant technique is detected in the deployed environment.
What does an active-rule mapping fail to prove by itself?
Security operations detection and response
That required telemetry arrives and the rule detects the relevant behavior reliably.
Why compare active coverage with available templates?
Security operations detection and response
It identifies relevant content that could fill a detection gap after prerequisites and tuning are assessed.
How should teams validate a high-priority technique’s coverage?
Security operations detection and response
Confirm data dependencies and safely test representative behavior; review detection quality and response.
Which ATT&CK matrix fits industrial control attack behaviors?
Security operations detection and response
ATT&CK for ICS; OT-specific Defender for IoT content includes ICS technique mappings.
What does the Defender for IoT Sentinel solution add beyond alert streaming?
Security operations detection and response
OT analytics rules, workbooks, playbooks, and incident mappings to ICS techniques.
Why should OT containment be coordinated with operations owners?
Security operations detection and response
Response can affect physical processes and availability; OT context must guide safe action.
Why can enterprise coverage not be assumed to cover mobile threats?
Security operations detection and response
Matrices and telemetry differ; validate the techniques and data relevant to the actual mobile environment.
How should ATT&CK gaps be prioritized?
Security operations detection and response
By relevant adversary behavior, asset impact, available telemetry, and feasible detection—not simply the number of colored cells.
Which subject does Conditional Access evaluate for an agent’s on-behalf-of request?
Identity authentication and access
The signed-in user represented in the delegated access token.
Which subject receives an autonomous agent’s app-only resource token?
Identity authentication and access
The agent identity; target agent identities or their blueprint with supported policies.
Which Conditional Access assignment protects an agent’s linked user account?
Identity authentication and access
Agent Users, targeted explicitly; ordinary Users assignments do not apply.
Does targeting an agent blueprint also protect linked agent user accounts?
Identity authentication and access
No. Blueprint targeting covers agent identities, including future ones from that blueprint, rather than linked user accounts.
Why can an OBO agent not reuse the user’s original token for another API?
Identity authentication and access
The original token has a different audience; the agent needs a downstream token for the target resource.
What happens to Entra Conditional Access when an agent uses only an API key?
Identity authentication and access
That request bypasses Entra token issuance, so Entra Conditional Access does not evaluate it.
Can an ordinary all-users Conditional Access policy cover agent user accounts?
Identity authentication and access
No. Even all-users or group-based Users targeting excludes agent user accounts under current documented scope rules.
Can group membership currently scope Agent Users policies?
Identity authentication and access
No. Current documentation does not support including or excluding agent user accounts through group membership.
What is an agent identity blueprint’s role?
Identity authentication and access
Define configuration and governance for creating related agent identities; runtime tasks use the agent identity.
Why does resource authorization remain necessary after agent Conditional Access passes?
Identity authentication and access
The resource validates the token and grants only authorized actions; successful token issuance is not unrestricted tool access.
What do identity, network, and application controls each decide?
Identity authentication and access
Identity establishes the caller and access conditions, network controls reachability, and application authorization permitted actions.
Why is successful SSO insufficient proof of application authorization?
Identity authentication and access
SSO authenticates the user; the application still needs appropriate roles, assignments, or permission checks.
What should a SaaS access design pair with enterprise authentication?
Identity authentication and access
Appropriate application assignment, provisioning/deprovisioning, and application permissions.
Why is a private PaaS endpoint not sufficient access control?
Identity authentication and access
Private reachability does not replace data-plane authentication and authorization.
How should unattended cloud workloads avoid reusable shared passwords?
Identity authentication and access
Use supported managed identities or workload identity federation with minimal resource permissions.
Why distinguish an IaaS management-plane role from guest OS access?
Identity authentication and access
Azure resource-management permissions and guest OS authentication are different planes. However, management actions such as Run Command, VM extensions, and password resets can provide indirect guest control. Assess those effective permissions as privileged access paths.
Microsoft Learn documents VM Contributor software execution, password reset, and local account management through extensions; Windows Run Command scripts run as System. Supporting reference: https://learn.microsoft.com/en-us/azure/virtual-machines/windows/run-command
What must a hybrid application design assess before choosing access controls?
Identity authentication and access
Its supported authentication protocol, resource authorization, client support, and network publication path.
Why does federation not automatically govern third-party cloud permissions?
Identity authentication and access
It authenticates identities; native cloud role mappings and effective permissions still determine allowed actions.
What is the role of Conditional Access in a layered resource design?
Identity authentication and access
Evaluate supported sign-in/token requests using identity, resource, and context signals; it does not replace all resource controls.
How should architects validate cross-layer access?
Identity authentication and access
Test intended and denied user/workload paths, including offboarding, unauthorized permissions, and network bypass attempts.
What live authentication dependency does password hash synchronization reduce?
Identity authentication and access
Cloud sign-in can be validated by Entra ID without contacting on-premises authentication infrastructure.
What does pass-through authentication require for cloud password sign-in?
Identity authentication and access
Available on-premises authentication agents and connectivity to validate the credentials.
What does federation delegate?
Identity authentication and access
Authentication to a trusted external identity system, whose availability and security become part of the sign-in path.
Why synchronize password hashes even when another primary method is chosen?
Identity authentication and access
It can support a planned fallback and cloud identity protection scenarios; fallback must be deliberately designed.
Does password hash synchronization send clear-text passwords to Entra ID?
Identity authentication and access
No. It synchronizes a derived password hash rather than clear-text passwords.
Why secure synchronization and federation servers as critical assets?
Identity authentication and access
They influence hybrid identity trust and can provide powerful paths into cloud and directory access.
What favors federation over simpler cloud authentication?
Identity authentication and access
A documented authentication requirement unavailable in supported managed authentication, evaluated against federation complexity.
Why use more than one PTA agent?
Identity authentication and access
To reduce reliance on a single authentication agent; on-premises dependencies still remain.
What should a hybrid identity recovery test include?
Identity authentication and access
Authentication service loss, synchronization recovery, fallback activation, and emergency cloud administration.
Why distinguish identity synchronization from authentication?
Identity authentication and access
Synchronization creates/updates identity information; authentication validates sign-in through the chosen method.
What does B2B collaboration enable?
Identity authentication and access
External users use their identities to access resources in a resource organization under its access policies.
What do inbound cross-tenant settings govern?
Identity authentication and access
External identities accessing your organization’s resources.
What do outbound cross-tenant settings govern?
Identity authentication and access
Your users accessing other organizations with your organizational identities.
When can a resource tenant trust an external user’s MFA or device claims?
Identity authentication and access
When supported inbound trust settings are explicitly configured; the resource tenant still evaluates its access policy.
Does cross-tenant access trust automatically grant an application assignment?
Identity authentication and access
No. Trust decisions and the resource’s authorization assignments remain separate.
How can partner access lifecycle be bundled?
Identity authentication and access
Use an entitlement management access package with approval, duration, and review.
What are the issuer, holder, and verifier roles in Verified ID?
Identity authentication and access
The issuer signs credentials, the holder presents them, and the verifier checks the evidence.
Does a verified credential automatically assign an Azure role?
Identity authentication and access
No. The relying service decides how verified claims support its authorization policy.
What must a verifier assess beyond a credential’s displayed claim?
Identity authentication and access
Issuer trust and cryptographic validity, plus relevant expiry, status, and presentation requirements.
Why use verifiable credentials in an external identity scenario?
Identity authentication and access
They can prove trusted claims without sharing an institution’s account password.
What is the basic Conditional Access decision model?
Identity authentication and access
If configured assignments and conditions match, enforce the specified grant and session controls.
How do multiple applicable Conditional Access policies interact?
Identity authentication and access
All applicable requirements are evaluated; a weaker grant does not override an applicable block.
What does sign-in risk estimate?
Identity authentication and access
The probability that a particular authentication request is unauthorized.
What does user risk estimate?
Identity authentication and access
The probability that the identity itself is compromised.
What does an authentication strength requirement specify?
Identity authentication and access
The acceptable combinations of authentication methods for access.
Why can a user who completed MFA still fail a strength requirement?
Identity authentication and access
Their method may not be in the required authentication strength, such as phishing-resistant MFA.
What does continuous access evaluation improve?
Identity authentication and access
Supported resources and clients can react to critical identity events without waiting for ordinary token expiry.
Why is CAE not universal instant revocation?
Identity authentication and access
It depends on supported clients/resources and can have propagation delay.
What do protected actions add to Entra administration?
Identity authentication and access
Action-time Conditional Access requirements for selected sensitive permissions using authentication context.
How does protected-action enforcement differ from PIM activation?
Identity authentication and access
PIM temporarily grants a role; protected actions check conditions when selected sensitive operations are attempted.
How does Conditional Access support verify explicitly?
Identity authentication and access
It combines available identity, device, resource, location, and risk signals rather than trusting one perimeter.
Why is a trusted office network insufficient Zero Trust assurance?
Identity authentication and access
A valid internal location does not prove the user or device is uncompromised.
What does report-only mode do?
Identity authentication and access
Evaluates and records policy effects without enforcing access controls.
What should What If analysis be paired with?
Identity authentication and access
Representative actual sign-in tests and log review, including dependencies and exceptional journeys.
What makes a Conditional Access exclusion governable?
Identity authentication and access
A narrow scope, accountable owner, business rationale, expiry, and periodic review.
Why test enrollment and recovery before stronger authentication enforcement?
Identity authentication and access
Users need supported methods and recovery paths to avoid lockout.
Does a policy named All users prove nonhuman identities are covered?
Identity authentication and access
No. Workload, agent identity, and agent user scopes have distinct support and targeting requirements.
How does least privilege complement Conditional Access?
Identity authentication and access
Limit resource assignments, API permissions, and roles; conditional sign-in is not authorization minimization.
How does assume breach influence access-policy validation?
Identity authentication and access
Test detection, session revocation, and containment paths as well as successful sign-in.
Why validate browser, rich-client, mobile, and guest journeys separately?
Identity authentication and access
Supported controls and token/session paths can differ across clients and identity types.
What is the role of Defender for Identity posture assessments?
Identity authentication and access
Identify identity misconfigurations and recommend remediation; they do not automatically make every configuration safe.
Why require LDAP signing on domain controllers?
Identity authentication and access
Unsigned LDAP traffic is susceptible to man-in-the-middle attacks; assess compatibility before enforcement.
What does the sensitive-and-cannot-be-delegated account setting protect?
Identity authentication and access
It prevents delegation of the privileged identity’s credentials; evaluate legitimate delegation dependencies.
Why replace unconstrained delegation where possible?
Identity authentication and access
It permits broad impersonation; constrain or remove delegation according to the legitimate service requirement.
Why review AD CS templates and CA configuration?
Identity authentication and access
Certificate misconfigurations can enable unauthorized identity access or privilege escalation.
Which prerequisite affects certificate-authority posture assessments?
Identity authentication and access
A sensor installed on the AD CS server; template assessments have a different documented availability boundary.
What prerequisite affects hybrid security recommendations for Entra Connect?
Identity authentication and access
A Defender for Identity sensor on servers running Entra Connect services.
Why treat privileged sign-in to ordinary workloads as a hardening concern?
Identity authentication and access
Lower-trust services can expose privileged credentials or abuse delegation into more sensitive systems.
Why audit improper permissions beyond direct Domain Admin membership?
Identity authentication and access
Accounts, groups, and delegated permissions can create indirect privileged access paths.
What should AD hardening validation include after remediation?
Identity authentication and access
Reassess affected entities, test legitimate service behavior, and allow for score/status update delay.
What does Azure Key Vault protect?
Identity authentication and access
Secrets, cryptographic keys, and certificates with their associated private-key material.
Why prefer managed identities or federation over stored application passwords?
Identity authentication and access
They can eliminate reusable application secrets while retaining identity-based least-privileged authorization.
Which Key Vault object type should hold a service-owned certificate that needs managed rotation?
Identity authentication and access
Store it as a Key Vault certificate and configure autorotation for its supported certificate lifecycle, rather than managing it solely as an ordinary secret.
Why separate vault management from data access?
Identity authentication and access
Managing the resource and reading or using its sensitive objects are different privilege boundaries.
What does soft delete provide?
Identity authentication and access
A recoverable period after deletion rather than immediate permanent loss.
What does purge protection add?
Identity authentication and access
It prevents permanent purge during the retention window, protecting against destructive loss.
Why is successful key rotation not proof all consumers adopted the new key?
Identity authentication and access
Consumers may retain caches or version-pinned references; adoption must be verified.
What service provides a dedicated single-tenant managed HSM boundary?
Identity authentication and access
Azure Key Vault Managed HSM for cryptographic keys.
Why must customer-managed-key recovery match workload recovery?
Identity authentication and access
Lost, disabled, or deleted required keys can make dependent data services unavailable.
What secret exposure must logging avoid?
Identity authentication and access
Recording secret values, credentials, or temporary tokens in diagnostic or pipeline logs.
What does the enterprise control plane govern?
Privileged access and governance
Enterprise identity, trust, and access decisions that can control who receives privileges.
What does the enterprise management plane do?
Privileged access and governance
Administer infrastructure and workloads at scale, often through powerful central management systems.
What resides in the data/workload plane?
Privileged access and governance
Business applications, processes, and information that the organization values.
Why protect infrastructure management tools as privileged paths?
Privileged access and governance
Their control of many systems can turn a management-tool compromise into broad workload compromise.
How should an administrative path be classified?
Privileged access and governance
By the highest-impact resources and trust decisions it can control, including indirect authority.
Why does password-reset or credential-creation authority count as privilege?
Privileged access and governance
It can enable control of another identity and therefore its access, even without the same visible role.
What is task-and-scope-based delegation?
Privileged access and governance
Grant the minimum actions at the minimum resource scope needed for the assigned job.
Why separate resource operation from permission administration?
Privileged access and governance
Operating a workload should not automatically allow the operator to grant broader access to others.
Why review inheritance and group-control paths?
Privileged access and governance
Indirect or inherited permissions can undermine an apparently narrow direct assignment.
How should segregation of duties shape privileged delegation?
Privileged access and governance
Avoid letting the same actor independently request, approve, execute, and erase evidence of sensitive work.
What does a PIM eligible assignment permit?
Privileged access and governance
Requesting activation under configured conditions; it does not grant the role’s privileges until activated.
What does a PIM active assignment provide?
Privileged access and governance
The assigned role’s privileges for the configured duration without a separate activation step.
Which activation controls can PIM apply?
Privileged access and governance
Time limits, approval, justification, MFA, notifications, and relevant audit history.
Why review eligible as well as active roles?
Privileged access and governance
Eligibility remains a path to future privileged activation and can become excessive or stale.
What is PIM for Groups used for?
Privileged access and governance
Manage supported group membership or ownership with time-bound or just-in-time access.
What does entitlement management govern?
Privileged access and governance
Access request, assignment, review, and expiry through supported access packages.
What is an access package?
Privileged access and governance
A governed bundle of supported resource access needed for a project or role.
What do access reviews ask?
Privileged access and governance
Whether existing access still has a legitimate business reason.
Why combine PIM with secure devices and strong authentication?
Privileged access and governance
An activated privileged role can still be abused from a compromised session or workstation.
Why does PIM not prove every third-party privilege is governed?
Privileged access and governance
Its supported role/group scope is bounded; native third-party permissions need their own governance design.
What credential material does pass-the-hash reuse?
Privileged access and governance
A stolen NTLM hash to authenticate or move to another system.
What material does pass-the-ticket reuse?
Privileged access and governance
A stolen Kerberos ticket to gain access as its represented identity.
What does Kerberoasting target?
Privileged access and governance
Service-ticket material associated with service accounts for offline password cracking.
What does a DCSync attack abuse?
Privileged access and governance
Directory replication to extract credential data such as password hashes.
Why can AD CS compromise create persistence?
Privileged access and governance
An attacker can issue malicious certificates that support later authentication as unauthorized identities.
Why review dangerous delegated and group permissions?
Privileged access and governance
Indirect access can expose credentials or privileged control even without obvious administrator membership.
What must a forest recovery plan preserve?
Privileged access and governance
Trusted usable backups and required Domain Admin/DSRM recovery credentials under secure procedures.
How many domains must be considered for full forest recovery?
Privileged access and governance
Every domain needs recovery from an available trusted backup; one restored root DC alone is insufficient.
Why is the newest AD backup not always the safest?
Privileged access and governance
It might already contain the compromise or dangerous state; balance recentness with trusted integrity.
Why keep recovery testing isolated from production?
Privileged access and governance
Recovered identity state must be assessed before reintroducing it into trusted operations.
Why inventory every cloud tenant’s administrative entry points?
Privileged access and governance
Federated, native, automation, and recovery paths may each grant powerful control and need protection.
Why separate normal and privileged identities?
Privileged access and governance
Productivity activity should not expose the credentials and sessions used for sensitive administration.
Why protect cloud deployment and automation identities?
Privileged access and governance
Their permissions can control production workloads even when they are not human administrator accounts.
Does Entra sign-in automatically eliminate native SaaS administrator paths?
Privileged access and governance
No. Native accounts and application-specific roles must be inventoried and governed.
What should cloud tenant administration pair with temporary elevation?
Privileged access and governance
Phishing-resistant authentication, a trusted workstation, limited interfaces, and monitoring.
How many Entra emergency accounts does Microsoft recommend?
Privileged access and governance
At least two to reduce lockout and single-account dependency.
Why should Entra emergency accounts be cloud-only?
Privileged access and governance
They avoid dependency on federated or synchronized on-premises identities during an outage.
What PIM assignment type is recommended for emergency Global Administrator access?
Privileged access and governance
Permanent active, so emergency recovery does not depend on an unavailable activation or approval path.
How should emergency accounts interact with restrictive Conditional Access policies?
Privileged access and governance
Exclude them from policies that block or restrict sign-in; keep strong independent authentication and monitoring.
What operational evidence should accompany emergency access?
Privileged access and governance
Alerts on sign-in/audit activity and regular validation that authorized recovery remains usable.
What problem does CIEM address?
Privileged access and governance
Excessive, unused, misconfigured, and risky infrastructure permissions across cloud identities and resources.
Where does current Defender for Cloud provide native CIEM?
Which clouds does native Defender CIEM analyze?
Privileged access and governance
Azure, AWS, and GCP, across supported identity and resource types.
Does retirement of standalone Entra Permissions Management remove Defender CIEM?
Privileged access and governance
No. The documentation explicitly states the deprecation does not affect existing Defender for Cloud CIEM.
What does effective permission analysis reveal?
Privileged access and governance
What an identity can actually reach and do, rather than merely the names of assigned roles.
Why include nonhuman identities in CIEM analysis?
Privileged access and governance
Service principals, managed identities, and service accounts can hold excessive access and support lateral movement.
What does Cloud Security Explorer support in CIEM?
Privileged access and governance
Queries about identities, resources, permissions, and contextual exposure.
How does attack-path analysis help prioritize permission risk?
Privileged access and governance
It links risky identities and exposed resources to routes toward sensitive or business-critical targets.
Why validate unused-permission recommendations with owners?
Privileged access and governance
Observed inactivity may omit rare legitimate operations; rights reduction should preserve required workload behavior.
How does CIEM differ from MFA?
Privileged access and governance
CIEM assesses authorization risk and excessive permissions; MFA strengthens authentication.
What is the purpose of an access review?
Privileged access and governance
Recertify whether existing resource access remains justified and apply the resulting decisions.
Why select business or resource owners as reviewers?
Privileged access and governance
They can assess the legitimate business need for continued access.
What is a fallback reviewer?
Privileged access and governance
An alternate reviewer used when the chosen owner or manager is unavailable.
Why define the no-response outcome?
Privileged access and governance
Unanswered reviews otherwise may leave unjustified access; the chosen policy must be deliberate and auditable.
What does Auto apply results to resource do?
Privileged access and governance
Applies completed review outcomes, such as membership or assignment removal, where supported.
What does an inactivity recommendation represent?
Privileged access and governance
Decision support based on configured usage criteria, not conclusive proof that the access has no legitimate purpose.
Can access reviews directly change an on-premises-synchronized group’s membership?
Privileged access and governance
No. On-premises AD remains the source of authority, so results need an appropriate source-side action.
Why can one group review simplify application reviews?
Privileged access and governance
If the group is the governed access path to the resources, its membership can represent the relevant entitlement bundle.
What may an Entra-only guest inventory omit?
Privileged access and governance
Direct rights assigned outside the observed Entra groups/app assignments, such as some direct resource grants.
How should an access-review pilot be made recoverable?
Privileged access and governance
Use limited scope, initially control result application, document removals, and monitor audit records.
What is the clean-source principle for privileged access?
Privileged access and governance
The originating device must be trustworthy; a compromised device can undermine account and session controls.
Why does a jump server not make a compromised source laptop safe?
Privileged access and governance
Malware on the source can steal credentials, impersonate the user, or control the privileged session.
What should a privileged workstation restrict compared with a productivity device?
Privileged access and governance
General browsing, unapproved software, local administrative rights, and unnecessary applications.
What hardware foundations support a secure workstation?
Privileged access and governance
A trusted hardware/firmware chain with TPM, Secure Boot, disk encryption, and relevant platform protections.
What role does managed configuration play in privileged device trust?
Privileged access and governance
Central management applies baselines, updates, approved applications, and compliance controls.
Why retain endpoint detection on privileged workstations?
Privileged access and governance
Hardening reduces attack surface, but detection is still needed to identify device compromise.
What four parts form an end-to-end privileged session path?
Privileged access and governance
Device, account, intermediaries, and administrative application interface.
Why can remote administration still need a privileged workstation?
Privileged access and governance
Remote transport and intermediaries do not remove the source device’s credential/session compromise risk.
Why permit a small set of administrative websites but not general browsing?
Privileged access and governance
Necessary management interfaces can be allowlisted while reducing exposure to arbitrary web content.
How should workstation assurance scale?
Privileged access and governance
Match device restrictions and trust to the sensitivity and impact of the privileges used.
What is the first step in translating a compliance obligation into a control?
Regulatory compliance and controls
Define the requirement and its in-scope services, data, identities, and organizational responsibilities.
What makes a control testable?
Regulatory compliance and controls
A stated objective, implementation, owner, evidence, and success criteria.
What is a customer-managed control?
Regulatory compliance and controls
A requirement implemented and operated by the customer organization.
What is a Microsoft-managed control?
Regulatory compliance and controls
A control Microsoft implements for its cloud service within the assessed scope.
What is a shared control?
Regulatory compliance and controls
A requirement with implementation responsibilities divided between Microsoft and the customer.
Why is a cloud-provider certification insufficient proof of customer compliance?
Regulatory compliance and controls
It covers provider-managed scope; the customer’s configurations, processes, and responsibilities still require assessment.
What does a Compliance Manager assessment group?
Regulatory compliance and controls
Controls associated with a regulation, standard, or organizational policy.
What is an improvement action used for?
Regulatory compliance and controls
Assign implementation/testing work, track status, and retain evidence and notes.
Why is an accepted exception still governed?
Regulatory compliance and controls
Its owner, residual risk, duration, and compensating controls need documented review.
What does a compliance score support?
Regulatory compliance and controls
Prioritization and progress tracking; it is not a legal assurance verdict for the entire organization.
Which Purview capability organizes assessments and improvement actions?
Which Purview capability classifies and can protect documents or email?
Regulatory compliance and controls
Sensitivity labels, with configured protection such as encryption and markings.
Which Purview capability governs risky sensitive-data sharing?
Regulatory compliance and controls
Data Loss Prevention policies with specified locations, conditions, and actions.
What does a content retention policy govern?
Regulatory compliance and controls
Whether content is retained, deleted, or retained and then deleted for the configured period.
How does audit retention differ from content retention?
Regulatory compliance and controls
Audit retention preserves operation records; content retention preserves or deletes the underlying information.
What does an eDiscovery hold preserve?
Regulatory compliance and controls
Relevant content in selected case locations during an investigation.
What does an eDiscovery case contain?
Regulatory compliance and controls
Related searches, holds, and review sets with case-specific access control.
Why does a sensitivity label not automatically impose every desired DLP action?
Regulatory compliance and controls
Label protection and DLP rules are separate configurations; policy conditions and actions must be designed.
Why scope DLP locations explicitly?
Regulatory compliance and controls
Policies only assess supported configured channels and activities; coverage must match the actual data paths.
Why combine Compliance Manager with operational Purview controls?
Regulatory compliance and controls
Assessment workflows organize accountability/evidence, while the relevant solutions implement data and investigation controls.
What does Azure Policy primarily evaluate?
Regulatory compliance and controls
Azure resource configuration/state against assigned policy rules, with effect behavior defined by the policy.
How does Azure Policy differ from Azure RBAC?
Regulatory compliance and controls
Policy constrains resource configuration; RBAC determines who can perform permitted resource actions.
What is an initiative?
Regulatory compliance and controls
A collection of policy definitions managed and assigned together toward an overarching goal.
What does the Audit effect do?
Regulatory compliance and controls
Records noncompliance without blocking the resource request.
What does Deny do for a noncompliant applicable request?
Regulatory compliance and controls
Prevents the request; it does not retroactively repair an existing resource.
What is DeployIfNotExists used for?
Regulatory compliance and controls
Deploy a required related configuration when its existence condition is not satisfied, subject to policy behavior and permissions.
What does Modify support?
Regulatory compliance and controls
Changing supported resource properties to meet policy requirements.
Which identity authorizes policy remediation deployments?
Regulatory compliance and controls
The policy assignment’s managed identity, with the minimum required Azure roles.
What is needed to remediate existing resources under DeployIfNotExists or Modify?
Regulatory compliance and controls
An appropriate remediation task and sufficient assignment-identity permissions.
Can a permissive child policy override an inherited Deny?
Regulatory compliance and controls
No. An applicable denying assignment must be changed or appropriately excluded/exempted; another grant does not override it.
What does Defender for Cloud regulatory compliance assess?
Regulatory compliance and controls
Supported resource security configurations against assigned compliance controls and standards.
Which clouds can have compliance standards managed in its dashboard?
Regulatory compliance and controls
Azure, AWS, and GCP, with appropriate onboarding and plan support.
What is the default benchmark enabled with Defender for Cloud onboarding?
Regulatory compliance and controls
Microsoft Cloud Security Benchmark (MCSB) under the documented onboarding defaults.
How do additional non-default standards depend on plans?
Regulatory compliance and controls
Current documentation requires at least one paid Defender for Cloud plan.
What does expanding a dashboard control reveal?
Regulatory compliance and controls
Its assessments, affected resources, and remediation information.
How can manual control assessment be supported?
Regulatory compliance and controls
Manual attestation with relevant evidence for the scoped subscriptions.
Why may remediation not appear immediately in compliance status?
Regulatory compliance and controls
Relevant assessments run periodically; the dashboard reflects changes after the next assessment.
What does integration with Compliance Manager add?
Regulatory compliance and controls
Resource-level compliance data for the same standard contributes to broader centralized improvement-action tracking.
Does a green assessment guarantee complete legal compliance?
Regulatory compliance and controls
No. It is evidence within supported assessment scope; customer and manual obligations still require validation.
What does a downloaded compliance report represent?
Regulatory compliance and controls
A summary based on the standard’s Defender assessment data, useful evidence rather than universal certification.
What does CSPM assess?
Hybrid multicloud posture and exposure
Cloud resource configuration and posture against security standards, producing recommendations to reduce misconfiguration risk.
How does CSPM differ from CWPP?
Hybrid multicloud posture and exposure
CSPM improves configuration posture; CWPP detects and responds to threats affecting running workloads.
Which Defender for Cloud CSPM tier includes basic recommendations and secure score?
Hybrid multicloud posture and exposure
Foundational CSPM, available at no cost.
Which plan provides advanced cloud attack-path analysis and risk prioritization?
Hybrid multicloud posture and exposure
The paid Defender CSPM plan; verify feature support for the connected environment.
What is the purpose of the Microsoft Cloud Security Benchmark?
Hybrid multicloud posture and exposure
MCSB provides consistent cloud security principles and platform-specific implementation guidance for evaluating resource security.
What happens to MCSB assessment when Defender for Cloud is enabled?
Hybrid multicloud posture and exposure
MCSB begins assessing resources in scope; additional benchmarks and standards can also apply.
Where can an architect inspect benchmark control assessment in Defender for Cloud?
Hybrid multicloud posture and exposure
The Regulatory compliance dashboard provides a dedicated benchmark view.
Does passing automated benchmark checks establish full regulatory compliance?
Hybrid multicloud posture and exposure
No. Assessment covers supported resource controls; full compliance also requires applicable manual evidence and organizational responsibilities.
What does a higher Defender for Cloud secure score indicate?
Hybrid multicloud posture and exposure
Lower identified risk from the assessed recommendations, rather than proof that every security risk is eliminated.
How should an architect treat MCSB v2 availability in current documentation?
Hybrid multicloud posture and exposure
MCSB v2 is documented as preview and can be enabled from the Regulatory compliance dashboard; validate preview suitability.
Which Secure Score decision records a recommendation that will remain unimplemented with its exposure deliberately retained?
Hybrid multicloud posture and exposure
Accept the risk or remaining risk for the recommended action. Record the decision and residual exposure; risk acceptance does not mean the recommended mitigation was implemented.
Where is Microsoft Secure Score available?
Hybrid multicloud posture and exposure
In the Microsoft Defender portal at the Secure Score experience.
Does Microsoft Secure Score guarantee that a breach cannot occur?
Hybrid multicloud posture and exposure
No. It measures recommended actions and does not guarantee protection against every threat.
What can Secure Score trends help an organization demonstrate?
Hybrid multicloud posture and exposure
Progress in implementing recommended controls over time and changes in measured security posture.
How do supported third-party protections relate to Secure Score?
Hybrid multicloud posture and exposure
The score can reflect qualifying third-party solutions when the associated recommendation is addressed; document the actual protection.
Why review licensing when interpreting Secure Score recommendations?
Hybrid multicloud posture and exposure
Available products and capabilities affect the recommendations and actions the organization can implement.
What is the purpose of comparing Secure Score with similar organizations?
Hybrid multicloud posture and exposure
To provide benchmark context and support improvement planning, not to prove equal business risk.
What should guide prioritization beyond Secure Score points?
Hybrid multicloud posture and exposure
Business impact and actual exposure; point gain alone should not determine the remediation order.
Which workloads are specifically emphasized in Microsoft Secure Score’s central dashboard?
Hybrid multicloud posture and exposure
Microsoft 365 identities, applications, and devices across the supported Microsoft security estate.
Which score focuses on cloud-resource recommendations rather than Microsoft 365 posture?
Hybrid multicloud posture and exposure
Defender for Cloud secure score. It is a different score system from Microsoft Secure Score.
Which two Defender for Cloud capability families should a multicloud plan distinguish?
Hybrid multicloud posture and exposure
CSPM for configuration posture and CWPP for workload threat protection.
How does Defender for Cloud connect to AWS and GCP posture?
Hybrid multicloud posture and exposure
Through cloud connectors with required permissions for the AWS accounts and GCP projects being assessed.
What inventory should precede multicloud protection design?
Hybrid multicloud posture and exposure
The clouds, accounts, projects, subscriptions, workloads, owners, and required security capabilities in scope.
Why identify functional and technical requirements before selecting multicloud protection?
Hybrid multicloud posture and exposure
They determine required capabilities, onboarding prerequisites, supported environments, and the deployment approach.
Why can a cloud connector be insufficient for runtime detection?
Hybrid multicloud posture and exposure
Some runtime protections require endpoint agents or in-cluster components beyond provider-API posture collection.
What should a multicloud pilot validate?
Hybrid multicloud posture and exposure
Connectivity, permissions, discovered-resource coverage, required protection components, and operational handling of findings.
What is a key limit of agentless machine scanning?
Hybrid multicloud posture and exposure
It supplies supported snapshot-based findings and does not replace continuous endpoint EDR telemetry.
Why plan for new cloud accounts during onboarding?
Hybrid multicloud posture and exposure
An integration must remain complete as the estate changes; a one-time inventory can leave new resources unprotected.
Who should handle posture recommendations versus workload alerts?
Hybrid multicloud posture and exposure
Accountable resource owners remediate posture; security operations investigate threat alerts, with coordinated workflows.
Where does Azure Arc fit into a hybrid posture design?
Hybrid multicloud posture and exposure
It brings supported non-Azure servers into Azure management; native cloud connectors still serve their cloud scopes.
What should determine the selection of a Defender workload protection plan?
Hybrid multicloud posture and exposure
The workload type, required threat-detection capability, platform support, and deployment prerequisites.
What is the main focus of Defender for Servers Plan 1?
Hybrid multicloud posture and exposure
Endpoint detection and response through integration with Microsoft Defender for Endpoint.
How does Defender for Servers Plan 2 relate to Plan 1?
Hybrid multicloud posture and exposure
It includes Plan 1 capabilities and adds server protection features such as supported agentless scanning and just-in-time VM access.
What additional posture findings can Plan 2 agentless scanning provide?
Hybrid multicloud posture and exposure
Supported vulnerability, malware, and exposed-secret findings from machines.
Which Defender plan addresses container image vulnerabilities and Kubernetes runtime threats?
Hybrid multicloud posture and exposure
Defender for Containers, with the required access and runtime components for the environment.
Which workload protection family should assess suspicious storage activity?
Hybrid multicloud posture and exposure
Defender for Storage, with required features enabled for the supported storage workload.
How should an architect select database workload protection?
Hybrid multicloud posture and exposure
Choose the supported Defender for Databases plan matching the actual database engine and hosting model.
Why check the Defender for Servers support matrix?
Hybrid multicloud posture and exposure
Operating system, environment, and capability support vary; an enabled plan alone does not establish feature parity.
Does Plan 2 just-in-time access apply identically to every on-premises server?
Hybrid multicloud posture and exposure
No. Validate environment-specific support; Azure VM network access controls do not automatically extend to arbitrary on-premises hosts.
Why verify sensors after enabling Defender for Containers?
Hybrid multicloud posture and exposure
Runtime detection requires in-cluster components; enabling the plan does not prove those components are healthy.
What does the Azure Arc Connected Machine agent do?
Hybrid multicloud posture and exposure
Registers a supported non-Azure server as an Azure resource and enables Azure management integration.
Does Arc registration move a server’s operating system into Azure?
Hybrid multicloud posture and exposure
No. The server remains in its hosting environment; Arc provides a management bridge.
Which identities run Arc server extensions locally?
Hybrid multicloud posture and exposure
Extensions can run as Local System on Windows or root on Linux, making extension deployment a privileged operation.
Why is Azure RBAC for Arc extensions security sensitive?
Hybrid multicloud posture and exposure
Permission to deploy extensions can translate into effective administrative control of the connected host.
What networking direction does Arc agent communication primarily require?
Hybrid multicloud posture and exposure
Outbound access to required Azure endpoints; Arc registration does not require a public inbound management port.
Who is responsible for host security in an Arc deployment?
Hybrid multicloud posture and exposure
The customer remains responsible for the machine, agent maintenance, access permissions, and extension security.
How can an Arc deployment reduce unnecessary extension attack surface?
Hybrid multicloud posture and exposure
Restrict permitted extensions or disable extension operations where they are not needed.
What should an Arc onboarding identity receive?
Hybrid multicloud posture and exposure
The Azure Connected Machine Onboarding role at the resource groups or subscriptions actually needed for registration, with later host-administration powers assigned separately.
Why maintain the Connected Machine agent?
Hybrid multicloud posture and exposure
Updates address security, reliability, and service compatibility; registering a machine is not the end of maintenance.
What must be protected when Arc enables access to a server managed identity?
Hybrid multicloud posture and exposure
Local access to identity tokens and the permissions granted to that identity; it should not become an escalation path.
From what perspective does Defender EASM discover assets?
Hybrid multicloud posture and exposure
An external, internet-facing perspective on the organization’s online infrastructure.
What is a discovery seed in Defender EASM?
Hybrid multicloud posture and exposure
A known legitimate organizational asset used to start recursive discovery of related infrastructure.
How does EASM find previously unknown assets?
Hybrid multicloud posture and exposure
It follows observed relationships from known assets and infers connections to additional infrastructure.
Name four asset types EASM can inventory.
Hybrid multicloud posture and exposure
Domains, hosts, IP addresses, and SSL certificates; its inventory also includes web pages and other related infrastructure.
Why validate ownership of an EASM-discovered candidate?
Hybrid multicloud posture and exposure
Relationships are inferred; a discovered asset may belong to a vendor or unrelated organization rather than the customer.
How does EASM help after an acquisition?
Hybrid multicloud posture and exposure
It can discover related internet-facing infrastructure missing from the acquiring company’s internal inventory.
Does EASM replace internal endpoint process telemetry?
Hybrid multicloud posture and exposure
No. External surface discovery does not supply complete host EDR or internal operating-system configuration evidence.
What risk can an expiring internet-facing certificate create?
Hybrid multicloud posture and exposure
Service disruption or loss of trusted connectivity; certificate findings should reach an accountable owner.
Why continue EASM discovery after the initial inventory?
Hybrid multicloud posture and exposure
The online attack surface changes; continuous discovery helps identify new and forgotten exposures.
What should follow confirmation of an external exposure?
Hybrid multicloud posture and exposure
Assign ownership, prioritize the risk, remediate through an appropriate workflow, and verify that exposure is reduced.
What does Microsoft Security Exposure Management unify?
Hybrid multicloud posture and exposure
Security posture context across devices, identities, cloud resources, and external attack surfaces.
What is an attack path?
Hybrid multicloud posture and exposure
A connected route from an attacker entry point through weaknesses and permissions to critical assets.
How does enterprise attack-path analysis differ from Defender for Cloud’s cloud-only experience?
Hybrid multicloud posture and exposure
The Defender portal experience covers cross-workload endpoint, cloud, and hybrid paths; the Azure portal experience focuses on cloud environments.
Why identify critical assets in exposure management?
Hybrid multicloud posture and exposure
Criticality supplies business context so paths leading to important assets can receive suitable priority.
What is a useful remediation choke point?
Hybrid multicloud posture and exposure
A weakness or permission whose removal interrupts several feasible attacker routes to critical assets.
What can incomplete telemetry do to attack-path results?
Hybrid multicloud posture and exposure
Make paths absent or incomplete; no displayed path does not prove no exposure exists.
What do security initiatives organize?
Hybrid multicloud posture and exposure
Related security metrics and recommendations around an improvement objective such as ransomware protection.
How do security insights support a posture process?
Hybrid multicloud posture and exposure
They provide contextual metrics and actionable improvement information for prioritizing and tracking exposure reduction.
Why should path closure be verified after remediation?
Hybrid multicloud posture and exposure
Verify that the change interrupts the attacker route; other weaknesses or permissions may preserve access. For endpoint ASR rules, Audit logs risky behavior without blocking it, so an audited rule alone does not establish enforced path reduction.
Which cloud availability limitation is documented for Security Exposure Management?
Hybrid multicloud posture and exposure
It is available in the public cloud; validate suitability for sovereign or national-cloud requirements.
What does server EDR add beyond configuration assessment?
Server client IoT and OT security
Detection, investigation, and response for advanced threats on the running endpoint.
Why specify server protection separately for Windows and Linux?
Server client IoT and OT security
Supported operating systems and protection features differ; validate each platform against the support matrix.
What is the purpose of a server security configuration baseline?
Server client IoT and OT security
A defined minimum configuration for that resource type, established and assessed through configuration management.
Why remove unnecessary server software and services?
Server client IoT and OT security
To reduce the attack surface and the components that require patching and monitoring.
How should server EDR alerts connect to operations?
Server client IoT and OT security
Integrate alerts with the SIEM and security-operations process so they are investigated and acted on.
When should a server architecture evaluate Defender for Servers Plan 2?
Server client IoT and OT security
When it needs Plan 1 EDR plus supported additional protections such as agentless scanning or just-in-time VM access.
Why prioritize server vulnerability remediation rather than only collecting scans?
Server client IoT and OT security
Scanning identifies weaknesses; prioritized corrective action and verification reduce the resulting exposure.
Does registering a server with Arc transfer host-security responsibility to Microsoft?
Server client IoT and OT security
No. The customer still secures and maintains the host and controls administrative access.
How should an unsupported server platform be treated?
Server client IoT and OT security
As a residual-risk exception needing compensating controls and a remediation or replacement plan, rather than assumed secure.
What must be checked before assuming a Windows server protection feature also works on Linux?
Server client IoT and OT security
The feature’s operating-system and environment support, prerequisites, and deployment method.
What is the main purpose of Intune endpoint security policies?
Server client IoT and OT security
Configure focused security controls such as antivirus, firewall, encryption, EDR, and attack surface reduction on supported platforms.
How does a compliance policy differ from a configuration policy?
Server client IoT and OT security
Compliance primarily evaluates requirements and reports status; configuration policies set device security settings.
How can device compliance influence access to corporate resources?
Server client IoT and OT security
Intune reports compliance to Microsoft Entra ID, and Conditional Access can require appropriate compliance for access.
What protects corporate data inside supported apps on unmanaged personal devices?
Server client IoT and OT security
Intune app protection policies, which govern apps and data rather than full-device settings.
How can Defender for Endpoint risk affect device access?
Server client IoT and OT security
Its threat-level signal can feed Intune compliance and app protection policies, which can support access decisions.
What does tamper protection help protect?
Server client IoT and OT security
Security settings against unauthorized changes that could weaken endpoint protection.
What is the purpose of attack surface reduction rules?
Server client IoT and OT security
Target risky software behavior on supported Windows devices, such as Office child processes, obfuscated scripts, and code injection, using applicable ASR rule modes.
Why avoid setting conflicting values in multiple device configuration policies?
Server client IoT and OT security
The same setting may fail to apply or show a conflict requiring manual resolution.
Are all endpoint-security policy capabilities identical on Windows, macOS, Linux, iOS, and Android?
Server client IoT and OT security
No. Capabilities vary by platform and supported policy type.
What evidence is stronger than merely assigning an endpoint policy?
Server client IoT and OT security
The resulting device configuration, compliance, and protection health reported after delivery and evaluation.
Why should IoT devices avoid one shared fleet authentication key?
Server client IoT and OT security
A compromise of that key can let an attacker impersonate many devices and compromise the fleet.
Which authentication choices are commonly used with Azure IoT DPS?
Server client IoT and OT security
X.509 certificates, TPM attestation, and symmetric keys, selected according to hardware and operational requirements.
What does a TPM contribute to IoT device identity security?
Server client IoT and OT security
Protected cryptographic key generation and storage, with supported attestation for provisioning.
What operational duty accompanies X.509 device authentication?
Server client IoT and OT security
Certificate lifecycle management, including issuance, renewal, replacement, and trust management.
Why protect a symmetric device key in hardware where practical?
Server client IoT and OT security
Exposed keys enable impersonation; secure hardware storage reduces extraction risk.
How does Device Update verify downloaded update binaries?
Server client IoT and OT security
The agent validates the signed update manifest and checks the binary hashes recorded in that trusted manifest.
Why is update authenticity distinct from encrypted transport?
Server client IoT and OT security
Encryption protects the channel; signatures and trusted hashes establish that the intended update content is authentic and unchanged.
Which security boundaries exist in an edge-connected IoT system?
Server client IoT and OT security
Assets, connections, edge infrastructure, and cloud services each need protection.
What should the device retirement stage remove or revoke?
Server client IoT and OT security
Device identity and credentials, active access, and sensitive retained data as required by the lifecycle process.
What monitoring approach can protect devices that cannot host conventional security agents?
Server client IoT and OT security
Agentless network monitoring with Defender for IoT, subject to traffic visibility and environment requirements.
Why is agentless monitoring useful for OT and ICS?
Server client IoT and OT security
Specialized industrial devices often cannot run ordinary endpoint agents; network monitoring provides visibility without modifying them.
How does an OT network sensor receive observed traffic?
Server client IoT and OT security
Through a configured SPAN port or network TAP at an appropriate monitoring location.
Where does OT sensor analysis take place?
Server client IoT and OT security
Data collection, processing, analysis, and alerting occur on the sensor; selected telemetry and insights can reach Azure.
What does Defender for IoT discover about industrial devices?
Server client IoT and OT security
Device inventory, communication patterns, vulnerabilities, and suspicious or unauthorized activity.
What does behavior-baseline analysis detect in ICS networks?
Server client IoT and OT security
Deviations from expected operations, such as unauthorized function codes, access, or configuration changes.
How can an air-gapped OT deployment use Defender for IoT?
Server client IoT and OT security
Use locally managed sensors with sensor-console visibility rather than mandatory cloud connectivity.
How are threat-intelligence packages updated on locally managed OT sensors?
Server client IoT and OT security
They must be uploaded manually; cloud-connected sensors can receive packages automatically.
How can Defender for IoT findings enter an enterprise response process?
Server client IoT and OT security
Integrate with Microsoft Sentinel or other supported SOC, SIEM, SOAR, and API workflows.
What should govern actions on safety-critical OT control paths?
Server client IoT and OT security
Site-specific operational safety processes and applicable industry requirements, not a cloud dashboard alone.
Why plan sensor placement around actual traffic paths?
Server client IoT and OT security
A sensor can analyze only traffic it receives; incomplete mirroring leaves devices or communications invisible.
What is a Microsoft Intune security baseline?
Server client IoT and OT security
A group of preconfigured recommended Windows security settings that can be customized and deployed to managed devices.
Should a security baseline be treated as a fixed value set that can never change?
Server client IoT and OT security
No. Customize it for justified environment requirements and evaluate new baseline versions as guidance changes.
What device platform does Intune’s Windows security baseline feature target?
Server client IoT and OT security
Supported Windows devices; it is not a universal baseline for every mobile or Linux platform.
How do endpoint security policies differ from a broad baseline?
Server client IoT and OT security
They focus on specific control areas; a baseline groups recommended settings across a broader posture.
Why review overlaps before assigning multiple baselines?
Server client IoT and OT security
Different values for the same setting can cause configuration conflicts or unexpected effective state.
What should secure-configuration baselines cover across resource types?
Server client IoT and OT security
Configuration requirements suited to each resource type, established through deployment and configuration management.
Why pilot baseline changes before broad enforcement?
Server client IoT and OT security
To test business compatibility and resulting security settings before potentially disruptive fleet-wide deployment.
Which policy primarily verifies that devices meet baseline-related access requirements?
Server client IoT and OT security
A compliance policy, using the resulting device state to evaluate the required conditions.
What should be checked after a new baseline version is adopted?
Server client IoT and OT security
Changed settings, assignments, conflicts, and the actual resulting configuration on targeted devices.
Why continue configuration assessment after baseline deployment?
Server client IoT and OT security
Settings can drift or new resources can bypass the intended baseline; continuous assessment detects deviations.
What does Windows LAPS manage?
Server client IoT and OT security
The password of a local administrator account on supported joined Windows devices, and supported DC DSRM account passwords.
How does Windows LAPS reduce lateral movement?
Server client IoT and OT security
It rotates unique per-device local administrator passwords rather than leaving a reusable password across the fleet.
Which directories can hold a managed local administrator password?
Server client IoT and OT security
Microsoft Entra ID or Windows Server Active Directory, according to the selected backup policy and join scenario.
What DFL is required for Windows LAPS password encryption in Active Directory?
Server client IoT and OT security
Windows Server 2016 domain functional level or later.
Which DCs can use LAPS DSRM management at DFL 2016 or later?
Server client IoT and OT security
LAPS-capable Windows Server 2019 or later domain controllers; Server 2016 and earlier DCs do not support this feature.
Can Windows LAPS back up DSRM passwords to Entra ID?
Server client IoT and OT security
No. DSRM password backup requires Windows Server Active Directory and enabled password encryption.
Is permission to read an encrypted LAPS attribute sufficient to decrypt it?
Server client IoT and OT security
No. The reader must also be an authorized decryption principal.
What schema preparation is needed for AD-backed Windows LAPS?
Server client IoT and OT security
Update the Active Directory schema for Windows LAPS, then configure required computer and administrator permissions.
What does LAPS password reset after authentication achieve?
Server client IoT and OT security
It rotates the managed local account password after a configurable grace period to limit continued reuse.
Does post-authentication password reset apply to the DSRM account?
Server client IoT and OT security
No. Password reset after authentication is not supported for the DSRM account on domain controllers.
Which responsibilities remain with the customer across SaaS, PaaS, and IaaS?
SaaS PaaS IaaS containers and AI services
Protecting customer data, configuring controlled settings, and managing identities and access.
Who manages the guest operating system in IaaS?
SaaS PaaS IaaS containers and AI services
The customer manages guest OS security, updates, and configuration.
Who manages the platform operating system in PaaS?
SaaS PaaS IaaS containers and AI services
Microsoft manages the underlying platform OS; the customer still secures its applications, data, and controlled settings.
Does SaaS remove the customer’s access-management duties?
SaaS PaaS IaaS containers and AI services
No. Customers still manage accounts, permissions, access controls, and the security settings they control.
How should baselines differ across service models?
SaaS PaaS IaaS containers and AI services
Define controls suited to each service’s capabilities and the customer’s actual responsibilities rather than copying one OS baseline everywhere.
What is the value of service-specific security baselines?
SaaS PaaS IaaS containers and AI services
They translate common security principles into configuration requirements for the particular cloud service.
Who secures Azure physical hosts and datacenters?
SaaS PaaS IaaS containers and AI services
Microsoft operates the underlying physical cloud infrastructure.
How can secure configurations be built into deployment?
SaaS PaaS IaaS containers and AI services
Use infrastructure and configuration automation with appropriate policy guardrails to establish the baseline from the start.
Why assess existing resources after introducing deployment guardrails?
SaaS PaaS IaaS containers and AI services
Guardrails for new deployments do not prove previously deployed resources meet the baseline.
Why must cloud baseline ownership be explicit?
SaaS PaaS IaaS containers and AI services
Control responsibilities vary by service model, and unmanaged customer settings can leave exposure even when the provider secures its platform.
Why use renewable credentials for IoT Hub devices?
SaaS PaaS IaaS containers and AI services
Rotation limits how long a compromised credential can be reused and supports long-lived device operation.
Why should devices receive distinct identities?
SaaS PaaS IaaS containers and AI services
Per-device authorization and revocation reduce the impact of a compromised device credential.
Why avoid broad IoT Hub shared-access policies for device clients?
SaaS PaaS IaaS containers and AI services
They can grant more service access than a single device needs; use scoped device credentials and permissions.
How should backend applications access IoT Hub where supported?
SaaS PaaS IaaS containers and AI services
Use Microsoft Entra identities and appropriate least-privilege RBAC rather than broadly distributing shared secrets.
What protects data in transit between an IoT device and hub?
SaaS PaaS IaaS containers and AI services
TLS with trustworthy certificate validation and securely managed authentication credentials.
Why secure edge infrastructure separately from the cloud hub?
SaaS PaaS IaaS containers and AI services
The edge handles local data, identities, and management operations that remain attack targets outside the cloud service.
What role do IoT Hub private endpoints play?
SaaS PaaS IaaS containers and AI services
They restrict supported service access through private network paths; they do not replace authentication or permissions.
Why segment OT, IT, and cloud-connected IoT networks?
SaaS PaaS IaaS containers and AI services
To limit reachable control paths and prevent one compromised boundary from freely reaching the others.
What information can device twins provide for fleet management?
SaaS PaaS IaaS containers and AI services
Device metadata, desired configuration, and reported state used to target and verify management operations.
Why must telemetry and command paths have separate security review?
SaaS PaaS IaaS containers and AI services
Monitoring data and control commands have different trust and safety implications; command authority must be explicitly constrained.
Why separate web workload ingress, backend, and administration paths?
SaaS PaaS IaaS containers and AI services
Each path has different users, permissions, reachability, and threat exposure; one ingress control does not secure all of them.
What does an App Service private endpoint protect?
SaaS PaaS IaaS containers and AI services
Inbound access from private networks through Private Link using an address from the virtual network.
What must accompany a private endpoint when public App Service exposure is forbidden?
SaaS PaaS IaaS containers and AI services
Disable public network access and verify the intended private access path.
Does an App Service private endpoint configure application outbound connectivity?
SaaS PaaS IaaS containers and AI services
No. Outbound access uses other features such as virtual network integration; private endpoints serve inbound access.
Why is private DNS required for private web access?
SaaS PaaS IaaS containers and AI services
Clients must resolve the application name to the private endpoint’s address rather than an unsuitable public path.
Which control addresses common HTTP attacks such as SQL injection?
SaaS PaaS IaaS containers and AI services
A web application firewall on a supported web ingress service; it complements secure application code.
Why use managed identities for supported web app dependencies?
SaaS PaaS IaaS containers and AI services
They avoid storing application passwords while allowing scoped service permissions.
Why protect the deployment pipeline as part of web workload security?
SaaS PaaS IaaS containers and AI services
A compromised deployment identity or artifact can alter production code and inherit application access.
How does DDoS protection differ from WAF protection?
SaaS PaaS IaaS containers and AI services
DDoS protection addresses supported volumetric availability threats; WAF inspects web application traffic for application-layer attacks.
Does a private network path remove the need for application authorization?
SaaS PaaS IaaS containers and AI services
No. The application still must authenticate callers and authorize each operation and data access.
Why start container images from approved minimal base images?
SaaS PaaS IaaS containers and AI services
A smaller approved software set reduces unnecessary packages and the vulnerabilities that must be maintained.
What does container image vulnerability assessment examine?
SaaS PaaS IaaS containers and AI services
Supported registry or running-image software packages for known vulnerabilities.
Does image vulnerability scanning replace runtime threat detection?
SaaS PaaS IaaS containers and AI services
No. Image assessment and runtime activity collection are distinct capabilities.
Why avoid unnecessary root or privileged execution inside containers?
SaaS PaaS IaaS containers and AI services
It increases the permissions available after compromise and can weaken isolation from the host.
What is the risk of granting a container broad host access?
SaaS PaaS IaaS containers and AI services
A compromised workload may reach host resources and affect other workloads, extending its blast radius.
Why should container images avoid embedded production secrets?
SaaS PaaS IaaS containers and AI services
Image copies and registry readers can expose credentials; use an appropriate secret or workload-identity mechanism.
What collection component provides container runtime signals in Defender for Containers?
SaaS PaaS IaaS containers and AI services
The supported Defender sensor collects runtime telemetry on cluster nodes.
What does container signing add to an artifact security design?
SaaS PaaS IaaS containers and AI services
It supports verification of artifact provenance and integrity, complementing vulnerability scanning rather than replacing it.
What must follow discovery of a vulnerable container package?
SaaS PaaS IaaS containers and AI services
Fix or rebuild the image, deploy the corrected artifact, and verify the running workload uses it.
Why protect access to the container registry?
SaaS PaaS IaaS containers and AI services
Registry permissions control who can read or replace executable artifacts that production workloads will run.
Which Kubernetes boundary should a private AKS API server protect?
SaaS PaaS IaaS containers and AI services
Administrative control-plane access to the cluster API; it is separate from workload ingress.
Why use namespace-scoped Kubernetes authorization where appropriate?
SaaS PaaS IaaS containers and AI services
It limits administrative and workload access to the required cluster resources rather than granting cluster-wide authority.
Does creation of a namespace alone enforce all network isolation?
SaaS PaaS IaaS containers and AI services
No. Use appropriate network policies and enforcement to control permitted pod communication.
What is the purpose of Kubernetes network policies?
SaaS PaaS IaaS containers and AI services
Constrain allowed pod traffic according to selectors and policy rules when enforced by the supported network implementation.
What does Azure Policy for Kubernetes do?
SaaS PaaS IaaS containers and AI services
It supports admission-time configuration enforcement through the Kubernetes admission-control integration.
Why separate cluster administrator and application deployment roles?
SaaS PaaS IaaS containers and AI services
Deployment should not automatically grant authority to alter every workload or security control in the cluster.
What does workload identity improve for Kubernetes applications?
SaaS PaaS IaaS containers and AI services
It provides scoped service authentication without embedding long-lived cloud credentials in workload configuration.
What telemetry does the Defender runtime sensor collect?
SaaS PaaS IaaS containers and AI services
Supported process, network, and Kubernetes event telemetry from cluster nodes.
Why review cluster egress as well as ingress?
SaaS PaaS IaaS containers and AI services
Compromised workloads can contact malicious destinations or exfiltrate data even when inbound access is constrained.
Why distinguish agentless cluster discovery from in-cluster runtime detection?
SaaS PaaS IaaS containers and AI services
They use different collection paths and prerequisites; discovery alone does not establish runtime protection.
What should precede securing an organization’s Azure AI workloads?
SaaS PaaS IaaS containers and AI services
Discover the AI workloads and usage so the required service, data, identity, and dependency boundaries are known.
Which Defender plan includes AI security posture capabilities?
SaaS PaaS IaaS containers and AI services
Defender CSPM provides supported AI workload discovery, security recommendations, and attack-path analysis.
Why prefer managed identity authentication for supported AI service calls?
SaaS PaaS IaaS containers and AI services
It avoids stored API keys while allowing scoped service access through Entra authentication.
What dependencies belong inside an AI workload’s network security review?
SaaS PaaS IaaS containers and AI services
Supporting services such as Storage, Key Vault, and registries, not only the AI endpoint.
Why configure private DNS for AI private endpoints?
SaaS PaaS IaaS containers and AI services
Clients and dependencies must resolve service names to the intended private addresses.
Why restrict outbound destinations from AI infrastructure?
SaaS PaaS IaaS containers and AI services
To limit unauthorized exfiltration while preserving approved model-training and inference dependencies.
What does AI input filtering help identify?
SaaS PaaS IaaS containers and AI services
Malicious or harmful prompts, including supported prompt-injection and jailbreak patterns.
What does AI output filtering help prevent?
SaaS PaaS IaaS containers and AI services
Delivery of harmful model responses, subject to supported filtering and configuration.
Why use API gateway rate limits for AI workloads?
SaaS PaaS IaaS containers and AI services
To constrain resource consumption and abusive API usage alongside identity and content controls.
Why require human review for high-risk AI actions?
SaaS PaaS IaaS containers and AI services
The model’s proposed action should not automatically authorize sensitive transfers or system changes; an approval workflow limits impact.
What does an Azure NSG filter?
Network security and Security Service Edge
Inbound and outbound network flows using rules based on sources, destinations, ports, and protocols.
Does an NSG inspect HTTP payloads for SQL injection?
Network security and Security Service Edge
No. Use a suitable WAF for web attack inspection; NSGs control network flows.
Which Azure Firewall SKU provides TLS inspection and IDPS?
Network security and Security Service Edge
Azure Firewall Premium; validate certificate, routing, and feature requirements.
How does FQDN filtering differ from full URL filtering?
Network security and Security Service Edge
FQDN filtering identifies the destination host; full URL filtering can also distinguish the path, with supported TLS inspection for HTTPS.
Why combine WAF and DDoS controls for an internet-facing service?
Network security and Security Service Edge
They address different application-layer and volumetric availability threats.
What name-resolution condition must hold for private endpoint access?
Network security and Security Service Edge
The service name must resolve to the intended private endpoint IP from the calling network.
Why evaluate east-west traffic in a segmented architecture?
Network security and Security Service Edge
Lateral workload traffic can carry compromise between segments even when internet ingress is restricted.
Why validate egress routes through a chosen firewall?
Network security and Security Service Edge
The security appliance protects only traffic that actually follows its inspected path; bypass routes defeat the control.
How are matching NSG rules prioritized?
Network security and Security Service Edge
Lower numeric priorities are processed first; the first matching rule ends evaluation for that flow.
Does Azure Firewall Premium TLS inspection require certificate planning?
Network security and Security Service Edge
Yes. The inspection architecture creates separate TLS connections and requires a trusted inspection certificate configuration.
What is Entra Internet Access for all apps?
Network security and Security Service Edge
An identity-centric secure web gateway for SaaS applications and other internet traffic.
Which destination attributes can web content filtering use?
Network security and Security Service Edge
Web categories and fully qualified domain names, with supported URL visibility depending on traffic and inspection.
What is an Internet Access security profile?
Network security and Security Service Edge
An ordered grouping of filtering policies that can be applied through user-aware Conditional Access.
What determines policy order within a security profile?
Network security and Security Service Edge
Unique priority numbers; lower numbers have higher priority.
What is the role of the baseline security profile?
Network security and Security Service Edge
A lowest-priority catch-all profile for all Internet Access traffic routed through the service, even without a linked Conditional Access policy.
How does ordinary HTTPS filtering identify a host without full TLS inspection?
Network security and Security Service Edge
It can use Server Name Indication; encrypted full URL paths require additional supported inspection visibility.
How can user context influence Entra Internet Access enforcement?
Network security and Security Service Edge
Conditional Access integration can use user, device, location, risk, and compliance context.
What must happen before cloud-edge filtering can apply to a user’s traffic?
Network security and Security Service Edge
The relevant traffic must be acquired and routed through the Global Secure Access service.
Which licenses provide the Internet Access product capabilities?
Network security and Security Service Edge
Microsoft Entra Suite or a standalone Internet Access license, with the required Entra ID P1/P2 prerequisite for users.
Why review traffic logs during an Internet Access pilot?
Network security and Security Service Edge
They show actual destinations and enforced policies, helping verify expected acquisition, allowed access, and blocked access.
Which traffic profile acquires supported Microsoft 365 and Entra ID service traffic?
Network security and Security Service Edge
The Microsoft traffic profile in Global Secure Access.
Can traffic assigned to the Microsoft traffic profile be acquired instead by the Internet Access profile?
Network security and Security Service Edge
No. Microsoft-profile traffic is acquired only by the Microsoft traffic profile.
What deployment step scopes the Microsoft traffic profile to users?
Network security and Security Service Edge
Assign the profile to the relevant users and groups, then verify the client receives its forwarding rules.
Which license includes Internet Access for Microsoft services capabilities?
Network security and Security Service Edge
Microsoft Entra ID P1 or P2; this differs from the full Internet Access product licensing.
What do universal tenant restrictions add to authentication traffic?
Network security and Security Service Edge
Tenant restrictions v2 policy information so supported services can enforce allowed and blocked tenant access.
Where are permitted external tenants and exceptions defined?
Network security and Security Service Edge
In the tenant restrictions v2 policy under cross-tenant access settings, including default and partner-specific settings.
What must accompany a tenant restrictions v2 policy for Global Secure Access enforcement?
Network security and Security Service Edge
Enable universal tenant restrictions signaling for relevant acquired authentication traffic.
What does the compliant network check verify?
Network security and Security Service Edge
The user connects through Global Secure Access for the specific tenant whose access policy requires the network signal.
Why is a compliant network signal from one tenant insufficient for another tenant’s requirement?
Network security and Security Service Edge
The signal is tenant specific; the required tenant’s Global Secure Access service must supply it.
Why use a fresh sign-in when testing compliant-network blocking?
Network security and Security Service Edge
Existing sessions may not be interrupted immediately; evaluation occurs when a new sign-in is required.
What does Microsoft Entra Private Access provide?
Network security and Security Service Edge
Identity-aware access to specified private resources through Global Secure Access without requiring broad legacy VPN network access.
What is Quick Access?
Network security and Security Service Edge
A primary grouping of private FQDNs, IP addresses, or ranges intended to be tunneled through the service.
When is per-app access preferable to one broad Quick Access definition?
Network security and Security Service Edge
When a subset of private resources needs separate user assignment, Conditional Access, or time-limited access.
What is the role of a private network connector?
Network security and Security Service Edge
It brokers connections from the cloud service to reachable private backend resources through outbound service connections.
Why does a connector not need public inbound firewall ports?
Network security and Security Service Edge
The connector initiates outbound connections and uses the established channels for bidirectional traffic.
How many connectors are recommended in a group for high availability?
Network security and Security Service Edge
At least two, with suitable backend reachability and required service connectivity.
Why use connector groups?
Network security and Security Service Edge
To route applications through the appropriate locations and provide segmentation, load balancing, and high availability.
Which enterprise-app controls restrict Private Access users?
Network security and Security Service Edge
Assign users or groups to the app and apply appropriate Conditional Access policies.
What should be checked when a connector cannot reach an FQDN-based backend?
Network security and Security Service Edge
Connector-side DNS resolution, routing, destination connectivity, and the backend’s own access requirements.
Does Private Access automatically rewrite every legacy application’s authentication protocol?
Network security and Security Service Edge
No. It adds identity-aware access controls around resource access; backend authentication and authorization still require design.
What does Microsoft Secure Score measure?
Microsoft 365 Intune Purview and Copilot
Adoption of recommended security actions across supported identities, apps, and devices; a higher score reflects more actions taken.
Does a high Microsoft Secure Score prove regulatory compliance?
Microsoft 365 Intune Purview and Copilot
No. It is a posture metric, not an audit certification or guarantee against compromise.
What is the purpose of Secure Score recommended actions?
Microsoft 365 Intune Purview and Copilot
They expose configuration and practice gaps, provide remediation guidance, and help track improvements.
How should an architect prioritize actions beyond their point values?
Microsoft 365 Intune Purview and Copilot
Use asset sensitivity, exposure, likely attack paths, business impact, and remediation feasibility.
Why can a Secure Score action receive partial points?
Microsoft 365 Intune Purview and Copilot
Some actions are scored in proportion to the users or devices protected rather than only complete or incomplete.
Can a non-Microsoft control contribute to Secure Score?
Microsoft 365 Intune Purview and Copilot
Yes. Supported recommendations can be recorded as addressed through a non-Microsoft solution or alternate mitigation.
What should accompany a security posture trend report?
Microsoft 365 Intune Purview and Copilot
Deployment coverage, exceptions, incident evidence, and validation of the controls behind the score.
What can benchmark comparisons in Secure Score help establish?
Microsoft 365 Intune Purview and Copilot
Relative posture and improvement targets; they do not establish the organization's individual risk tolerance.
Which portal exposes Microsoft Secure Score?
Why review licenses when selecting Secure Score remediation?
Microsoft 365 Intune Purview and Copilot
A recommendation may be visible even when its specific implementation capability requires a different edition or plan.
Which Defender for Office 365 capability protects supported links at click time?
Which Defender for Office 365 capability analyzes supported attachments for malicious content?
What does Defender for Office 365 Plan 2 add to Plan 1's protective foundation?
Microsoft 365 Intune Purview and Copilot
Capabilities including attack simulation training, deeper hunting and investigation, and automated investigation and response.
Why configure SPF, DKIM, and DMARC alongside Defender for Office 365?
Microsoft 365 Intune Purview and Copilot
They provide sender authentication and alignment signals that complement phishing and malware protection.
Which product discovers unsanctioned SaaS usage?
Microsoft 365 Intune Purview and Copilot
Microsoft Defender for Cloud Apps, using supported discovery signals and its cloud application catalog.
What does SaaS Security Posture Management assess?
Microsoft 365 Intune Purview and Copilot
Security configuration and recommended hardening in supported connected SaaS applications.
What risk does app governance address?
Microsoft 365 Intune Purview and Copilot
OAuth-enabled applications with permissions and behavior that can expose or misuse organizational data.
Which capability can restrict downloads in supported SaaS browser sessions?
Microsoft 365 Intune Purview and Copilot
Conditional Access App Control with appropriate supported session policies and integration.
Why is browser session control insufficient for all OAuth app risks?
Microsoft 365 Intune Purview and Copilot
An application can use granted API permissions independently of an interactive browser session.
Why review a proposed cloud app connection's supported governance actions?
Microsoft 365 Intune Purview and Copilot
Visibility and enforcement depend on the application's integration and supported access paths.
What is Intune mobile device management responsible for?
Microsoft 365 Intune Purview and Copilot
Managing enrolled device configuration, compliance, applications, and supported device-wide controls.
What does Intune mobile application management protect?
Microsoft 365 Intune Purview and Copilot
Organizational data within supported managed applications, including scenarios without full device enrollment.
Which Intune control can restrict copying corporate data into personal apps?
Microsoft 365 Intune Purview and Copilot
An app protection policy with supported data transfer restrictions.
What is the difference between configuration and compliance policies?
Microsoft 365 Intune Purview and Copilot
Configuration policies apply settings; compliance policies evaluate whether a device meets required conditions.
What role does Conditional Access play in an Intune compliance design?
Microsoft 365 Intune Purview and Copilot
It uses the evaluated compliance signal to make an access decision; compliance evaluation alone is not the access enforcement step.
What is a selective app wipe intended to remove?
Microsoft 365 Intune Purview and Copilot
Organizational data from protected apps while preserving personal data within supported scenarios.
Why validate the application before relying on app protection?
Microsoft 365 Intune Purview and Copilot
The app must support the relevant Intune app protection capabilities and platform behavior.
How can app protection enforce additional access safeguards?
Microsoft 365 Intune Purview and Copilot
It can require an app PIN or biometric access and apply supported conditional launch requirements.
Does an app protection policy manage every file on a personal device?
Microsoft 365 Intune Purview and Copilot
No. Its boundary is protected organizational data in participating apps, not all personal content.
Why combine Conditional Access with app protection policies?
Microsoft 365 Intune Purview and Copilot
To require the intended protected access path and help ensure application data protection is enforced.
What are the three broad Microsoft Purview capability areas?
Microsoft 365 Intune Purview and Copilot
Data security, data governance, and data compliance.
What does a sensitivity label express?
Microsoft 365 Intune Purview and Copilot
An organization's classification and supported handling or protection settings for content.
Does every sensitivity label encrypt content?
Microsoft 365 Intune Purview and Copilot
No. Encryption depends on the label's configured protection settings; some labels only classify or mark content.
What does a DLP policy define?
Microsoft 365 Intune Purview and Copilot
Sensitive information to detect, supported locations, matching conditions, and actions to take.
How does retention differ from DLP?
Microsoft 365 Intune Purview and Copilot
Retention governs preservation and deletion over time; DLP governs inappropriate use or movement of sensitive data.
What is the role of Purview eDiscovery?
Microsoft 365 Intune Purview and Copilot
Finding, preserving, reviewing, and producing relevant content for investigations and legal processes.
What is the role of Purview Audit?
Microsoft 365 Intune Purview and Copilot
Providing records of supported user and administrator activities for investigations and compliance.
Does a sensitivity label on a site automatically label every file?
Microsoft 365 Intune Purview and Copilot
No. Container settings and file-level labeling are separate scopes; file protection must be configured as required.
Why should DLP deployment include simulation or evaluation before broad enforcement?
Microsoft 365 Intune Purview and Copilot
To confirm scope, matches, user impact, false positives, and exceptions before blocking business activity.
Why are sensitivity labels and DLP commonly combined?
Microsoft 365 Intune Purview and Copilot
Labels express classification and protection; DLP can use classification and context to restrict risky actions.
Whose permissions govern Microsoft 365 Copilot's access to organizational content?
Microsoft 365 Intune Purview and Copilot
The permissions of the user initiating the prompt; Copilot does not automatically repair excessive permissions.
What should precede Copilot rollout when sensitive sites are overshared?
Microsoft 365 Intune Purview and Copilot
Identify owners and exposure, reduce inappropriate sharing, and remediate source permissions.
Can Copilot DLP exclude supported labeled content while a user still has direct access?
Microsoft 365 Intune Purview and Copilot
Yes. Processing exclusion and ordinary source authorization are separate controls.
Can an item excluded by label-based Copilot DLP still appear in citations?
Microsoft 365 Intune Purview and Copilot
Yes. The documented label-based control excludes content processing, but the item can still appear in citations.
Which email date boundary is documented for label-based Copilot DLP?
Microsoft 365 Intune Purview and Copilot
It supports emails sent on or after January 1, 2025.
Are calendar invites covered by the documented label-based Copilot DLP email control?
Microsoft 365 Intune Purview and Copilot
No. The documentation lists calendar invites as unsupported.
What is the status of DLP blocking sensitive information types in Copilot prompts?
Microsoft 365 Intune Purview and Copilot
Preview and rolling out; verify that the feature is available in the target tenant and experience.
What does the external-email Copilot DLP preview evaluate?
Microsoft 365 Intune Purview and Copilot
Sender-domain metadata against the tenant's accepted domains; it does not inspect the email body.
What happens when the Copilot DLP web-search control matches sensitive prompt data?
Microsoft 365 Intune Purview and Copilot
External web search is blocked for that prompt, while responses can still use permitted internal Microsoft 365 sources.
Which Purview capabilities support Copilot investigation and content lifecycle?
Microsoft 365 Intune Purview and Copilot
Supported Audit, eDiscovery, and retention capabilities help investigate and preserve AI interactions.
What inventory is needed before assessing an application portfolio?
Application lifecycle workload identities and APIs
Applications, owners, business criticality, data sensitivity, dependencies, exposed endpoints, identities, and deployed versions.
Why include unused applications in a security posture review?
Application lifecycle workload identities and APIs
They can retain exposed endpoints, permissions, secrets, or vulnerable components and increase attack surface.
How should portfolio vulnerability findings be prioritized?
Application lifecycle workload identities and APIs
By exploitability, exposure, business impact, affected data, and compensating controls rather than counts alone.
What does an application dependency inventory enable?
Application lifecycle workload identities and APIs
Identification of affected workloads when a library or framework vulnerability is disclosed.
Why assess both code and runtime posture?
Application lifecycle workload identities and APIs
Code analysis finds implementation risks; runtime assessment finds deployed behavior, exposure, drift, and operational weaknesses.
What does Defender for APIs contribute to an application portfolio review?
Application lifecycle workload identities and APIs
Inventory, API posture findings, sensitive-data classification, and threat detection for supported onboarded APIs.
Why assign an owner to each application finding?
Application lifecycle workload identities and APIs
So remediation, risk acceptance, deadlines, and validation have accountable decision makers.
What risk does an abandoned OAuth permission grant introduce?
Application lifecycle workload identities and APIs
An application can retain access to organizational data even when users no longer actively use it.
Why review deployed versions instead of only repository branches?
Application lifecycle workload identities and APIs
The running workload may differ from current source and contain older or unexpected components.
What evidence should validate an application's posture improvement?
Application lifecycle workload identities and APIs
Retesting the affected attack path and confirming the corrected code or configuration is deployed.
What is the purpose of threat modeling?
Application lifecycle workload identities and APIs
Identify, evaluate, and mitigate threats to a system early and revisit them as the architecture evolves.
What does STRIDE stand for?
Application lifecycle workload identities and APIs
Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, and Elevation of privilege.
Which STRIDE category concerns an attacker pretending to be another identity?
Which STRIDE category concerns unauthorized modification of data or code?
Which STRIDE category concerns denying an action without sufficient evidence?
Which STRIDE category concerns exposure of information to unauthorized parties?
Which STRIDE category concerns exhausting a service's capacity?
Which STRIDE category concerns gaining capabilities beyond authorized privileges?
Why show trust boundaries and data flows in a threat model?
Application lifecycle workload identities and APIs
They reveal where data or identities cross assumptions and where authentication, authorization, validation, and protection are required.
What should a threat model record for each important threat?
Application lifecycle workload identities and APIs
The affected asset or flow, risk, mitigation, owner, validation, and response if the control fails.
When should application security requirements enter the lifecycle?
Application lifecycle workload identities and APIs
During planning and design alongside business and functional requirements.
How should threat modeling evolve during the lifecycle?
Application lifecycle workload identities and APIs
Revisit it after material architecture, dependency, privilege, or data-flow changes.
What does SAST inspect?
Application lifecycle workload identities and APIs
Source code, bytecode, or binaries without executing the application.
What does DAST evaluate?
Application lifecycle workload identities and APIs
A running application using simulated attack interactions and runtime observations.
Why continuously scan approved dependencies?
Application lifecycle workload identities and APIs
Previously acceptable components can acquire newly disclosed vulnerabilities.
What is a security quality gate in a pipeline?
Application lifecycle workload identities and APIs
A defined check that prevents or controls promotion when a security requirement is not met.
Why protect developer workstations as part of application security?
Application lifecycle workload identities and APIs
A compromised workstation can tamper with source, credentials, or build access before production deployment.
How does progressive exposure support secure release?
Application lifecycle workload identities and APIs
Gradual rollout limits the affected population and supports controlled response if a defect appears.
How should production incidents affect development practices?
Application lifecycle workload identities and APIs
Feed verified causes and fixes back into requirements, threat models, tests, and secure coding practices.
What security work belongs to application decommissioning?
Application lifecycle workload identities and APIs
Remove unused workloads, endpoints, credentials, permissions, and retained assets according to lifecycle requirements.
Why establish secure coding standards?
Application lifecycle workload identities and APIs
To define repeatable approved practices and reduce avoidable vulnerabilities across development teams.
What is the role of role-specific developer security training?
Application lifecycle workload identities and APIs
Teach the threats and prevention techniques relevant to each developer's work before privileged source access.
What should protect a source repository beyond code scanning?
Application lifecycle workload identities and APIs
Least privilege, strong identity controls, structured peer review, and accountable approval workflows.
Why should pipeline extensions come from trusted, validated sources?
Application lifecycle workload identities and APIs
They execute inside privileged build workflows and can introduce supply-chain compromise.
What should happen when a secret is found in source control?
Application lifecycle workload identities and APIs
Treat it as exposed, revoke or rotate it, remove the unsafe usage, and add preventive controls.
What is the secure default for application authorization logic?
Application lifecycle workload identities and APIs
Deny access unless explicitly authorized.
Why isolate production and nonproduction environments?
Application lifecycle workload identities and APIs
To limit lateral movement and prevent lower-trust development or testing from exposing production assets.
Why restrict build-agent privileges and network access?
Application lifecycle workload identities and APIs
Build agents can access valuable source, credentials, and deployment capabilities.
What advantage can clean hosted build environments provide?
Application lifecycle workload identities and APIs
They reduce persistence opportunities and the operational burden of maintaining reusable self-hosted agents.
Why use synthetic or appropriately protected test data?
Application lifecycle workload identities and APIs
Copying production data into lower environments can move sensitive information beyond its intended protection boundary.
Which technology fits centralized storage of unavoidable application secrets?
Application lifecycle workload identities and APIs
Azure Key Vault, with restricted access, audit, network controls, and lifecycle management.
Which technology avoids stored credentials for supported Azure-hosted workloads?
Application lifecycle workload identities and APIs
Managed identities combined with the necessary least-privilege resource authorization.
Which technology can validate API tokens and apply quotas centrally?
Application lifecycle workload identities and APIs
Azure API Management policies at the gateway.
Which control must decide whether a caller can access a particular business record?
Application lifecycle workload identities and APIs
Application or data-layer authorization using trusted identity and resource context.
Which service family addresses common HTTP exploits such as SQL injection and XSS?
Application lifecycle workload identities and APIs
Azure WAF on a supported service such as Application Gateway or Front Door.
Which SQL feature protects supported sensitive column plaintext from the database engine?
Application lifecycle workload identities and APIs
Always Encrypted with appropriate client-side keys and supported drivers.
Which SQL feature protects database files and backups at rest?
Application lifecycle workload identities and APIs
Transparent Data Encryption; it does not by itself hide query plaintext from an authorized administrator.
Which capability detects API posture risks for supported onboarded API Management APIs?
Application lifecycle workload identities and APIs
Microsoft Defender for APIs.
Which control limits the application network's access path to a supported PaaS resource?
Application lifecycle workload identities and APIs
Private endpoints and appropriate public access restrictions, with working DNS; identity authorization is still required.
Why map a requirement to multiple complementary controls?
Application lifecycle workload identities and APIs
Identity, authorization, network restriction, encryption, detection, and recovery address different failure modes.
What distinguishes a workload identity from a human identity?
Application lifecycle workload identities and APIs
A workload identity represents software such as an application, service, script, or container rather than a person.
What is the Microsoft Entra application object?
Application lifecycle workload identities and APIs
The global application definition or template used to create tenant-local service principals.
What is a service principal?
Application lifecycle workload identities and APIs
The tenant-local representation of an application, defining its access and capabilities in that tenant.
What problem do managed identities remove?
Application lifecycle workload identities and APIs
The need for developers to store and manually manage workload authentication credentials.
How is a system-assigned managed identity's lifecycle handled?
Application lifecycle workload identities and APIs
It is tied to one Azure resource and is deleted when that resource is deleted.
How is a user-assigned managed identity's lifecycle handled?
Application lifecycle workload identities and APIs
It is an independent Azure resource that can be assigned to multiple resources and must be explicitly managed.
Does enabling a managed identity grant downstream data access?
Application lifecycle workload identities and APIs
No. The identity still needs the appropriate permissions on the target resource.
What does workload identity federation replace in supported external workloads?
Application lifecycle workload identities and APIs
Stored application secrets or certificates with trusted token exchange from an external identity provider.
Which federated identity credential fields must match the incoming token?
Application lifecycle workload identities and APIs
Issuer, subject, and audience must case-sensitively match the configured trust values.
Why scope a workload identity's permissions to its specific task?
Application lifecycle workload identities and APIs
To reduce the data and resources an attacker can reach if the workload is compromised.
What are the three main API Management components?
Application lifecycle workload identities and APIs
The API gateway, management plane, and developer portal.
What is API Management's gateway role?
Application lifecycle workload identities and APIs
Accept API requests and consistently apply configured routing, credential checks, quotas, transformations, and observability.
What should API token validation check?
Application lifecycle workload identities and APIs
The expected issuer, audience, validity, signature, and required claims according to the authentication design.
Why are API subscription keys insufficient as complete end-user identity?
Application lifecycle workload identities and APIs
They identify subscription access rather than proving each user's identity and authorization to individual business objects.
What is broken object-level authorization?
Application lifecycle workload identities and APIs
A caller can access or modify a business object they are not authorized to use, often by changing an identifier.
What is broken function-level authorization?
Application lifecycle workload identities and APIs
A caller can invoke an operation outside their permitted role or capabilities.
What risk do quotas and rate limits mitigate?
Application lifecycle workload identities and APIs
Excessive consumption and some abuse patterns; they do not establish object-level permissions.
Why validate API payloads and schemas?
Application lifecycle workload identities and APIs
To reject malformed or unexpected input and reduce the accepted attack surface.
Why restrict direct backend access in a gateway design?
Application lifecycle workload identities and APIs
Otherwise callers may bypass gateway authentication, validation, throttling, or monitoring policies.
What does Defender for APIs add to API Management's gateway controls?
Application lifecycle workload identities and APIs
Posture findings and supported threat detection for onboarded APIs; it complements preventive policies.
Which attacks are common targets for Azure WAF rules?
Application lifecycle workload identities and APIs
Supported HTTP threats such as SQL injection and cross-site scripting.
What does Application Gateway WAF detection mode do?
Application lifecycle workload identities and APIs
Monitors and logs matched threats without blocking incoming requests.
What does Application Gateway WAF prevention mode do?
Application lifecycle workload identities and APIs
Blocks requests identified as attacks by the enforced rules and records them in WAF logs.
Why begin a new WAF deployment with a short detection period?
Application lifecycle workload identities and APIs
To observe real traffic, investigate false positives, and tune rules before enforcement.
What does a WAF policy contain?
Application lifecycle workload identities and APIs
Managed rules, custom rules, exclusions, and supported service-specific settings.
What is the purpose of a narrowly scoped WAF exclusion?
Application lifecycle workload identities and APIs
Avoid false positives for a specific request attribute while retaining the rest of the intended inspection.
How do custom rules differ from managed rules?
Application lifecycle workload identities and APIs
Custom rules express application-specific matching and actions; managed rule sets provide maintained predefined protections.
Which WAF host fits global edge HTTP protection?
Application lifecycle workload identities and APIs
Azure Front Door with the appropriate WAF tier and capabilities.
Does Azure WAF replace application authorization?
Application lifecycle workload identities and APIs
No. The application still must enforce trusted user, tenant, object, and function permissions.
Are Front Door Standard and Premium WAF capabilities identical?
Application lifecycle workload identities and APIs
No. Standard supports custom rules; Premium provides the full integrated WAF capabilities including managed rules.
What is the first purpose of data discovery?
Data classification encryption databases and storage
Locate data assets and processing paths so the organization knows what needs protection.
How does data classification influence architecture?
Data classification encryption databases and storage
Sensitivity, information type, and obligations guide access, segmentation, encryption, monitoring, retention, and handling.
What does an organizational data taxonomy provide?
Data classification encryption databases and storage
Shared categories and definitions so teams classify and handle information consistently.
Why classify backups, caches, exports, and test data?
Data classification encryption databases and storage
Sensitive content can be replicated outside its primary store and still requires appropriate protection.
What do sensitive information types identify?
Data classification encryption databases and storage
Configured patterns and evidence associated with sensitive data, shared across supported Purview solutions.
What are trainable classifiers used for?
Data classification encryption databases and storage
Identifying categories of content through machine learning and examples rather than only fixed patterns.
What does Purview Data Map scanning capture?
Data classification encryption databases and storage
Metadata about scanned assets and sources for data governance.
Does a Purview catalog reader role grant access to underlying business data?
Data classification encryption databases and storage
No. Data Map and Unified Catalog roles govern metadata and do not themselves grant underlying data access.
What is the role of a data owner in classification?
Data classification encryption databases and storage
Determine business meaning, approve appropriate classifications and access, and maintain accountable handling.
Why validate automated classification results?
Data classification encryption databases and storage
Tools can suggest classifications, but coverage, false positives, missed sensitive data, and business context still need review.
What factors determine the priority of a data threat?
Data classification encryption databases and storage
Data sensitivity, business impact, exposure, likely abuse, affected scope, obligations, and available controls.
Why does encryption not resolve excessive authorized access?
Data classification encryption databases and storage
An authorized principal can usually receive plaintext through the service, so permissions and use still need controls.
What should be prioritized when regulated data is publicly accessible?
Data classification encryption databases and storage
Contain the exposure, assess impact, and correct the access boundary before lower-impact posture improvements.
Why include data copies in threat mitigation priorities?
Data classification encryption databases and storage
Exports, caches, backups, and test datasets can expose the same sensitive information through weaker boundaries.
What is data minimization's security purpose?
Data classification encryption databases and storage
Reduce unnecessary sensitive information collected, processed, copied, or retained.
Why align recovery protections with data criticality?
Data classification encryption databases and storage
Loss or corruption of critical data can cause severe business harm even without disclosure.
What should an accepted data risk record contain?
Data classification encryption databases and storage
Affected data and impact, rationale, accountable owner, compensating controls, review date, and validation.
How can classification support incident response priority?
Data classification encryption databases and storage
It helps identify high-value affected data and scope likely business and regulatory consequences.
Why distinguish confidentiality, integrity, and availability threats?
Data classification encryption databases and storage
Unauthorized disclosure, modification, and loss require different complementary mitigation and validation.
What should prove that a data mitigation worked?
Data classification encryption databases and storage
Evidence that the targeted access, transfer, integrity, or recovery path now meets the requirement.
What security state does encryption at rest protect?
Data classification encryption databases and storage
Stored data such as service files, disks, or backups; it does not by itself authorize or restrict service-mediated plaintext queries.
What protects data while it crosses a network?
Data classification encryption databases and storage
Appropriately configured TLS or another suitable secure transport, including correct endpoint and certificate validation.
What materials can Azure Key Vault protect?
Data classification encryption databases and storage
Cryptographic keys, certificates and private keys, and secrets such as passwords or connection strings.
Why separate vaults by application and environment?
Data classification encryption databases and storage
To limit shared secret access and reduce the blast radius of a compromise.
How do customer-managed storage keys differ from Microsoft-managed keys?
Data classification encryption databases and storage
The customer has key-control and lifecycle responsibilities, with the service using the configured key-management integration.
What does Storage infrastructure encryption add?
Data classification encryption databases and storage
A second encryption layer with a different key and algorithm, separate from service-level encryption.
When must account-level infrastructure encryption be selected?
Data classification encryption databases and storage
At storage account creation; it cannot be enabled or disabled for that account afterward.
Can infrastructure encryption be selected for a new encryption scope?
Data classification encryption databases and storage
Yes. The documented scope setting is selected when the scope is created and cannot be changed afterward.
Why enable soft delete and purge protection for required cryptographic material?
Data classification encryption databases and storage
To reduce irreversible loss or malicious destruction of keys that dependent services need.
What key lifecycle risks must an encryption design manage?
Data classification encryption databases and storage
Permission misuse, expired or unavailable keys, rotation failures, deletion, audit gaps, and recovery dependencies.
What is the key authorization requirement for a RAG assistant?
Data classification encryption databases and storage
Only content the authenticated user is authorized to use should reach the model's grounding context.
Why must search security-filter identities come from a trusted source?
Data classification encryption databases and storage
A string filter is not authentication; allowing users to assert arbitrary groups can bypass the intended document boundary.
Why retain document permission metadata during ingestion?
Data classification encryption databases and storage
It allows supported retrieval-time access checks or security filters to exclude unauthorized content.
Do prompt safety checks repair overbroad retrieval permissions?
Data classification encryption databases and storage
No. Prompt attack detection and document authorization address different threats.
What are direct user prompt attacks?
Data classification encryption databases and storage
Adversarial user inputs that try to override model instructions or safety behavior.
What are document attacks in a grounded AI workload?
Data classification encryption databases and storage
Malicious instructions embedded in retrieved documents, emails, or pages that attempt to hijack model behavior.
Does the Azure AI Content Safety Prompt Shields API itself block content?
Data classification encryption databases and storage
No. The calling application decides how to act on detection results; supported Foundry blocking configuration behaves separately.
Why restrict AI tool identities and permissions?
Data classification encryption databases and storage
A manipulated agent can otherwise perform privileged actions or retrieve more information than its task requires.
Why include embeddings, logs, and training copies in AI data governance?
Data classification encryption databases and storage
Derived and operational artifacts can retain sensitive information and require appropriate handling.
What should AI source governance validate besides access?
Data classification encryption databases and storage
Source trust, data quality, provenance, ownership, and lifecycle so unreliable or poisoned content is not treated as trusted.
What does Azure SQL TDE encrypt?
Data classification encryption databases and storage
Database files and backups at rest; an authorized query can still return plaintext.
What security requirement does Always Encrypted address?
Data classification encryption databases and storage
Keeping supported sensitive column plaintext unavailable to the database engine or administrators without client key access.
What does SQL row-level security enforce?
Data classification encryption databases and storage
Row access through configured security predicates using trusted execution or identity context.
What does dynamic data masking change?
Data classification encryption databases and storage
The sensitive values displayed in query results for applicable users; it does not change stored data or encrypt it.
Why is masking insufficient as a complete adversarial data boundary?
Data classification encryption databases and storage
Privileged users can see original data and determined querying can undermine limited masking; authorization must remain sound.
Which permission planes must a Synapse design distinguish?
Data classification encryption databases and storage
Azure resource roles, Synapse workspace roles, SQL permissions, Git permissions, and relevant storage access.
Why review Synapse execution rights along with linked-service identities?
Data classification encryption databases and storage
A user able to execute code or pipelines may use an identity or credential with broader data access than their own.
How do Cosmos DB for NoSQL control-plane and data-plane roles differ?
Data classification encryption databases and storage
Control-plane roles manage resources; native data-plane roles authorize operations on items and containers.
What authentication pattern should be preferred for supported Cosmos DB for NoSQL workloads?
Data classification encryption databases and storage
Managed identity and appropriately scoped Entra data-plane roles instead of embedded account keys.
Why do database private endpoints not replace database permissions?
Data classification encryption databases and storage
They constrain the network path; callers still need valid authentication and authorization.
What identity pattern is preferred for a supported Azure workload accessing Blob data?
Data classification encryption databases and storage
Microsoft Entra authentication with a managed identity and least-privilege data permissions.
Why distinguish a Storage data role from a resource management role?
Data classification encryption databases and storage
Management permissions and direct data operations are separate authorization needs.
What is a shared access signature?
Data classification encryption databases and storage
A bearer credential delegating specified resource access, permissions, and validity within supported Storage services.
How should a necessary SAS be constrained?
Data classification encryption databases and storage
Use the narrowest supported resource and permissions, short expiry, secure transport, and a planned revocation strategy.
How is a user delegation SAS secured?
Data classification encryption databases and storage
With Microsoft Entra credentials and the SAS permissions; verify target service, API version, and client support.
Which SAS types support stored access policies?
Data classification encryption databases and storage
A service SAS can use a stored access policy; user delegation and account SAS do not use them.
Why must logs avoid full SAS URLs?
Data classification encryption databases and storage
The embedded bearer token can grant access to anyone who obtains it while it remains valid.
Does a private endpoint for Blob automatically cover all Storage services?
Data classification encryption databases and storage
No. Each required subresource endpoint and access path must be planned and validated.
What should be configured when anonymous Blob access is not required?
Data classification encryption databases and storage
Disallow public Blob access and validate that intended identity and network paths remain functional.
How do immutability and recovery features address different needs?
Data classification encryption databases and storage
Immutability restricts supported modification or deletion for retention; soft delete, versions, and backup support recovery and must be selected and tested appropriately.
Which telemetry does Defender for Storage analyze?
Data classification encryption databases and storage
Supported data-plane and control-plane activity to detect suspicious storage behavior.
Is Defender for Storage deployed with an agent inside each Storage account?
Data classification encryption databases and storage
No. It is an agentless cloud-native protection solution.
What are the main Defender for Storage protection capabilities?
Data classification encryption databases and storage
Activity monitoring, sensitive-data threat detection, and malware scanning in supported scenarios.
How do on-upload and on-demand malware scanning differ?
Data classification encryption databases and storage
On-upload scans supported newly uploaded or modified content; on-demand evaluates selected existing content or stores.
Why must an upload application account for variable scan duration?
Data classification encryption databases and storage
Content can be accepted before scanning completes, so downstream release must await the intended validated result.
What happens when the on-upload monthly scan cap is reached?
Data classification encryption databases and storage
Scanning halts under the documented cap behavior; subsequent files can remain unscanned until scanning resumes.
How should pending, failed, unsupported, or unscanned uploads be handled?
Data classification encryption databases and storage
Keep them outside the approved download path until the defined security validation and release policy is satisfied.
What does Defender for Azure SQL Databases provide?
Data classification encryption databases and storage
Supported vulnerability assessment and alerts for anomalous or suspicious database activity.
Which Cosmos DB API is supported by the documented Defender for Azure Cosmos DB plan?
Data classification encryption databases and storage
Azure Cosmos DB for NoSQL; the documented table excludes MongoDB, Cassandra, Table, and Gremlin APIs.
Why integrate Defender data alerts into security operations?
Data classification encryption databases and storage
Detections need accountable triage, investigation, containment, and remediation; enabling detection is not the response itself.
Practice questions
These are original study questions. Multiple-response practice uses exact-set scoring in the app, with no partial credit.
1. A hospital scheduling service has modest hardware costs but its loss prevents patient appointments. Which factor should determine its criticality?
Business resilience and ransomware
✓ Correct answer
- The effect on patient services and essential operations
Business impact determines criticality. Server replacement cost omits disruption, highly available placement is a control rather than intrinsic business importance, and a runbook does not measure the consequences of service loss.
Open this question’s page →2. An organization can remediate one issue immediately: an externally exposed remote-management server with a path to domain administration, or a higher-severity flaw on an isolated disposable lab VM. What is the best first action?
Business resilience and ransomware
✓ Correct answer
- Assess and close the exposed path to domain administration
The exposed administrative path threatens concentrated enterprise control. Severity alone ignores exposure/impact, unvalidated antivirus coverage does not establish path containment, and replacement cost misses indirect influence over critical services.
Open this question’s page →3. A payment platform remains online while an attacker changes supplier bank details. Which security outcome is most directly violated?
Business resilience and ransomware
✓ Correct answer
- Integrity of business data
Unauthorized modification violates integrity. The service remains available; the scenario concerns changed data rather than viewing alone, and authenticating an identity does not establish that payment instructions remain correct.
Open this question’s page →4. A recovery exercise restores the order database, but users cannot sign in because the only identity service was excluded from recovery planning. What should the architect change?
Business resilience and ransomware
✓ Correct answer
- Extend the business-service dependency map and recovery plan to include identity
The complete business service depends on identity. A file restore and database redundancy do not restore sign-in, and excluding the failed dependency from measurement hides rather than repairs the recovery gap.
Open this question’s page →5. A manufacturer is identifying concentrated cybersecurity risk. Which two assets deserve protection based on their ability to affect high-value operations? Select two answers.
Business resilience and ransomware
✓ Correct answers
- The deployment identity that can replace code in every production application
- The production design repository containing irreplaceable intellectual property
The production design repository containing irreplaceable intellectual property: Its intrinsic business value makes disclosure or destruction highly damaging. The deployment identity that can replace code in every production application: Its administrative influence creates concentrated risk across high-value assets. Every disposable lab VM at the same priority as production control identities: Uniform priority ignores differences in business impact and influence. Only resources with the highest monthly Azure bill: Cost alone does not identify high-value data or privileged control. Only internet-facing resources, excluding internal administrators: An internal privileged identity can still control critical systems.
Open this question’s page →6. A board asks for two measurements that demonstrate reduced risk to critical services. Which should the architect select? Select two answers.
Business resilience and ransomware
✓ Correct answers
- Evidence that critical administrative paths enforce least privilege and strong authentication
- Successful service-level recovery tests against agreed targets
Recovery exercises and enforced privileged-path controls demonstrate service-risk reduction. Job success omits usable restoration, inventory existence omits effective protection, and an aggregate score may hide the relevant critical-service gaps.
Open this question’s page →7. An application has a 30-minute RPO. Its last usable backup is at 09:00, and an incident occurs at 10:20. What is the potential data-loss interval?
Business resilience and ransomware
✓ Correct answer
- 80 minutes
80 minutes: The interval from 09:00 to 10:20 is 80 minutes, exceeding the 30-minute target. 30 minutes: The target does not establish the age of the actual recovery point. 50 minutes: This is the amount by which the interval exceeds the target, not the full potential loss. Zero minutes because a backup exists: Backup existence does not establish zero data loss.
Open this question’s page →8. A disaster-recovery plan defines a 120-minute RTO. Sequential steps take 35 minutes for infrastructure, 25 for identity and networking, and 75 for application restoration and validation. What does the rehearsal show?
Business resilience and ransomware
✓ Correct answer
- The measured 135-minute sequence exceeds the RTO
The measured 135-minute sequence exceeds the RTO: Sequential durations add to 135 minutes, so the required service restoration time is not met. The RTO is met because each step is below 120 minutes: The target applies to complete service restoration, not each separate component. The RPO must be 135 minutes: Data-loss tolerance and restoration duration are different measurements. The target is met if the last step starts before 120 minutes: Business operations must be restored, not merely started on their final recovery step.
Open this question’s page →9. A retailer already has regional VM replication but needs recovery from malicious database updates copied to the replica. Which additional capability addresses this requirement?
Business resilience and ransomware
✓ Correct answer
- Protected point-in-time recovery with validated clean restoration
Protected point-in-time recovery with validated clean restoration: Earlier recovery states address data corruption that replication propagates. More frequent replication of the same current state: More frequent copying still propagates malicious changes. A lower DNS TTL without historical recovery points: DNS helps traffic failover but does not reconstruct earlier data. A larger secondary VM without recoverable history: Compute capacity does not reverse copied data corruption.
Open this question’s page →10. A recovery automation restores encrypted backups in another region. The original tenant is unavailable, and the required key permissions are not provisioned there. What is the best architectural correction?
Business resilience and ransomware
✓ Correct answer
- Design and test independent access to the required keys and recovery identities
Design and test independent access to the required keys and recovery identities: Recoverability requires usable encryption keys and authorization under the incident conditions. Assume successful backup jobs prove the keys will be available: Backup completion does not prove key access during a tenant outage. Remove encryption from all backups permanently: Removing confidentiality protection is not required to design a secure recovery path. Increase replication frequency without changing key access: Frequency does not resolve the authorization dependency.
Open this question’s page →11. A company wants evidence of complete disaster-recovery readiness. Which two activities directly contribute? Select two answers.
Business resilience and ransomware
✓ Correct answers
- Exercise recovery identities, networking, DNS, and external dependencies
- Restore into a controlled environment and validate critical business transactions
Business transactions and dependency exercises validate usable recovery. Backup jobs do not measure RTO, replica compute omits service dependencies/data trust, and operational decisions are part of the planned recovery process.
Open this question’s page →12. A multinational must protect Azure, on-premises, and AWS workloads while meeting sovereignty constraints. Which two design choices are appropriate? Select two answers.
Business resilience and ransomware
✓ Correct answers
- Use supported recovery mechanisms for each platform under common business recovery targets
- Validate allowed recovery locations and data movement against residency requirements
Use supported recovery mechanisms for each platform under common business recovery targets: Platform-specific capability is necessary even when governance is unified. Validate allowed recovery locations and data movement against residency requirements: Cross-region or cross-cloud recovery can change where data is stored or processed. Assume Azure Site Recovery protects every SaaS and cloud database: Support matrices restrict eligible sources, targets, and workloads. Choose the cheapest remote region before checking legal constraints: Cost cannot override mandatory location requirements. Define recovery success solely as infrastructure deployment completion: Business-service restoration and validation must also succeed.
Open this question’s page →13. A ransomware program proposal begins with recovery preparation, then privileged-access protection, then entry-point reduction. What best explains this order?
Business resilience and ransomware
✓ Correct answer
- It assumes compromise and prioritizes reducing business impact quickly
It assumes compromise and prioritizes reducing business impact quickly: Survivable recovery and limited administrative blast radius reduce the consequences of successful entry. It proves initial-access controls are unnecessary: Entry-point protection remains a required part of the plan. It is an unavoidable technical deployment dependency: The published order is risk prioritization and allows parallel work. It applies only to workloads with no sensitive data: The guidance is relevant to sensitive and business-critical environments.
Open this question’s page →14. An endpoint team can deploy a phishing-defense improvement today while another team protects backups. Which approach follows Microsoft urgent ransomware guidance?
Business resilience and ransomware
✓ Correct answer
- Proceed in parallel without delaying recovery and privileged-access work
Proceed in parallel without delaying recovery and privileged-access work: Quick later-stage improvements can be completed while preserving the recommended priority. Stop all endpoint work until every backup task is complete: The guidance allows different teams to work simultaneously. Cancel backup work because phishing controls are available: Preventive improvements do not replace resilience under assumed compromise. Treat the priority list as permission to skip privileged access: Privileged-access protection limits an attacker who gets through entry defenses.
Open this question’s page →15. A vault administrator has standing Backup MUA Operator rights on the vault Resource Guard. The architect expects an independent approval boundary. What is wrong?
Business resilience and ransomware
✓ Correct answer
- The administrator already has rights that satisfy the Resource Guard check
Standing MUA operational authority defeats the intended independent check. Resource Guard can be separately hosted, Reader is not the critical-operation authority, and MFA strengthens authentication without separating the administrator’s permissions.
Open this question’s page →16. An organization has tested immutable backups but discovers that customer files were exfiltrated before encryption. What is the best conclusion?
Business resilience and ransomware
✓ Correct answer
- Recovery protection is valuable, but disclosure and access risks require additional controls
Recovery protection is valuable, but disclosure and access risks require additional controls: Backups restore data; they do not undo prior theft or prevent unauthorized disclosure. Immutability was necessarily misconfigured because exfiltration occurred: Vault immutability addresses recovery-point destruction, not every production data access. A successful restore removes all confidentiality consequences: Restoration cannot revoke knowledge of data already stolen. Data protection is unnecessary after recovery succeeds: The incident demonstrates why disclosure prevention and detection are still needed.
Open this question’s page →17. Which two conditions support an independent Resource Guard authorization boundary? Select two answers.
Business resilience and ransomware
✓ Correct answers
- The vault administrator lacks standing Contributor or MUA operational authority on Resource Guard
- A different security authority owns and controls Resource Guard
Separate ownership and absent standing MUA authority support independence. Permanent Owner can bypass the intended separation, hosting separation is insufficient when effective rights remain, and Resource Guard does not govern arbitrary production-source operations.
Open this question’s page →18. A recovery team proposes locking vault immutability and then restoring production immediately after every security incident. Which two prerequisites should the architect insist on? Select two answers.
Business resilience and ransomware
✓ Correct answers
- Validate recovered systems in a controlled environment before reconnecting them
- Validate required retention and operating behavior before irreversible locking
Validate required retention and operating behavior before irreversible locking: Locking cannot be undone, so the supported workload and retention design must be correct. Validate recovered systems in a controlled environment before reconnecting them: Recovery should confirm trusted operation rather than restore into ongoing compromise. Grant production administrators permanent rights to delete recovery data: Shared destructive authority undermines ransomware resilience. Assume the newest recovery point cannot contain attacker persistence: Recent backups can contain malicious changes and require validation. Treat locked immutability as a substitute for all recovery drills: Protected storage does not prove usable data, dependencies, or restoration time.
Open this question’s page →19. A company needs one management view for supported Windows and Linux servers in Azure, its datacenter, and another cloud. Which architecture fits?
Business resilience and ransomware
✓ Correct answer
- Azure Update Manager with Azure Arc onboarding for supported non-Azure servers
Update Manager and Arc support the described server environments. SIEM collection and policy assessment alone do not install patches, and Windows client mechanisms do not establish Linux server coverage.
Open this question’s page →20. An architect proposes a new Update Manager deployment and states that an Azure Automation account and Log Analytics workspace are mandatory. What should the reviewer say?
Business resilience and ransomware
✓ Correct answer
- The current Azure Update Manager has no dependency on those legacy components
The current Azure Update Manager has no dependency on those legacy components: It uses native VM or Arc integration and Resource Manager operations. An Automation account is mandatory for every Arc machine: That claim confuses current Update Manager with legacy update-management architecture. A Sentinel workspace substitutes for every server agent requirement: SIEM ingestion does not replace supported machine patching integration. Removing server onboarding requirements is the only alternative: Supported VM or Arc integration still needs to be present.
Open this question’s page →21. A patch rollout reaches a small pilot group and causes application failures. Which next action follows safe deployment practices?
Business resilience and ransomware
✓ Correct answer
- Halt wider rollout, initiate recovery, and investigate the failed health checks
Halt wider rollout, initiate recovery, and investigate the failed health checks: Progressive exposure limits impact by stopping expansion when the pilot fails. Continue to all production servers to finish the schedule: Continuing expands the known failure blast radius. Disable monitoring so the deployment can complete without alerts: Removing evidence does not make the release healthy. Declare success because the patch installer exited successfully: Installer success does not prove workload health.
Open this question’s page →22. A critical server has an actively exploited vulnerability, but its vendor requires a compatibility fix before the patch can be installed safely. What is the best interim design?
Business resilience and ransomware
✓ Correct answer
- Apply a governed temporary exception, restrict reachable attack paths, and accelerate an approved remediation plan
Apply a governed temporary exception, restrict reachable attack paths, and accelerate an approved remediation plan: This balances exploitation risk with service safety while retaining ownership and a deadline. Exclude the server permanently from compliance reporting: Hiding the exception removes visibility without reducing risk. Install the patch blindly despite a known unacceptable failure: Ignoring the verified dependency can create a damaging outage. Assume endpoint monitoring has repaired the vulnerable code: Monitoring can detect attacks but does not remove the underlying weakness.
Open this question’s page →23. Which two checks provide evidence that a scheduled update program is effective? Select two answers.
Business resilience and ransomware
✓ Correct answers
- Post-update application health and remaining vulnerability status
- Installation and reboot results for the targeted machines
Actual installation/reboot and post-update health/security results validate effectiveness. Schedules and available-update assessment do not prove application, and excluding failures conceals gaps.
Open this question’s page →24. An emergency security update must be accelerated across revenue-critical services. Which two practices should remain? Select two answers.
Business resilience and ransomware
✓ Correct answers
- Monitoring that can halt expansion when failures occur
- Defined approval and a recoverable rollout with targeted health checks
Defined approval and a recoverable rollout with targeted health checks: Urgency changes timing but does not remove the need for controlled change and recovery. Monitoring that can halt expansion when failures occur: A rapid release still needs evidence and a way to contain deployment impact. Permanent disabling of all release gates: Removing controls beyond the immediate need creates ongoing risk. One unrestricted patching identity shared by all contractors: Broad shared privileges increase the management-plane attack surface. A commitment never to deploy urgent patches outside the normal cadence: A rigid cadence can leave actively exploited critical workloads exposed.
Open this question’s page →25. An architect needs an enterprise reference to compare Microsoft and third-party security capabilities across Azure, on-premises, OT, and AI. Which resource best fits?
MCRA MCSB and Zero Trust
✓ Correct answer
- Microsoft Cybersecurity Reference Architectures
Microsoft Cybersecurity Reference Architectures: MCRA explicitly maps integrated security capabilities across the hybrid technology estate. Only the Well-Architected Cost Optimization pillar: That pillar evaluates workload cost decisions rather than enterprise cybersecurity integration. Only the CAF migration plan: A migration plan organizes adoption activities but is not the required security capability reference. Only a service-specific security baseline: A baseline provides controls for that service, not the complete cross-estate architecture.
Open this question’s page →26. A platform team needs prescriptive cloud security controls and Azure service baselines that can inform posture assessment. Which resource should be its starting point?
MCRA MCSB and Zero Trust
✓ Correct answer
- Microsoft Cloud Security Benchmark
Microsoft Cloud Security Benchmark: MCSB supplies cloud-centric control and baseline guidance. Only an MCRA product capability diagram: The diagram explains relationships but does not replace detailed service control guidance. Only the CAF business strategy phase: Strategy sets organizational direction rather than detailed cloud control baselines. Only a workload performance benchmark: Performance measurements do not define the requested security controls.
Open this question’s page →27. A supplier claims that assigning an MCSB initiative proves complete regulatory compliance. What is the best response?
MCRA MCSB and Zero Trust
✓ Correct answer
- Use the assessment as control evidence and separately validate the required implementation and obligations
Use the assessment as control evidence and separately validate the required implementation and obligations: A control mapping and configuration assessment do not establish complete legal or operational assurance. Accept the claim if every mapped resource is green: Assessment status alone omits unmeasured controls, scope, and operating evidence. Remove all automated assessment because it has no compliance value: Automated assessment can provide useful evidence even though it is not an attestation. Replace the initiative with an MCRA diagram to gain certification: A reference diagram is also guidance and does not certify compliance.
Open this question’s page →28. A security program owns endpoint protection, identity governance, and a SIEM, but a simulated compromised identity reaches sensitive data without triggering coordinated containment. Which architectural action is most appropriate?
MCRA MCSB and Zero Trust
✓ Correct answer
- Map the attack path to controls, verify telemetry and enforcement integrations, and assign response ownership
Map the attack path to controls, verify telemetry and enforcement integrations, and assign response ownership: The gap is in effective end-to-end coverage and response, not merely product ownership. Treat product licenses as proof that the path is covered: Ownership does not establish functioning integration or enforcement. Remove identity controls because endpoint software already exists: The attack path spans identity and data, requiring complementary controls. Increase the SIEM retention period as the sole remedy: Retention helps later investigation but does not by itself add missing containment or authorization.
Open this question’s page →29. Which two are appropriate uses of MCRA? Select two answers.
MCRA MCSB and Zero Trust
✓ Correct answers
- Compare existing capabilities and integrations with recommended coverage
- Define an enterprise target state for cybersecurity capabilities
Define an enterprise target state for cybersecurity capabilities: MCRA provides a starting architecture to adapt to the organization. Compare existing capabilities and integrations with recommended coverage: The reference helps identify missing capabilities and integration gaps. Treat every depicted technology as a mandatory purchase: A reference is adapted to requirements and existing investments. Use it as a substitute for service-specific implementation guidance: Detailed configurations and support requirements still need service documentation. Use it as automatic proof of a legal compliance certification: Architecture guidance does not establish formal attestation.
Open this question’s page →30. An organization adopts MCSB v2 guidance for an AI application. Which two actions are necessary for a defensible architecture? Select two answers.
MCRA MCSB and Zero Trust
✓ Correct answers
- Check current preview status and actual service support for the chosen controls
- Test required security outcomes and keep implementation evidence with responsible owners
Check current preview status and actual service support for the chosen controls: Benchmark recommendations and platform implementation availability are distinct. Test required security outcomes and keep implementation evidence with responsible owners: Control alignment must be demonstrated in the deployed workload. Assume every recommendation has a generally available automated policy: Some controls require application logic, processes, or preview features. Treat policy assignment as proof that agent tools cannot be abused: Agent authorization and runtime behavior require specific enforcement and validation. Omit operational and human controls because the benchmark has cloud guidance: Cloud guidance does not remove organizational responsibilities.
Open this question’s page →31. A security team wants to correlate signals of potentially malicious or accidental employee data leakage while preserving investigation privacy. Which capability fits?
MCRA MCSB and Zero Trust
✓ Correct answer
- Microsoft Purview Insider Risk Management
Insider Risk Management correlates the relevant insider activity with privacy-oriented investigation. DLP alone does not provide the full requested workflow, external inventory misses internal handling, and sign-in risk does not by itself assess employee document behavior.
Open this question’s page →32. An employee with valid access repeatedly exports sensitive documents to an unapproved destination. What is the strongest architectural response?
MCRA MCSB and Zero Trust
✓ Correct answer
- Combine least-privilege review, data-loss controls, and a governed investigation
Combine least-privilege review, data-loss controls, and a governed investigation: Legitimate credentials do not make every data-handling action permitted or safe. Allow the activity automatically because authentication succeeded: Authentication establishes identity, not approval for every data action. Investigate only the external firewall configuration: Perimeter configuration alone misses activity using permitted internal access. Treat backup availability as prevention of disclosure: Recoverability does not prevent exfiltration or its confidentiality consequences.
Open this question’s page →33. A repository accepts external pull requests. Its build runner can also deploy directly into production with a standing credential. Which change best reduces supply-chain impact?
MCRA MCSB and Zero Trust
✓ Correct answer
- Isolate untrusted builds from production credentials and grant release authority only through the approved deployment path
Separate trust/execution and scoped release authority restrict attacker-controlled builds. Encryption is insufficient when untrusted jobs can decrypt, retained logs do not remove deployment privilege, and familiar hosting does not establish trustworthy contributions.
Open this question’s page →34. A production package has a valid signature, but its signing system was compromised before the release. Which conclusion is correct?
MCRA MCSB and Zero Trust
✓ Correct answer
- Signature verification alone is insufficient; protect the signing and release process and evaluate the artifact
Signature verification alone is insufficient; protect the signing and release process and evaluate the artifact: A compromised trusted signing system can produce a valid signature on malicious content. A valid signature proves every dependency is vulnerability-free: Signatures do not establish complete code safety. The package must be safe because its file was not modified after signing: Post-signing integrity does not prove the original signed content was benign. All artifact verification should be abandoned permanently: Verification remains useful within a protected provenance and release process.
Open this question’s page →35. Which two practices address insider-risk investigation without assuming every alert proves malicious intent? Select two answers.
MCRA MCSB and Zero Trust
✓ Correct answers
- Correlate activity and context before deciding an appropriate response
- Use privacy-preserving access controls and audited investigator permissions
Use privacy-preserving access controls and audited investigator permissions: This supports authorized investigation while reducing unnecessary exposure of personal data. Correlate activity and context before deciding an appropriate response: Risk indicators can arise from inadvertent or legitimate behavior as well as malicious actions. Publish all flagged employees to every administrator: Broad disclosure conflicts with privacy-oriented investigation controls. Treat a single risk alert as conclusive proof of deliberate theft: An alert is a signal for assessment, not a final judgment. Disable all logging of investigator activity: Auditing helps govern access and accountability.
Open this question’s page →36. Which two controls directly reduce a compromised CI/CD system's ability to affect production? Select two answers.
MCRA MCSB and Zero Trust
✓ Correct answers
- Limit deployment identity permissions and permitted release contexts
- Require verified artifacts and a protected approval path before production release
Limit deployment identity permissions and permitted release contexts: Restricted authority reduces the resources and workflows an attacker can control. Require verified artifacts and a protected approval path before production release: The release boundary reduces unchecked movement from build inputs to production. Give build jobs production Owner rights to avoid deployment failures: This expands rather than reduces the potential compromise impact. Store the deployment credential in the repository history: Repository disclosure can expose production credentials. Rely only on perimeter filtering around the production web endpoint: Attackers with deployment authority can change the application behind that perimeter.
Open this question’s page →37. A platform allows engineers to deploy arbitrary community AI models without recording their origin or review. Which MCSB AI control most directly addresses this gap?
MCRA MCSB and Zero Trust
✓ Correct answer
- AI-1 use of approved models
AI-1 use of approved models: The gap is model verification, trusted provenance, and deployment approval. Only AI-5 human approval of business actions: Action approval does not establish that the deployed model itself was reviewed. Only AI-6 runtime monitoring: Monitoring is complementary but does not replace model approval before deployment. Only ordinary backup retention: Backup history does not verify model origin or approval.
Open this question’s page →38. A chatbot filters user prompts but also consumes partner webpages and sends generated output to users. Which design best follows layered AI content controls?
MCRA MCSB and Zero Trust
✓ Correct answer
- Validate external content and outputs as well as prompts while retaining independent authorization
Validate external content and outputs as well as prompts while retaining independent authorization: Multiple entry and output paths need safeguards; filtering still does not replace permissions. Trust partner webpages automatically because they are not typed by users: External content can carry indirect prompt injection. Remove output checks because prompt filtering has already run: A filtered input does not guarantee safe output. Give the model more data permissions to reduce false positives: Increasing privileges expands exposure rather than adding content controls.
Open this question’s page →39. An inventory agent is intended to read stock counts, but its API credential can also delete inventory records. Which change most directly implements AI-4?
MCRA MCSB and Zero Trust
✓ Correct answer
- Restrict the agent tool and downstream identity to the required read operations
Independent tool and identity permissions enforce read-only scope. System instructions, logging, and output filtering do not remove the granted destructive API authority.
Open this question’s page →40. A team proposes storing all raw confidential prompts in broadly readable diagnostic logs to improve AI-6 monitoring. What should the architect recommend?
MCRA MCSB and Zero Trust
✓ Correct answer
- Collect sufficient investigation evidence with restricted access, appropriate minimization, and retention
Collect sufficient investigation evidence with restricted access, appropriate minimization, and retention: Monitoring must be useful without creating an uncontrolled secondary sensitive-data store. Grant all developers unrestricted access to every raw interaction: Broad access increases confidentiality and privacy exposure. Disable all AI monitoring to avoid retaining any information: Eliminating monitoring removes needed detection and investigation capability. Assume logs are harmless because they are not the primary database: Copies of sensitive prompts remain sensitive information.
Open this question’s page →41. An agent can make high-impact changes to customer subscriptions. Which two controls align with AI-4 and AI-5? Select two answers.
MCRA MCSB and Zero Trust
✓ Correct answers
- Constrain the agent identity and tool to specifically permitted subscription operations
- Enforce human approval before designated consequential changes are executed
Constrain the agent identity and tool to specifically permitted subscription operations: Least privilege limits what the agent can do independently of its generated instructions. Enforce human approval before designated consequential changes are executed: Approval must guard the action, not merely document it afterward. Allow all operations but add a disclaimer after each change: A disclaimer does not constrain or approve the action. Replace permissions with a safety system prompt alone: Meta-prompts are not an authorization boundary. Log human review only after irreversible changes finish: Post-action review cannot provide the required pre-action checkpoint.
Open this question’s page →42. A previously evaluated AI assistant gains a new external-data connector and write-capable tool. Which two actions should precede wider release? Select two answers.
MCRA MCSB and Zero Trust
✓ Correct answers
- Repeat adversarial tests covering the new content and tool paths
- Revalidate tool permissions, data boundaries, monitoring, and approval requirements
Repeat adversarial tests covering the new content and tool paths: New inputs and capabilities change the attack surface and can invalidate old findings. Revalidate tool permissions, data boundaries, monitoring, and approval requirements: Safety depends on enforcement and visibility across the changed application. Reuse the original evaluation without considering the new connector: The original assessment did not cover the changed input path. Assume a trusted model makes every integration safe: Integration permissions and content introduce independent risks. Remove the old restrictive controls to simplify the new tool: Simplification must not silently broaden authorization.
Open this question’s page →43. A proposed access design trusts every request from the corporate LAN without checking identity or device context. Which Zero Trust principle most directly requires a change?
MCRA MCSB and Zero Trust
✓ Correct answer
- Verify explicitly
Verify explicitly directly addresses the missing identity/context checks. Network-only trust is insufficient, limited permissions do not authenticate the caller, and assumption of compromise does not justify omitting authentication.
Open this question’s page →44. A cloud-administration role is assigned permanently to all developers although only a small group occasionally performs approved changes. Which design better aligns with Zero Trust?
MCRA MCSB and Zero Trust
✓ Correct answer
- Limit eligible roles, scope, activation duration, and approval to the actual administrative need
Limit eligible roles, scope, activation duration, and approval to the actual administrative need: This reduces standing and excessive authority while supporting required work. Keep permanent broad roles and add a policy reminder: A reminder does not constrain authority. Assign a separate broad role to every developer: Different names do not reduce the effective privilege. Require only a corporate network connection: Network context alone does not correct excess permissions.
Open this question’s page →45. A company has bought security products but has no agreed business outcomes or owners for adoption. Which next step is most appropriate?
MCRA MCSB and Zero Trust
✓ Correct answer
- Secure leadership sponsorship, define outcomes, assess maturity, and assign a phased roadmap
Secure leadership sponsorship, define outcomes, assess maturity, and assign a phased roadmap: Adoption requires organizational alignment and measurable implementation. Declare the program complete because the products are licensed: Purchasing capabilities does not establish working controls. Add more dashboards before agreeing who acts on them: Visibility without ownership does not resolve the adoption gap. Use the vendor product list as the entire business strategy: A technology inventory omits outcomes, responsibilities, and change management.
Open this question’s page →46. A service still permits access through an already issued token after a user is disabled. The team assumed every application supports immediate continuous access reevaluation. What should be done?
MCRA MCSB and Zero Trust
✓ Correct answer
- Validate the application's supported token and revocation behavior and design appropriate containment
Supported client/resource and session behavior must be tested. Disablement is not universal instant revocation, future sign-in frequency alone does not establish termination of an existing session, and role eligibility removal does not prove all active tokens are revoked.
Open this question’s page →47. Which two measures help demonstrate Zero Trust adoption rather than simple product deployment? Select two answers.
MCRA MCSB and Zero Trust
✓ Correct answers
- Tests showing unauthorized access is denied under the intended conditions
- Measured reduction of critical attack paths with verified response capability
Denied-access tests and verified attack-path/response outcomes demonstrate behavior. Enabled state can be mis-scoped, one administrator journey does not cover every identity/client, and aggregate scores may conceal critical gaps.
Open this question’s page →48. A compromised administrator is already inside a trusted network. Which two design elements directly reflect assume breach? Select two answers.
MCRA MCSB and Zero Trust
✓ Correct answers
- Segmentation and constrained administrative access between critical systems
- Independent protection of recovery data and recovery authority
Independent protection of recovery data and recovery authority: The organization should retain a recovery path despite production compromise. Segmentation and constrained administrative access between critical systems: These controls restrict lateral movement and the impact of existing compromise. Automatic trust for all traffic originating inside the LAN: Internal origin does not establish safe or authorized access. One shared unrestricted administrator for every service: Shared broad authority increases the compromise blast radius. Removal of investigation telemetry to reduce complexity: Reduced visibility undermines detection and containment.
Open this question’s page →49. A company plans to introduce a customer-service AI assistant. Which first step best supports secure adoption?
CAF Well Architected and secure adoption
✓ Correct answer
- Define use cases, data boundaries, business impact, and accountable owners
Define use cases, data boundaries, business impact, and accountable owners: These requirements determine a suitable approved platform and controls. Select the largest model before documenting data access: Model capacity does not establish the business and security requirements. Grant the assistant tenant-wide data access for its pilot: Broad access increases exposure before boundaries are validated. Treat vendor model approval as approval for every organizational use: A provider decision does not evaluate the organization-specific data and impact.
Open this question’s page →50. A read-only assistant is changed into an agent that updates supplier bank details. Which design change is most important?
CAF Well Architected and secure adoption
✓ Correct answer
- Reassess the new autonomy and enforce scoped tool authorization with independent approval for sensitive changes
Reassess the new autonomy and enforce scoped tool authorization with independent approval for sensitive changes: The new ability changes business state and needs controls outside generated instructions. Retain all original controls because the model is unchanged: Risk changes when tool capability and impact change even with the same model. Allow database administrator access to avoid tool failures: Administrative rights exceed the approved transaction scope. Replace action audit logs with a more detailed system prompt: Instructions do not provide accountability or enforce authorization.
Open this question’s page →51. An AI workload uses private endpoints but its managed identity can read every department database. What is the best finding?
CAF Well Architected and secure adoption
✓ Correct answer
- Network isolation is present, but data permissions must be reduced to the approved workload scope
Network isolation is present, but data permissions must be reduced to the approved workload scope: Private endpoints do not narrow the identity authorization boundary. Private endpoints make the broad identity assignment harmless: An authorized private connection can still access excessive data. Remove identity authentication and embed a shared key in prompts: This weakens credential handling and access governance. Use only content filtering to authorize individual database rows: Content classification does not replace database authorization.
Open this question’s page →52. An AI pilot passes harmful-content tests but produces inconsistent decisions for users with disabilities. What additional evaluation is required?
CAF Well Architected and secure adoption
✓ Correct answer
- Evaluate inclusiveness, fairness, reliability, and the use-case impact with accountable human review
Evaluate inclusiveness, fairness, reliability, and the use-case impact with accountable human review: Responsible AI includes these outcomes alongside privacy and security. Declare the system responsible because its firewall rules passed: Network controls do not evaluate the described decision quality. Restrict evaluation to whether prompts contain credentials: Credential detection does not assess inclusion or fairness. Measure only inference throughput before approving rollout: Performance alone cannot assess responsible AI behavior.
Open this question’s page →53. A platform team approves AI access patterns. Which TWO practices most directly reduce credential and permission exposure? Select TWO.
CAF Well Architected and secure adoption
✓ Correct answers
- Use identity-based authentication instead of keys where supported
- Give each agent only the downstream permissions required for its approved tools
Use identity-based authentication instead of keys where supported: This reduces reliance on stored shared credentials. Give each agent only the downstream permissions required for its approved tools: Least privilege constrains the agent access boundary. Place a shared privileged key in the system prompt: Prompts are not a protected credential store. Let every agent inherit the platform owner role: Owner rights create excessive authority unrelated to task needs. Treat model-provider trust as data-access permission: Model approval does not grant an agent authorization to data.
Open this question’s page →54. An enterprise is preparing an AI rollout involving internal documents and third-party retrieved content. Which THREE checks should be included? Select THREE.
CAF Well Architected and secure adoption
✓ Correct answers
- Evaluate model provenance and the provider against organizational requirements
- Test prompt-injection defenses against user input and external content
- Validate that retrieval enforces approved data-access boundaries
Validate that retrieval enforces approved data-access boundaries: Retrieval must respect authorized scope. Test prompt-injection defenses against user input and external content: Both can carry adversarial instructions. Evaluate model provenance and the provider against organizational requirements: Model approval should account for provider and intended use. Assume a pilot model requires no review after adding production write tools: New autonomy changes risk and needs reassessment. Use a successful deployment as the sole evidence of responsible AI: Resource creation does not validate safety, privacy, fairness, or accountability.
Open this question’s page →55. A CIO needs an organization-wide roadmap covering operating models, an Azure foundation, governance, security, and ongoing operations. Which framework best fits?
CAF Well Architected and secure adoption
✓ Correct answer
- Microsoft Cloud Adoption Framework for Azure
CAF addresses organizational adoption and platform operations. A single workload review, service baseline, and capability diagram are useful inputs but do not supply the whole adoption roadmap.
Open this question’s page →56. A team needs to assess one customer-facing application across security, reliability, cost, operations, and performance. What is the most direct assessment framework?
CAF Well Architected and secure adoption
✓ Correct answer
- Azure Well-Architected Framework
Azure Well-Architected Framework: Its five pillars assess workload quality and tradeoffs. Only CAF Strategy business motivation: That phase establishes enterprise direction rather than the detailed workload review. Only MCRA enterprise capability mapping: MCRA supports integrated cybersecurity architecture but does not replace the five-pillar workload assessment. Only an Azure Policy compliance export: Configuration evidence supports assessment but omits several workload quality dimensions.
Open this question’s page →57. A governance review finds centrally defined logging standards but no team assigned to connect new workload resources or verify collection. What should the architect recommend?
CAF Well Architected and secure adoption
✓ Correct answer
- Define platform and workload control responsibilities and verify onboarding evidence
Owned onboarding and verification close the control gap. A written standard, unowned central collection, and undefined delegation leave responsibility or operation unvalidated.
Open this question’s page →58. An application team proposes aggressive fail-closed dependencies that meet a security requirement but breach a documented availability target during identity outages. What should the architecture review do?
CAF Well Architected and secure adoption
✓ Correct answer
- Evaluate the security and reliability tradeoff and design an approved approach that meets the stated requirements
Evaluate the security and reliability tradeoff and design an approved approach that meets the stated requirements: Well-Architected requires consideration of interacting quality pillars. Ignore reliability because only Security is a Well-Architected pillar: Reliability is also a pillar and the business requirement remains relevant. Disable all authorization permanently to meet availability: This discards the security requirement rather than resolving the tradeoff. Assume a CAF landing zone automatically settles application failure behavior: The workload still needs an explicit design and assessment.
Open this question’s page →59. An organization has completed its first migration. Which THREE CAF phases continue to address control and operation of the environment? Select THREE.
CAF Well Architected and secure adoption
✓ Correct answers
- Manage
- Govern
- Secure
Govern controls the Azure environment, Secure protects it, and Manage operates and optimizes it. Plan prepares the organization for adoption and Ready designs the landing-zone foundation; these are real CAF phases, but not the three phases most directly addressing ongoing control and operation.
Open this question’s page →60. A company is evaluating its current security strategy with CAF and Well-Architected. Which TWO assessment activities are most appropriate? Select TWO.
CAF Well Architected and secure adoption
✓ Correct answers
- Assess workload security choices against the other four quality pillars
- Check whether the enterprise foundation and operating responsibilities support workload teams
Check whether the enterprise foundation and operating responsibilities support workload teams: CAF addresses organizational standards and the platform foundation. Assess workload security choices against the other four quality pillars: Well-Architected evaluates workload quality and tradeoffs. Conclude that deploying a landing zone proves every application is secure: Workload-specific security still needs implementation and validation. Rank designs solely by the number of purchased security products: Product count is not evidence of required security outcomes. Remove workload owners from reviews because all security is centralized: Central guardrails and workload responsibilities must work together.
Open this question’s page →61. An architect needs to prevent creation of Azure resources in unapproved regions. Which control most directly matches?
CAF Well Architected and secure adoption
✓ Correct answer
- An Azure Policy deny assignment for the allowed-location requirement
An Azure Policy deny assignment for the allowed-location requirement: Policy can enforce the applicable resource configuration boundary. A Reader role assignment for the deployment identity: Reader limits actions but does not define which regions are allowed for authorized deployers. A billing tag documenting the preferred region: A tag alone does not prevent a deployment. A policy audit assignment with no enforcement change: Audit reports violations without blocking the matching request.
Open this question’s page →62. A team assigns a deployIfNotExists diagnostic-settings policy to a subscription. Existing resources remain noncompliant. What should it check first?
CAF Well Architected and secure adoption
✓ Correct answer
- Remediation task execution and the assignment identity permissions required to deploy the settings
Existing-resource remediation requires a task and authorized assignment identity. The creator’s role does not replace the remediation identity, Deny does not deploy missing settings retroactively, and Audit reports without deployment.
Open this question’s page →63. A legacy application needs a temporary exception to one baseline requirement. What is the best governance response?
CAF Well Architected and secure adoption
✓ Correct answer
- Approve a scoped, documented exemption with compensating controls, ownership, and an expiry or review date
Approve a scoped, documented exemption with compensating controls, ownership, and an expiry or review date: This preserves the baseline while governing the particular risk. Remove the baseline assignment from the whole management group: This weakens control for unrelated workloads. Move the application outside monitoring without recording why: That hides risk and creates an accountability gap. Give the application Owner on every subscription: More access does not address the configuration requirement.
Open this question’s page →64. A workload is compliant with every assigned Azure Policy rule, but a service identity cannot query its database. What should the architect explain?
CAF Well Architected and secure adoption
✓ Correct answer
- Configuration compliance does not grant database authorization; assign the required supported data-access permissions
Configuration compliance does not grant database authorization; assign the required supported data-access permissions: Policy and access authorization serve different purposes. Policy compliance should automatically grant all data-plane rights: It does not establish a principal entitlement to query data. Disable database authentication because Policy is already green: This removes a necessary control. Apply an extra audit policy to grant SQL query rights: Audit assesses configuration rather than granting query permissions.
Open this question’s page →65. A platform team needs consistent security governance across many subscriptions. Which TWO recommendations fit? Select TWO.
CAF Well Architected and secure adoption
✓ Correct answers
- Group related requirements in policy initiatives and assign at suitable hierarchy scopes
- Stage enforcement changes and validate their impact on representative workloads
Group related requirements in policy initiatives and assign at suitable hierarchy scopes: This supports consistent control application and assessment. Stage enforcement changes and validate their impact on representative workloads: This reduces unintended deployment or operational failures. Use tags as a replacement for all authorization decisions: Tags do not provide the required principal access boundary. Treat noncompliance reports as proof that deny enforcement already runs: Reporting and enforcement effects differ. Give exemptions indefinite scope without an accountable owner: Exceptions require governance and review.
Open this question’s page →66. A security strategy uses CAF standards and Well-Architected reviews. Which THREE elements turn a recommendation into an operational control? Select THREE.
CAF Well Architected and secure adoption
✓ Correct answers
- Repeatable implementation through governed deployment patterns
- Evidence that the expected control outcome actually occurs
- A named owner and remediation process
A named owner and remediation process: Accountability turns findings into work. Repeatable implementation through governed deployment patterns: Consistent deployment reduces configuration drift. Evidence that the expected control outcome actually occurs: Testing and monitoring validate implementation. A diagram with no implementation or operating responsibility: A diagram alone does not operate the control. A high posture score used to waive all workload threat assessments: A score is a useful signal rather than complete workload assurance.
Open this question’s page →67. An enterprise wants consistent governance and shared connectivity while giving application teams scoped control of their resources. Which architecture best fits?
CAF Well Architected and secure adoption
✓ Correct answer
- A platform landing zone with governed workload landing zones
A platform landing zone with governed workload landing zones: This combines shared foundation controls with workload ownership. One unrestricted subscription where all teams are Owners: This removes the requested ownership and authority boundaries. Independent subscriptions with no common governance structure: That lacks the required consistent guardrails. Only separate billing tags for production resources: Tags do not establish platform services or access boundaries.
Open this question’s page →68. A workload subscription inherits policies from its parent management group. A developer asks to bypass the controls by creating a new resource group. What should the architect explain?
CAF Well Architected and secure adoption
✓ Correct answer
- Changing the resource group does not remove applicable inherited policy assignments
Changing the resource group does not remove applicable inherited policy assignments: The subscription and applicable descendant resources remain under the hierarchy scope. A new resource group automatically cancels management-group policy: Inheritance is not cancelled by that resource organization change. Resource-group creation grants tenant-wide policy administrator authority: It does not grant that access. All policies apply only to the management-group object itself: Applicable assignments govern descendant subscriptions and resources.
Open this question’s page →69. New application subscriptions are created manually and often lack diagnostic settings and baseline assignments. Which improvement most directly addresses the recurring gap?
CAF Well Architected and secure adoption
✓ Correct answer
- A governed subscription-vending process with automated baseline deployment and verification
Vending makes creation and baseline onboarding repeatable and verifiable. Naming does not configure controls, undefined delegation retains inconsistency, and one accelerator run does not ensure future subscription compliance.
Open this question’s page →70. A landing-zone accelerator deployment succeeded. Its designers claim no further security work is needed for a new AI agent workload. What is the best response?
CAF Well Architected and secure adoption
✓ Correct answer
- Validate the platform and add the workload-specific model, data, identity, and tool controls
Validate the platform and add the workload-specific model, data, identity, and tool controls: The foundation supports the workload but does not prove its individual security outcomes. Accept the claim because deployment success proves authorization works: Resource deployment does not validate agent and data access. Move the agent outside the landing-zone hierarchy to avoid AI governance: New technology still needs common guardrails and additional applicable controls. Give the agent platform-wide Owner so it can handle any workload dependency: This violates scope and least privilege.
Open this question’s page →71. Which TWO responsibilities normally belong to the platform landing-zone foundation? Select TWO.
CAF Well Architected and secure adoption
✓ Correct answers
- Define the management-group hierarchy and common governance guardrails
- Provide approved shared connectivity and security-monitoring capabilities when justified
Hierarchy/guardrails and justified shared services belong to the foundation. Application authorization and workload operations still need workload owners; the platform does not justify unrestricted shared access.
Open this question’s page →72. A company plans to expand its landing-zone model. Which THREE design choices support governed scale? Select THREE.
CAF Well Architected and secure adoption
✓ Correct answers
- Place subscriptions in a suitable hierarchy to inherit common requirements
- Provide repeatable workload subscription requests and distribution
- Scope workload-team authority to its approved resources
Place subscriptions in a suitable hierarchy to inherit common requirements: Inheritance supports consistent governance. Provide repeatable workload subscription requests and distribution: Subscription vending scales onboarding. Scope workload-team authority to its approved resources: Scoped access separates workload and shared-platform control. Allow workload administrators to remove central guardrails without review: This defeats the governance foundation. Assume network peering automatically routes every path through a central firewall: Inspection needs an explicit routing and path design.
Open this question’s page →73. A team runs vulnerability tests only on release day and often discovers architectural authorization defects too late. Which process improvement is most appropriate?
CAF Well Architected and secure adoption
✓ Correct answer
- Embed threat modeling and security requirements early, then validate through build, release, and runtime
Embed threat modeling and security requirements early, then validate through build, release, and runtime: This integrates security throughout delivery rather than only at the end. Move all security decisions to the final production approval meeting: That retains the late discovery problem. Treat successful compilation as proof of safe authorization: Compilation does not validate application access boundaries. Remove developers from remediation ownership: DevSecOps requires development engagement and accountable fixes.
Open this question’s page →74. A delivery pipeline uses a long-lived Owner secret shared between test and production. Which replacement best reduces exposure?
CAF Well Architected and secure adoption
✓ Correct answer
- Separate scoped deployment identities with supported federation and restrictions on the authorized workflow or environment
Separate scoped deployment identities with supported federation and restrictions on the authorized workflow or environment: This removes shared standing secrets and constrains authority. Store the same Owner secret in an encrypted repository file that all test jobs can decrypt: Shared access still lets test jobs obtain production authority. Give all build agents tenant-wide administrator rights: This increases privilege rather than reducing it. Keep the shared secret and rely only on application SAST: Code scanning does not constrain deployment credentials.
Open this question’s page →75. A critical API uses vulnerable third-party packages. Which test category most directly identifies known dependency issues?
CAF Well Architected and secure adoption
✓ Correct answer
- Software composition analysis
SCA focuses on components and known dependency vulnerabilities. First-party static analysis, runtime behavior testing, and IaC scanning evaluate different surfaces and do not replace dependency inventory/security analysis.
Open this question’s page →76. A release gate detects a confirmed exploitable dependency vulnerability in a critical service. A patch is available, but compatibility testing finds a serious outage risk. What is the best DevSecOps response?
CAF Well Architected and secure adoption
✓ Correct answer
- Assign an owner, restrict the exposure, and use a time-bound approved exception while accelerating a tested fix
Owned mitigation, a scoped exception, and a tested fix balance exploitation and service risk. Permanent gate removal creates recurring exposure, signatures do not remove code flaws, and an indefinite unowned block lacks a managed remediation process.
Open this question’s page →77. Which THREE controls help protect the path from developer work to production deployment? Select THREE.
CAF Well Architected and secure adoption
✓ Correct answers
- Security findings with accountable remediation and risk-based release gates
- Least-privilege deployment access separated by environment
- Protected branches with peer review and governed workflow changes
Protected branches with peer review and governed workflow changes: These reduce unauthorized source and release modifications. Least-privilege deployment access separated by environment: This limits the effect of compromised automation. Security findings with accountable remediation and risk-based release gates: These make checks actionable. Production secrets available to every pull-request test job: This exposes production authority to less-trusted execution. An assumption that runtime monitoring is unnecessary after a clean scan: Pre-release scanning cannot establish future runtime safety.
Open this question’s page →78. A secret scanner detects a production credential committed to a repository. Which TWO immediate responses are required to address the exposure? Select TWO.
CAF Well Architected and secure adoption
✓ Correct answers
- Revoke or rotate the exposed credential through the owning service
- Remove the secret from the workflow and remediate its storage pattern
Rotation/revocation invalidates exposed authority and safe storage prevents recurrence. Deleting one line leaves history/copies, private repository exposure is still credential compromise risk, and waiting for every clone delays invalidation.
Open this question’s page →79. Which capability is the strongest reason to combine Sentinel with Defender XDR?
Security operations detection and response
✓ Correct answer
- Correlating third-party network logs with XDR incidents
Sentinel expands data scope to third-party sources. Log ingestion does not replace endpoint sensors, correlation does not grant or restrict application rights, and no detector guarantees complete threat visibility.
Open this question’s page →80. After XDR integration, the SOC receives two incident records for the same component alerts. What should it inspect first?
Security operations detection and response
✓ Correct answer
- Overlapping incident-creation rules and connector paths
Overlapping creation paths can produce two incidents for correlated alerts. Shorter raw-event retention affects evidence availability, ownership automation changes handling rather than creating the duplicate correlation path, and raw-table selection is distinct from incident duplication.
Open this question’s page →81. An automation rule stops matching after XDR incident integration because incident names change. Which redesign is best?
Security operations detection and response
✓ Correct answer
- Match suitable tags or stable incident properties
Tags or suitable stable properties avoid dependence on correlation-generated titles. Manual renaming is fragile, duplicate creation reintroduces noise, and an empty owner does not identify the intended attack class.
Open this question’s page →82. A Sentinel query against DeviceTvmSoftwareVulnerabilities returns no rows although Defender advanced hunting has results and incident synchronization works. What should the architect verify first?
Security operations detection and response
✓ Correct answer
- Whether that raw table is supported for Sentinel ingestion
Verify supported raw-table ingestion first: TVM tables can appear in the Sentinel schema without ingested data. Incident synchronization does not copy every advanced-hunting table, selecting a schema table does not enable collection, and longer retention cannot create unsupported or uncollected data.
Open this question’s page →83. A SOC connects Sentinel to Defender XDR. Which two checks directly validate coordinated incident handling? Select two.
Security operations detection and response
✓ Correct answers
- Test status and owner synchronization
- Confirm associated alerts and entities arrive
Arriving context and synchronized status/owner validate the integration. Raw-table coverage is separate, deleting source incidents damages investigation, and Global Administrator is excessive and does not verify synchronization.
Open this question’s page →84. A SOC receives Defender for Cloud incidents through XDR but lacks details and sees duplicates from an older subscription connector. Which two design changes best fit documented integration behavior? Select two.
Security operations detection and response
✓ Correct answers
- Remove overlapping legacy alert and incident-creation paths
- Enable the tenant-based Defender for Cloud alert/entity connector
The tenant-based connector supplies synchronized cloud alert/entity details, and removing legacy overlap prevents duplicates. A title omits evidence, broad Owner permissions are unnecessary, and empty details indicate an integration gap rather than absence of alerts.
Open this question’s page →85. Investigators need a searchable record of user operations across Exchange and SharePoint. Which service fits?
Security operations detection and response
✓ Correct answer
- Microsoft Purview Audit
Purview Audit records supported user operations. Policy evaluates resource configurations, PIM controls privileged activation, and route tables direct network traffic rather than preserving these audit operations.
Open this question’s page →86. A team assumes Audit Standard preserves new user records for one year. Which correction is appropriate?
Security operations detection and response
✓ Correct answer
- Standard defaults to 180 days; assess Premium and applicable policies for longer retention
Standard defaults to 180 days. It is not indefinite; content labels and administrator roles do not establish audit retention duration or retroactively extend committed records.
Open this question’s page →87. Legal counsel needs ten years of user audit records beginning now. What is the best design?
Security operations detection and response
✓ Correct answer
- Verify the required per-user add-on and configure a ten-year policy for the covered records
Ten-year audit retention needs the add-on and matching policy. Standard is insufficient, document retention governs content rather than audit records, and Premium alone does not grant the ten-year entitlement.
Open this question’s page →88. A ten-year retention policy is assigned to a service principal, but its non-user audit records still show a one-year lifetime. What explains this?
Security operations detection and response
✓ Correct answer
- Non-user-entity audit records have fixed one-year retention and custom policies do not apply
Non-user records have fixed one-year retention under the documented exception. A sponsor’s user license does not transfer that user retention entitlement, custom policies do not apply to these records, and Premium does not make every record ten-year.
Open this question’s page →89. Which two characteristics distinguish Audit Premium from Standard? Select two.
Security operations detection and response
✓ Correct answers
- High-value intelligent insights
- Custom audit log retention policies
Premium adds custom retention and intelligent insights. Licensing and scope still matter, auditing observes activity rather than replacing authorization, and product use does not certify legal compliance.
Open this question’s page →90. A company wants long-term SIEM evidence and must investigate a specific mailbox read. Which two planning actions address these needs? Select two.
Security operations detection and response
✓ Correct answers
- Validate the needed high-value audit events and user licensing
- Design supported API collection with independent destination retention
Validate event availability/licensing and supported collection into a retained destination. Expired records cannot be recovered by a new policy, incident summaries omit audit detail, and broad search access exposes sensitive evidence.
Open this question’s page →91. Which technology collects guest operating-system telemetry from an Arc-enabled non-Azure server?
Security operations detection and response
✓ Correct answer
- Azure Monitor Agent
Azure Monitor Agent collects guest telemetry. Access packages govern access, retention labels govern content, and assigning a role alone installs no telemetry collector.
Open this question’s page →92. An AWS VM sends system logs, but the SOC cannot see IAM policy changes. What is missing?
Security operations detection and response
✓ Correct answer
- AWS account audit-log ingestion through the appropriate Sentinel connector
IAM policy changes belong to the AWS control plane. Repeating guest collection or enlarging its buffer does not collect CloudTrail; PIM for the VM owner does not ingest AWS audit events.
Open this question’s page →93. An application runs across Azure and GCP hosts and needs request-level tracing. Which design is appropriate?
Security operations detection and response
✓ Correct answer
- Instrument it with Application Insights SDKs
Application Insights instrumentation captures request traces. Host metrics lack request-level context, provider audits describe control-plane activity, and Arc management alone does not instrument application requests.
Open this question’s page →94. An architect wants one data path for CloudTrail, guest Windows events, and proprietary REST logs. Which evaluation is sound?
Security operations detection and response
✓ Correct answer
- Use source-appropriate connectors, agents, and ingestion API paths into a coordinated workspace
Different source types need appropriate paths. Arc guest monitoring does not automatically collect all cloud API audits, a REST source requires an integration, and Update Manager performs patch assessment and installation.
Open this question’s page →95. Which two pairings are correct for multicloud monitoring? Select two.
Security operations detection and response
✓ Correct answers
- AWS/GCP audit logs: Sentinel connectors
- VM guest telemetry: Azure Monitor Agent and data collection rules
Agent/rules collect guest telemetry and connectors ingest provider audit data. Windows events alone do not collect CloudTrail, IAM audits do not instrument request execution, and collection rules do not install updates.
Open this question’s page →96. A multicloud monitoring plan covers VMs and cloud audits but omits custom business events and Kubernetes metrics. Which two additions fit? Select two.
Security operations detection and response
✓ Correct answers
- Use Logs Ingestion API for supported custom REST log data
- Use appropriate Container insights or Prometheus collection for clusters
The ingestion API handles custom log integration and cluster-specific monitoring handles Kubernetes telemetry. VM metrics omit cluster and business context, access reviews assess entitlement justification, and duplicating CloudTrail does not create cluster metrics.
Open this question’s page →97. A SOC wants new incidents assigned and tagged without external API calls. Which capability fits directly?
Security operations detection and response
✓ Correct answer
- Sentinel automation rules
Automation rules perform basic incident handling. Storage retention preserves data, routes direct traffic, and authentication strength controls sign-in methods rather than assigning incidents.
Open this question’s page →98. A response must open an ITSM ticket and query an external reputation service. What should an automation rule invoke?
Security operations detection and response
✓ Correct answer
- A Logic Apps playbook
A playbook can call ITSM and enrichment APIs. A workbook visualizes, a scheduled detection query does not itself execute those API workflows, and tagging alone cannot perform the required integration.
Open this question’s page →99. A playbook is triggered but fails when attempting an endpoint action. What should be checked first?
Security operations detection and response
✓ Correct answer
- The workflow connector identity’s permission for that action
The connector identity needs authorization for endpoint action. Incident-view permission does not necessarily grant workflow execution rights, query thresholds concern detection, and tags do not authorize connector API calls.
Open this question’s page →100. A playbook adds a tag, the update triggers the same rule, and duplicate tickets are created. Which redesign best addresses the cause?
Security operations detection and response
✓ Correct answer
- Use conditions and an execution marker that prevent reprocessing the same incident action
Conditions and an execution marker prevent recursive reprocessing. Increasing severity does not stop the loop, deleting history removes evidence, and more permissions do not fix trigger logic.
Open this question’s page →101. Which two components are essential for a safe production-disabling playbook? Select two.
Security operations detection and response
✓ Correct answers
- A narrowly authorized workflow identity
- An appropriate business approval and failure path
Least privilege and approval/failure handling constrain impact. Broad analyst rights, absent failure evidence, and indiscriminate triggering increase risk rather than ensure safe response.
Open this question’s page →102. A SOC must enrich alerts immediately but reserve destructive containment for confirmed incidents. Which two design choices align? Select two.
Security operations detection and response
✓ Correct answers
- Use incident conditions and approvals for high-impact containment
- Use alert-triggered automation for appropriately scoped enrichment
Alert-triggered rules support enrichment while incident criteria/approval govern impact. Workbooks are not unrestricted response engines, uniform destruction ignores context, and silent failure is not a containment strategy.
Open this question’s page →103. Which statement best describes proactive hunting?
Security operations detection and response
✓ Correct answer
- Testing a threat hypothesis against available data
Hunting tests hypotheses for undetected threats. Alert waiting is reactive, temporary roles concern access, and archiving alone provides no analysis.
Open this question’s page →104. A hunt finds a rare process on a developer machine but no confirmed compromise. What should happen next?
Security operations detection and response
✓ Correct answer
- Investigate execution and related entity context before escalating
Rarity warrants contextual investigation. Universal isolation is disproportionate, rarity is not proof, and omitting evidence prevents reasoned validation.
Open this question’s page →105. An analyst switches from Sentinel-specific hunting to unified Advanced hunting and cannot find bookmarks. Which explanation fits?
Security operations detection and response
✓ Correct answer
- Bookmarks are not available in unified Advanced hunting; preserve context through supported alternatives
The experiences have different bookmark support. Global Administrator is not the explanation, disappearance from that interface does not prove deletion, and incident count is unrelated.
Open this question’s page →106. A hunt validates a repeatable attack pattern, but no scheduled rule detects it. What is the best improvement?
Security operations detection and response
✓ Correct answer
- Create and test an analytics rule from the validated behavior with suitable scope and tuning
A tested analytics rule operationalizes repeatable behavior. Repeated manual hunts leave the detection gap, alerting indiscriminately increases noise, and an indicator alone may miss behavior that does not depend on a stable IOC.
Open this question’s page →107. Which two outputs can a completed Sentinel hunt produce? Select two.
Security operations detection and response
✓ Correct answers
- An incident supported by investigation evidence
- A new analytics rule
Hunts can create incidents and rules. They do not certify legal compliance, replace endpoint sensors, or justify stopping the evidence collection they need.
Open this question’s page →108. A hunt shows no matching events during a period when the required source stopped sending logs. Which two conclusions are justified? Select two.
Security operations detection and response
✓ Correct answers
- Collection health should be restored and relevant evidence reconsidered
- The telemetry gap limits confidence in the hypothesis outcome
Missing telemetry weakens the test and calls for restored collection/reassessment. An empty result under a data gap disproves neither the threat nor proves complete coverage; benign classification needs evidence.
Open this question’s page →109. What is the architectural purpose of mapping detections to ATT&CK?
Security operations detection and response
✓ Correct answer
- Expose coverage and gaps for relevant adversary techniques
ATT&CK mappings help evaluate behavior coverage. They neither certify compliance nor assign permissions, and mapped rules still require source evidence.
Open this question’s page →110. The MITRE map shows an active rule for a technique, but its data connector has stopped. What should the SOC conclude?
Security operations detection and response
✓ Correct answer
- The mapping alone does not establish effective detection coverage
Effective coverage depends on working data and logic. Color or additional tags cannot replace telemetry, and adversary behavior remains relevant during an outage.
Open this question’s page →111. A factory wants OT-specific incidents mapped to ICS techniques. What should it add to alert streaming?
Security operations detection and response
✓ Correct answer
- The Defender for IoT Sentinel solution’s relevant content
The solution includes OT analytics, workbooks, playbooks, and ICS mappings. Enterprise endpoint rules alone miss OT context, access packages govern access, and blanket benign classification destroys detection value.
Open this question’s page →112. A security report claims complete protection because every Enterprise matrix cell has a mapped rule. Which challenge is strongest?
Security operations detection and response
✓ Correct answer
- Require evidence of relevant telemetry, tested logic, and applicable Mobile/ICS coverage
A mapped rule is not proof of effective detection or coverage of other environments. Recounting and names add no behavioral evidence; ignoring difficult dependencies preserves blind spots.
Open this question’s page →113. Which two checks turn a mapping into meaningful detection assurance? Select two.
Security operations detection and response
✓ Correct answers
- Verify the rule’s required data sources
- Safely test representative attack behavior
Data and behavioral testing validate capability. Templates may be inactive, tags do not prevent attacks, and deleting useful unmapped rules merely manipulates presentation.
Open this question’s page →114. An organization has desktops, mobile devices, and a plant. Which two design actions best support coverage evaluation? Select two.
Security operations detection and response
✓ Correct answers
- Use matrix and telemetry assumptions appropriate to each environment
- Coordinate ICS response testing with OT owners
Environment-specific matrices/data and OT coordination make evaluation relevant and safe. Desktop results do not prove other coverage, alert count ignores quality, and indiscriminate shutdown can harm physical operations.
Open this question’s page →115. A background agent accesses a resource with no signed-in human. Which policy subject fits its app-only token?
Identity authentication and access
✓ Correct answer
- The agent identity
The app-only token subject is the agent identity. A report viewer is not represented, ordinary-user scope does not cover it, and a subnet is not its identity subject.
Open this question’s page →116. An agent uses both app-only access and a linked mailbox user account. Which design covers both subjects?
Identity authentication and access
✓ Correct answer
- Separate policies targeting agent identities and Agent Users
The identity and linked account are separate subjects needing their own scope. Blueprint policies cover identities, ordinary Users policies exclude agent users, and sponsor targeting does not protect the agent’s own tokens.
Open this question’s page →117. A team says its agent’s API-key calls are protected by an Entra agent policy. What is the flaw?
Identity authentication and access
✓ Correct answer
- API-key calls bypass Entra’s token pipeline
API-key access bypasses Entra evaluation. Keys do not become user tokens, group targeting does not change the authentication path, and the API still needs its own credential and authorization controls.
Open this question’s page →118. A policy targets all agents created by a blueprint. A new linked agent user account can still sign in outside its constraints. What is the best diagnosis?
Identity authentication and access
✓ Correct answer
- Blueprint scope covers agent identities, so explicitly target the agent user account
Blueprint scope includes future agent identities but not linked agent user accounts. Password sharing weakens security, and removing audience validation would admit inappropriate tokens rather than correct policy scope.
Open this question’s page →119. Which two statements correctly describe agent token evaluation? Select two.
Identity authentication and access
✓ Correct answers
- OBO tokens represent a user and identify the calling agent
- Each target resource requires an appropriate token audience
Delegated tokens represent the user/caller and must fit the audience. Tokens are not universally reusable, linked subjects do not inherit each other’s policies, and autonomous app-only flows have no human to complete interactive MFA.
Open this question’s page →120. An agent accesses a user’s files through OBO and its own mailbox through a linked account. Which two policy decisions are correct? Select two.
Identity authentication and access
✓ Correct answers
- Explicitly target Agent Users for the mailbox account
- Apply relevant user-targeted policies to the OBO resource request
OBO evaluates the represented user and linked-account access evaluates Agent Users. Blueprint-only coverage misses these subjects, current group scoping is unsupported, and keys bypass Conditional Access.
Open this question’s page →121. A user signs in through Entra SSO to a SaaS app. What still controls which business records the user may edit?
Identity authentication and access
✓ Correct answer
- The application’s authorization and role model
The application role/permission model governs record editing. First-factor authentication and MFA establish authentication assurance; tenant integration alone does not authorize every user action.
Open this question’s page →122. A PaaS service is privately reachable but every internal workload can read sensitive data. Which layer needs attention?
Identity authentication and access
✓ Correct answer
- Data-plane identity and authorization
Data authorization must limit which workloads can read the data. Private reachability, transport encryption, and a compliant-device sign-in each protect a different boundary and do not independently reduce the granted data permissions.
Open this question’s page →123. A workload running in another cloud needs to call an Entra-protected API without a stored client secret. Which approach should be evaluated?
Identity authentication and access
✓ Correct answer
- Supported workload identity federation with limited API permissions
Federation can remove reusable credentials while resource permissions constrain access. Password sharing and broad roles increase risk; network location is not sufficient identity proof.
Open this question’s page →124. An architect claims Entra federation into a third-party cloud enforces least privilege automatically. What should be validated?
Identity authentication and access
✓ Correct answer
- Native role mappings and effective cloud permissions after sign-in
Federated authentication does not prove narrow native permissions. Redirect success establishes the sign-in path, region concerns placement, and mailbox retention does not govern the third-party role.
Open this question’s page →125. Which two controls jointly address private PaaS access? Select two.
Identity authentication and access
✓ Correct answers
- Appropriate private network reachability
- Least-privileged data-plane authorization
Network reachability and data authorization protect different boundaries. Shared accounts weaken accountability, IP-only trust omits identity, and display-name conventions do not enforce access.
Open this question’s page →126. A hybrid application is exposed through a modern access gateway but retains a privileged local account after staff departure. Which two validations are needed? Select two.
Identity authentication and access
✓ Correct answers
- Verify local/application deprovisioning and permissions
- Test gateway and direct access paths for the departed identity
The application lifecycle and both mediated/direct paths must be tested. Gateway sign-in does not necessarily delete local accounts, encryption does not reduce rights, and disabling logs weakens accountability.
Open this question’s page →127. Which hybrid authentication method validates cloud password sign-in without a live on-premises authentication path?
Identity authentication and access
✓ Correct answer
- Password hash synchronization
PHS enables cloud validation. PTA, federation, and an AD FS proxy all retain a live dependency on their on-premises sign-in infrastructure.
Open this question’s page →128. A PTA deployment has one agent and no fallback. Which risk is most direct?
Identity authentication and access
✓ Correct answer
- Loss of that agent can interrupt cloud password authentication
PTA depends on available agents. It does not imply clear-text cloud storage, grant Azure Owner, or remove application authorization requirements.
Open this question’s page →129. A federation design has no requirement unavailable in managed authentication. What should the architect evaluate?
Identity authentication and access
✓ Correct answer
- Whether PHS meets requirements with fewer live infrastructure dependencies
PHS can reduce dependency and complexity where it meets requirements. More rules can add complexity, removing synchronization does not remove authentication risk, and broad admin rights are excessive.
Open this question’s page →130. A federated tenant enables PHS but never tests the switch-over procedure. What should be concluded?
Identity authentication and access
✓ Correct answer
- The alternate credential capability alone does not demonstrate operational recovery
Recovery requires planned and tested operation. Enabling PHS is not proof of universal automatic fallback; federation keys remain critical and synchronized hybrid identities remain security-sensitive.
Open this question’s page →131. Which two are valid hybrid authentication planning concerns? Select two.
Identity authentication and access
✓ Correct answers
- A tested recovery or fallback strategy
- Availability of agents or federation infrastructure
Authentication dependencies and tested recovery matter. The choice does not assign application permissions, synchronization servers influence trust, and a diagram alone does not validate recovery.
Open this question’s page →132. An organization needs resilient cloud authentication while retaining on-premises identity synchronization. Which two statements are correct? Select two.
Identity authentication and access
✓ Correct answers
- Synchronization infrastructure must still be protected and recoverable
- PHS can remove the live on-premises password-validation dependency
Cloud password validation can use PHS while synchronization remains critical. PHS does not remove source-directory responsibilities; PTA retains live dependency, and compromised source identities can still affect hybrid security.
Open this question’s page →133. Which setting governs a partner’s users entering your tenant’s resources?
Identity authentication and access
✓ Correct answer
- Inbound cross-tenant access settings
Inbound settings govern external entry. Outbound settings govern your users going elsewhere; locks and storage lifecycle rules do not establish partner identity access policy.
Open this question’s page →134. A partner’s MFA is trusted, but a guest cannot open a business application. What should be checked next?
Identity authentication and access
✓ Correct answer
- The guest’s application assignment and resource authorization
Application assignments and resource authorization are separate from trusting the partner’s MFA. Repeating MFA cannot create rights, another partner’s inbound settings do not apply, and your employees’ outbound settings govern a different direction.
Open this question’s page →135. A company wants to control employees accessing partner resources with company identities. Which direction is relevant?
Identity authentication and access
✓ Correct answer
- Outbound cross-tenant access
Outbound controls apply to your organizational identities accessing external organizations. Inbound is the reverse direction; locks and content retention do not govern that identity path.
Open this question’s page →136. A Verified ID presentation proves a professional qualification. What must the application do before granting a privileged operation?
Identity authentication and access
✓ Correct answer
- Validate trusted credential evidence and apply its own authorization policy
The verifier validates evidence and the application decides authorization. Displayed claims are not unrestricted roles, password sharing defeats the credential model, and removing resource checks overgrants access.
Open this question’s page →137. Which two statements correctly separate B2B trust and authorization? Select two.
Identity authentication and access
✓ Correct answers
- Inbound trust can accept supported external MFA/device claims
- Resource assignments still determine granted access
Inbound claim trust affects authentication assurance while assignments govern rights. Outbound is the wrong direction, lifecycle governance remains necessary, and verified claims are not automatic directory roles.
Open this question’s page →138. A partner onboarding design uses Verified ID and a three-month project access package. Which two controls are still required? Select two.
Identity authentication and access
✓ Correct answers
- Validate the credential’s trusted issuer and presentation evidence
- Apply approved package assignments and expiry/review policy
Credential validation establishes evidence; access-package policy governs rights/lifecycle. A credential does not justify broad permanent roles or prevent all misuse, and a valid external account does not imply ongoing project authorization.
Open this question’s page →139. Which signal expresses the probability that a specific sign-in request is unauthorized?
Identity authentication and access
✓ Correct answer
- Sign-in risk
Sign-in risk estimates request compromise. User risk evaluates the account more broadly, compliance evaluates the device’s configuration, and authentication strength describes allowed methods rather than an estimated compromise probability.
Open this question’s page →140. A user satisfies password plus SMS MFA but is blocked by a phishing-resistant strength policy. Why?
Identity authentication and access
✓ Correct answer
- The completed method does not meet the required authentication strength
Authentication strength restricts allowed methods. Ordinary MFA need not meet phishing resistance; the policy does not inherently remove an app role or change token audience.
Open this question’s page →141. A disabled user retains access to an unsupported application until its session ends. What is the sound assessment?
Identity authentication and access
✓ Correct answer
- CAE support and application session behavior must be evaluated
CAE is bounded by compatible clients/resources; unsupported apps need their session behavior assessed. It is not universal instant revocation, disablement does not delete data, and tags do not revoke tokens.
Open this question’s page →142. An administrator has an active role but must satisfy stronger checks when deleting a sensitive directory configuration. Which capability targets that moment?
Identity authentication and access
✓ Correct answer
- Protected actions using authentication context
Protected actions impose checks on supported sensitive operations. PIM eligibility controls activation rather than every action, longer token life weakens rechecking, and mailbox retention does not guard directory operations.
Open this question’s page →143. Which two statements are correct about risk and access? Select two.
Identity authentication and access
✓ Correct answers
- Sign-in risk and user risk assess different compromise questions
- Risk-based user policies require relevant premium licensing
The risk scopes differ and licensing matters. Risk does not grant authorization, MFA does not disinfect devices, and remediation support varies—for example current adaptive user-risk remediation excludes guests.
Open this question’s page →144. A tenant combines PIM, protected actions, and CAE. Which two separations are valid? Select two.
Identity authentication and access
✓ Correct answers
- CAE reaction depends on the resource/client support
- Role activation and action-time protection address different moments
Activation and action-time checks differ; CAE depends on support. PIM does not satisfy every action requirement, CAE does not reduce assigned rights, and Conditional Access has no priority rule that overrides an applicable block.
Open this question’s page →145. A new policy is in report-only mode. What is it doing?
Identity authentication and access
✓ Correct answer
- Recording the effect without enforcing the controls
Report-only observes without enforcement. It does not block matching requests, grant temporary exceptions, or partially enforce grant controls while observing session controls.
Open this question’s page →146. A design bypasses strong controls whenever a user is in the office. What is the central Zero Trust concern?
Identity authentication and access
✓ Correct answer
- Network location alone does not establish identity and device assurance
Identity/device assurance cannot be inferred from location alone. A larger trusted range does not add verification, indefinite MFA bypass weakens assurance, and VPN transport does not prove endpoint integrity.
Open this question’s page →147. What is the best next step after a What If check predicts a policy will allow access?
Identity authentication and access
✓ Correct answer
- Test representative actual sign-ins and inspect policy results and dependencies
Actual journeys and logs validate practical behavior beyond a simulated check. Immediate untested rollout risks disruption, removing recovery can cause lockout, and deleting evidence weakens validation.
Open this question’s page →148. A report states all identity types are protected because an all-users policy is enabled. Which correction is needed?
Identity authentication and access
✓ Correct answer
- Validate separate supported scopes for workload and agent identities and Agent Users
Scopes differ, particularly agent user exclusions from ordinary Users policies. Sponsors do not represent all agent requests, current group targeting is unsupported, and keys bypass Entra evaluation.
Open this question’s page →149. Which two evidence sets best demonstrate a Zero Trust access rollout? Select two.
Identity authentication and access
✓ Correct answers
- Representative allowed and denied sign-in results
- Documented narrow exclusions with owners and review dates
Observed allowed/denied behavior and owned exclusions support validation. Simulation alone can miss operational paths, one administrator journey does not prove guest/client coverage, and enabled state does not establish correct scope or outcomes.
Open this question’s page →150. A policy requires phishing-resistant authentication for privileged users. Which two pre-enforcement checks reduce avoidable lockout while preserving assurance? Select two.
Identity authentication and access
✓ Correct answers
- Test secure recovery and emergency administration paths
- Confirm users have an allowed registered method
Allowed methods and recovery validate readiness. SMS is not phishing-resistant, blanket permanent exclusion removes the protection, and device compliance does not substitute for authentication strength.
Open this question’s page →151. Which capability identifies common exploitable AD configurations and recommends changes?
Identity authentication and access
✓ Correct answer
- Defender for Identity security posture assessments
Defender for Identity evaluates relevant AD misconfigurations. Endpoint signatures detect malware, PIM controls privileged activation, and Azure resource-property checks alone do not evaluate the directory’s identity configuration.
Open this question’s page →152. A domain permits unsigned LDAP. Which hardening requirement directly addresses the stated exposure?
Identity authentication and access
✓ Correct answer
- Require domain-controller LDAP signing after compatibility assessment
LDAP signing protects the stated unsigned traffic boundary. Backup encryption, cloud MFA, and service-password rotation can be useful controls but do not require signatures on the LDAP connection.
Open this question’s page →153. AD CS templates are assessed, but the team expects certificate-authority checks without an AD CS sensor. What must be verified?
Identity authentication and access
✓ Correct answer
- The documented AD CS sensor prerequisite for authority assessments
Verify the documented AD CS sensor prerequisite: certificate-authority assessments require the sensor on the AD CS server. Template assessment availability does not establish identical authority prerequisites. Generic Azure VM onboarding and a sensor only on a domain controller do not replace the required AD CS sensor coverage.
Open this question’s page →154. A line-of-business service relies on delegation, and a hardening project proposes marking all its accounts non-delegable immediately. What is the best architecture response?
Identity authentication and access
✓ Correct answer
- Identify legitimate dependencies and redesign unsafe delegation before enforcement
Delegation changes need dependency review and safer design. Constrained configurations can still expose sensitive entries, indefinite broad delegation retains risk, and content labels do not enforce Kerberos delegation.
Open this question’s page →155. Which two are AD identity-hardening priorities? Select two.
Identity authentication and access
✓ Correct answers
- Assess AD CS certificate configuration
- Review unsafe delegation and privileged account settings
Delegation/account controls and AD CS are identity hardening priorities. Synchronization affects trust, sensors do not repair all settings, and untested protocol removal can break required services.
Open this question’s page →156. An AD hardening change removes an exposed entity, but Secure Score remains unchanged immediately afterward. Which two actions are appropriate? Select two.
Identity authentication and access
✓ Correct answers
- Verify the changed configuration and affected-entity assessment
- Allow for documented score/status refresh delay
Configuration and entity reassessment verify the change while score/status can lag. Immediate rollback based only on score is unsupported, one correction does not assure the forest, and disabling collection undermines assessment.
Open this question’s page →157. A deployment currently hardcodes an API credential in source. What is the best first design evaluation?
Identity authentication and access
✓ Correct answer
- Use supported identity-based access to eliminate the credential, or a protected secret store if unavoidable
Identity-based access can remove the credential; a protected store handles unavoidable secrets. Comments and encoding leave it exposed, while administrator password reuse increases impact.
Open this question’s page →158. Development and production share a vault and broad secret-reader access. Which design change reduces blast radius?
Identity authentication and access
✓ Correct answer
- Separate vault security boundaries and narrow application access
Separate boundaries and limited data access reduce cross-environment exposure. Admin MFA, private networking, and rotation protect other risks while leaving broad application secret access intact.
Open this question’s page →159. A new key version exists, but a service keeps using a pinned old version. What should rotation validation include?
Identity authentication and access
✓ Correct answer
- Consumer reference and cache updates plus a safe retirement test
Rotation must coordinate consumer adoption and safe retirement. Creation alone proves no adoption, deleting historical keys can break recovery/decryption, and automatic switching is service-dependent.
Open this question’s page →160. An incident response disables a compromised encryption key and the dependent database becomes unavailable. What does the recovery design need to account for?
Identity authentication and access
✓ Correct answer
- Key-service dependency, rotation/migration, and protected recoverable key material
Customer-managed-key actions affect data availability, so dependency and recovery matter. Encryption does not permit keyless reading; broader admins or incident labels do not restore the cryptographic dependency.
Open this question’s page →161. Which two controls protect against destructive vault loss? Select two.
Identity authentication and access
✓ Correct answers
- Purge protection
- Soft delete
Soft delete enables recovery and purge protection prevents early permanent deletion. Plaintext logs, broad access administration, and shared credentials increase compromise or deletion exposure.
Open this question’s page →162. A company needs dedicated managed hardware protection for cryptographic keys and continues to store general API passwords. Which two design choices fit? Select two.
Identity authentication and access
✓ Correct answers
- Evaluate Managed HSM for the required key boundary
- Use an appropriate secret-capable vault for API passwords with minimal access
Managed HSM is key-focused; general passwords need an appropriate secret store. Treating HSM as a general password database is a product-boundary error, unsafe recovery material exposes keys, and premature disablement can break services.
Open this question’s page →163. Which enterprise plane primarily governs identity trust and privilege assignment?
Privileged access and governance
✓ Correct answer
- Control plane
The control plane governs enterprise trust and access. Workloads store business value; a productivity desktop and content-delivery layer are not the enterprise trust authority.
Open this question’s page →164. An endpoint management service can deploy executable code to every production server. How should its access be evaluated?
Privileged access and governance
✓ Correct answer
- As a powerful management path with broad workload impact
Deployment authority creates management-plane impact. Being outside a DC does not make it low privilege, cost is irrelevant to authority, and HTTPS does not reduce its granted control.
Open this question’s page →165. A helpdesk account cannot hold an executive’s role but can reset that executive’s credentials. What matters in privilege evaluation?
Privileged access and governance
✓ Correct answer
- The indirect identity-control path
Credential-reset authority can enable control of the executive identity. A missing direct role, MFA, and unrelated VM restrictions do not eliminate that indirect privileged path.
Open this question’s page →166. A resource operator is delegated a narrow role but also owns the group holding a broad administrative role. What is the best assessment?
Privileged access and governance
✓ Correct answer
- Group ownership can undermine the intended delegation boundary
Controlling privileged group membership can enable broad access. A narrow assignment does not cancel other grants, obscurity is not authorization, and retained logs do not prevent elevation.
Open this question’s page →167. Which two practices align with enterprise access model delegation? Select two.
Privileged access and governance
✓ Correct answers
- Classify authority by what it can control
- Delegate required tasks at limited scope
Impact-based classification and limited task/scope align. Management and backup tools can be highly powerful; access administration should not be universal, and nested groups can carry real privilege.
Open this question’s page →168. A deployment team can release production code, approve its own elevation, and delete the logs. Which two architectural changes address the privileged control problem? Select two.
Privileged access and governance
✓ Correct answers
- Protect the deployment identity/path according to production impact
- Separate approval and audit-evidence control from deployment authority
Segregated approval/evidence and protected deployment paths address the impact. Short duration alone preserves self-approval/evidence abuse, direct-role-only reviews miss indirect paths, and excluding deployment identities ignores their production authority.
Open this question’s page →169. A user has an eligible Azure role and must request it before use. Which capability provides that model?
Privileged access and governance
✓ Correct answer
- Privileged Identity Management
PIM provides eligible activation. Audit retains activity, monitoring collects telemetry, and a network security group filters traffic rather than granting time-limited roles.
Open this question’s page →170. A project needs a controlled bundle of group, app, and SharePoint rights with request and expiry. Which primary capability fits?
Privileged access and governance
✓ Correct answer
- Entitlement management access packages
Access packages govern the bundle’s request, assignment, and expiry. PIM governs activation, reviews reassess existing rights, and session controls do not create the resource bundle lifecycle.
Open this question’s page →171. Quarterly reviewers must decide whether existing application access remains justified. Which capability addresses this?
Privileged access and governance
✓ Correct answer
- Access reviews
Access reviews recertify existing access. Token duration changes sessions, patches fix devices, and unrestricted app registration adds risk rather than reviewing entitlements.
Open this question’s page →172. An architect makes a broad administrator role permanently eligible with no meaningful approval or expiry. What concern remains?
Privileged access and governance
✓ Correct answer
- Excessive activation eligibility remains a privileged access path
Weak permanent eligibility can still lead to broad active privilege. It is not zero activation capability, devices remain important, and PIM is not universal third-party cloud governance.
Open this question’s page →173. Which two controls most directly minimize standing privilege in a supported role? Select two.
Privileged access and governance
✓ Correct answers
- Eligible rather than permanent active assignment
- Short controlled activation windows
Eligibility and limited activation reduce standing privilege. Permanent Owner retains it, suppressed notifications reduce oversight, and unrestricted self-approval weakens sensitive access control.
Open this question’s page →174. A company combines PIM, access packages, and reviews. Which two mappings are correct? Select two.
Privileged access and governance
✓ Correct answers
- Access reviews: whether existing access remains necessary
- PIM: when supported privileged roles become active
PIM controls privileged activation and reviews recertify rights. Access packages do not remove malware, PIM scope is not every local privilege, and reviews do not configure routing.
Open this question’s page →175. An attacker steals an NTLM hash and uses it on another machine. Which technique is described?
Privileged access and governance
✓ Correct answer
- Pass-the-hash
Pass-the-hash reuses NTLM material. Pass-the-ticket reuses Kerberos tickets, Kerberoasting gathers service-ticket material for offline cracking, and access review is a governance process.
Open this question’s page →176. A suspicious host requests directory replication and extracts password hashes. Which privilege boundary is being abused?
Privileged access and governance
✓ Correct answer
- Replication authority associated with DCSync
DCSync abuses directory replication authority to obtain credential material. Ordinary LDAP reads do not grant replication of password secrets; Kerberoasting requests service tickets, and pass-the-hash uses an NTLM hash for authentication rather than directory replication.
Open this question’s page →177. Why is a weak service-account password particularly concerning when Kerberos service tickets can be obtained?
Privileged access and governance
✓ Correct answer
- The ticket material may be subjected to offline password cracking
Kerberoasting enables offline cracking of service-ticket material. Tickets do not inherently disable services or grant Enterprise Admin, and human MFA does not rotate service-account secrets.
Open this question’s page →178. A ransomware recovery plan relies only on the most recent DC backup and never checked its integrity. What is the key concern?
Privileged access and governance
✓ Correct answer
- The backup may contain the compromised state and must be assessed as trusted recovery material
The backup may preserve an already compromised directory state, so trusted recovery material must be assessed. The newest backup is not inherently safe. Encryption protects backup confidentiality but does not prove the restored state is uncompromised, and a read-only DC backup cannot restore writable domain controllers across every domain.
Open this question’s page →179. Which two examples correctly identify credential attack mechanisms? Select two.
Privileged access and governance
✓ Correct answers
- DCSync extracts credential data through replication
- Pass-the-ticket reuses a stolen Kerberos ticket
Kerberos ticket reuse and credential replication are the stated mechanisms. Kerberoasting is credential cracking, pass-the-hash uses NTLM material, and malicious certificates from AD CS can enable authentication.
Open this question’s page →180. A forest has multiple domains and suffered identity compromise. Which two recovery planning requirements are sound? Select two.
Privileged access and governance
✓ Correct answers
- Plan recovery for every domain, including the root domain dependency
- Identify trusted backups and required recovery credentials
Trusted material/credentials and all-domain planning support recovery. One snapshot is not a validated forest plan, compromised credentials retain risk, and recentness alone does not establish a safe restored state.
Open this question’s page →181. Which design most directly reduces exposure from daily email and browsing to cloud administrator credentials?
Privileged access and governance
✓ Correct answer
- Separate privileged identity and secure administration workstation
Separate the privileged identity and use a secure administration workstation to reduce exposure to daily email and browsing. A single account combines those exposures. A shorter timeout does not separate the privileged identity or trusted device; monitoring can reveal misuse but leaves the exposed administration path in place.
Open this question’s page →182. A tenant’s normal administrators are federated. What best preserves emergency access during federation failure?
Privileged access and governance
✓ Correct answer
- Cloud-only emergency accounts with independent strong authentication
Cloud-only accounts avoid the failed federation dependency. Synchronized/federated recovery repeats it, relying solely on one live agent adds fragility, and retention does not restore authentication.
Open this question’s page →183. Every emergency Global Administrator is eligible and activation approvers are unavailable. Which configuration better avoids this lockout?
Privileged access and governance
✓ Correct answer
- Permanent active emergency assignment under tightly controlled use
Microsoft recommends permanent active emergency roles to avoid activation dependency. Unavailable approval repeats lockout, deleting recovery removes resilience, and an unprivileged user cannot recover tenant administration.
Open this question’s page →184. A multicloud administrator uses Entra federation, but an unmanaged native root account remains in another cloud. What is the best assessment?
Privileged access and governance
✓ Correct answer
- The native privileged path remains a separate control and recovery risk
The enterprise model evaluates all impactful paths. Federation does not necessarily disable native access, rare use is not protection, and privileged native activity still needs monitoring.
Open this question’s page →185. Which two are recommended Entra emergency-access characteristics? Select two.
Privileged access and governance
✓ Correct answers
- Cloud-only identity independent of federation
- Strong authentication different from normal administrator dependencies
Cloud-only independent authentication supports recovery. Microsoft recommends multiple accounts, avoiding expiry/cleanup, and permanent active emergency privilege rather than unavailable activation approval.
Open this question’s page →186. A restrictive device policy could block emergency sign-in during a management outage. Which two actions align with current guidance? Select two.
Privileged access and governance
✓ Correct answers
- Exclude emergency accounts from policies that block or restrict sign-in
- Retain strong recovery authentication, secure authorized use, and sign-in alerts
Exclusions preserve recovery while strong authentication and monitoring constrain its use. Removing authentication is unsafe, routine use expands exposure, and deleting audit evidence prevents accountability.
Open this question’s page →187. Which problem is CIEM designed to address?
Privileged access and governance
✓ Correct answer
- Excessive cloud infrastructure permissions
CIEM analyzes infrastructure entitlement risk. Stronger authentication, PIM activation, and project package governance contribute other controls but do not themselves discover and assess multicloud infrastructure permissions.
Open this question’s page →188. A new multicloud design needs current Microsoft native CIEM. Which service should be evaluated?
Privileged access and governance
✓ Correct answer
- Defender CSPM in Defender for Cloud
Native CIEM is part of Defender CSPM. The standalone permissions product is deprecated; auditing and patching do not replace entitlement analysis.
Open this question’s page →189. A service principal has a benign role name but can reach a sensitive database through effective permissions. What matters most?
Privileged access and governance
✓ Correct answer
- Actual effective access and the attack path
Effective reach determines privilege impact. Role names and sign-in count do not bound actions, and group-based assignment may still grant excessive effective permissions.
Open this question’s page →190. CIEM recommends removing permissions unused in recent telemetry, but the workload has a quarterly recovery task. What should happen before removal?
Privileged access and governance
✓ Correct answer
- Validate the recovery dependency with the owner and test a narrower permission set
Usage-based recommendations need dependency validation and safe narrowing. Blind removal can break recovery, ignoring all findings preserves excess, and broader rights worsen the problem.
Open this question’s page →191. Which two are native Defender CIEM capabilities? Select two.
Privileged access and governance
✓ Correct answers
- Identity risks correlated with attack paths
- Effective permission analysis
Effective analysis and contextual attack paths are documented. CIEM does not certify legal status, replace every IAM engine, or guarantee safe autonomous removal without dependency review.
Open this question’s page →192. A team enabled MFA for humans but left overprivileged service accounts across AWS and GCP. Which two conclusions are correct? Select two.
Privileged access and governance
✓ Correct answers
- Authentication strength does not itself reduce granted infrastructure rights
- Nonhuman permissions remain relevant to CIEM
Nonhuman identities can be overprivileged and MFA does not narrow authorization. CIEM is multicloud and includes application identities; absence of human sign-in does not make permissions harmless.
Open this question’s page →193. Which governance process asks whether an existing user assignment is still needed?
Privileged access and governance
✓ Correct answer
- An access review
An access review recertifies entitlement need. Sign-in frequency governs sessions, updates fix operating systems, and certificate renewal maintains trust material.
Open this question’s page →194. A recurring access review completed with denied group memberships or application assignments, but those reviewed grants remain in place. What should the team inspect?
Privileged access and governance
✓ Correct answer
- Whether results were applied and whether automatic application was configured
Denied decisions change reviewed access only when results are applied. Check manual application and the automatic-application setting. Deadline completion, reviewer notifications, and recommendations alone do not confirm that the denied grants were removed.
Open this question’s page →195. A reviewer is absent and managers are missing for some users. Which planning control addresses this?
Privileged access and governance
✓ Correct answer
- Designated fallback reviewers and a clear no-response outcome
Fallbacks and deliberate nonresponse policy keep decisions accountable. Indefinite silence preserves risk, universal self-review can be inappropriate for privilege, and absent audits undermine evidence.
Open this question’s page →196. A denied membership persists in a group synchronized from on-premises AD. What explains the result?
Privileged access and governance
✓ Correct answer
- Access reviews cannot directly change the source-authoritative AD membership
The source is on-premises AD, requiring an appropriate source-side action. Review denial does not automatically override synchronization, names are irrelevant, and retention does not edit group membership.
Open this question’s page →197. Which two are essential access-review design decisions? Select two.
Privileged access and governance
✓ Correct answers
- How decisions and nonresponses affect access
- Who will review and who is the fallback
Reviewer/fallback and outcome behavior define control accountability. Frequency alone omits enforcement, universal privileged self-attestation lacks risk-based oversight, and recommendations alone do not prove source-side removal.
Open this question’s page →198. A guest access report contains Entra app and group assignments, but a guest also has direct rights in a resource. Which two actions provide better assurance? Select two.
Privileged access and governance
✓ Correct answers
- Verify denied decisions remove effective access at the authoritative resource
- Examine access paths beyond the report’s observed assignment scope
Scope-aware inventory and effective-access checks test actual removal. The report can omit direct grants, completion is not proof of enforcement, and blind deletion ignores dependencies.
Open this question’s page →199. What is the main reason privileged administration needs a trusted source device?
Privileged access and governance
✓ Correct answer
- A compromised source can steal or control the privileged session
Device compromise can undermine the session. Remote desktop does not guarantee a safe source, portals do not require unpatched devices, and encryption does not assign roles.
Open this question’s page →200. An administrator uses a hardened jump server from an unmanaged laptop. What trust gap remains?
Privileged access and governance
✓ Correct answer
- The source laptop can still compromise credentials or interaction
The compromised origin can undermine credentials and interaction. The jump server and transport encryption protect other boundaries; MFA alone does not neutralize source malware after authentication.
Open this question’s page →201. A privileged workstation allows general email, arbitrary browsing, and user-installed software. Which change best reduces its attack surface?
Privileged access and governance
✓ Correct answer
- Restrict it to approved administrative applications and management sites
Approved applications and sites reduce exposure. More browsing and local administration expand it, while stopping alerts removes detection.
Open this question’s page →202. A design enforces MFA and uses a secure gateway but ignores workstation health. What is the strongest assessment?
Privileged access and governance
✓ Correct answer
- Session assurances are limited by the trust of the originating device
The clean-source principle limits assurance when the origin is compromised. MFA and gateways strengthen parts of the path but do not eliminate device compromise or replace device controls.
Open this question’s page →203. Which two controls fit a privileged workstation? Select two.
Privileged access and governance
✓ Correct answers
- Restricted approved application execution
- Managed security baseline and updates
Management and execution restrictions support trust. General browsing, personal email with privilege, and unrestricted local admin expand compromise exposure.
Open this question’s page →204. A remote-access architecture claims complete privileged security because traffic is encrypted. Which two components still require explicit assurance? Select two.
Privileged access and governance
✓ Correct answers
- The originating device and privileged account
- The intermediary and administrative interface
The full path includes device/account and intermediary/interface. Transport-only protection, MFA-only protection, and target-only compliance each omit parts that can compromise the privileged session.
Open this question’s page →205. Which output best turns a broad requirement into an implementable security control?
Regulatory compliance and controls
✓ Correct answer
- A scoped objective with owner, implementation, test, and evidence
Owned, scoped, tested controls turn obligations into action. Product purchase does not prove implementation, provider certification does not cover all customer duties, and a score alone omits control evidence.
Open this question’s page →206. A requirement involves both platform safeguards and customer configuration. How should responsibility be represented?
Regulatory compliance and controls
✓ Correct answer
- As shared responsibility with explicit Microsoft and customer actions
Shared controls require defined contributions. Assigning everything to Microsoft ignores customer configuration, no owner prevents accountability, and purchase does not implement the required settings.
Open this question’s page →207. An audit asks who tested an access control and which evidence proves it worked. What should the architect produce?
Regulatory compliance and controls
✓ Correct answer
- The assigned improvement action’s implementation, test, and evidence records
Action records connect implementation, testing and evidence. Configuration alone does not show effectiveness, provider reports may not cover customer access controls, and score changes omit the test’s accountable scope.
Open this question’s page →208. A provider has an ISO certification, and a customer concludes its custom workload is automatically certified. What is the strongest correction?
Regulatory compliance and controls
✓ Correct answer
- Assess the workload’s in-scope customer and shared controls with evidence
Scoped customer/shared controls need evidence. Certified hosting covers provider scope, provider-only review omits customer duties, and technical benchmark results cannot establish all organizational obligations.
Open this question’s page →209. Which two elements are necessary for a defensible compliance control? Select two.
Regulatory compliance and controls
✓ Correct answers
- Evidence of implementation and testing
- Defined responsibility and scope
Responsibility/scope and tested evidence make assurance assessable. Scores assist prioritization, unowned exceptions retain risk, and automation cannot be assumed to prove all organizational duties.
Open this question’s page →210. A standard includes access control and a personnel training obligation. Which two design choices are appropriate? Select two.
Regulatory compliance and controls
✓ Correct answers
- Collect manual evidence where automated checks cannot establish the obligation
- Map technical and organizational obligations to accountable control owners
Ownership and relevant manual evidence cover different obligations. A firewall does not demonstrate training, a template does not deliver it, and one technical check cannot prove all control types.
Open this question’s page →211. A requirement says sensitive documents must be classified and encrypted when appropriate. Which Purview mechanism fits?
Regulatory compliance and controls
✓ Correct answer
- Configured sensitivity labels
Sensitivity labels classify and can encrypt content. Scores track progress, PIM controls privilege, and routes do not protect document content.
Open this question’s page →212. A company needs to reduce inappropriate sharing of payment data across supported channels. What should it design?
Regulatory compliance and controls
✓ Correct answer
- DLP policies with appropriate locations, conditions, and actions
DLP addresses sensitive-sharing behavior. Audit retention observes it, markings alone do not enforce the required action, and content preservation does not stop a permitted share.
Open this question’s page →213. Legal investigators need relevant mailbox and site content preserved while a case proceeds. Which mechanism directly fits?
Regulatory compliance and controls
✓ Correct answer
- An eDiscovery case hold on the relevant locations
A case hold preserves relevant content. Audit records describe operations rather than preserving the source content, a marking does not impose retention, and a search without a hold does not ensure preservation.
Open this question’s page →214. A team applies a seven-year content retention policy and claims user action records now also last seven years. What is wrong?
Regulatory compliance and controls
✓ Correct answer
- Content retention and audit-log retention require distinct designs
Content preservation is separate from audit record retention and its licensing/policy rules. Labels do not change all licensing, and retention does not remove resource access controls.
Open this question’s page →215. Which two Purview pairings are correct? Select two.
Regulatory compliance and controls
✓ Correct answers
- eDiscovery: preserve and review case evidence
- Compliance Manager: assign and track control improvement actions
Compliance Manager manages compliance work and eDiscovery manages evidence. DLP does not elevate Azure roles, labels do not patch servers, and content retention is not CIEM.
Open this question’s page →216. A compliance design must limit sensitive sharing and preserve investigatory evidence. Which two validations are most relevant? Select two.
Regulatory compliance and controls
✓ Correct answers
- Verify case holds and search/review access cover relevant evidence locations
- Test DLP enforcement across the intended supported channels
Channel-specific enforcement and correctly scoped evidence/access validate the intended controls. Labels do not guarantee every channel, broad case access exposes evidence, and scores do not prove preservation.
Open this question’s page →217. Which Azure capability constrains resource configuration against organizational rules?
Regulatory compliance and controls
✓ Correct answer
- Azure Policy
Azure Policy evaluates and can enforce configuration rules. PIM governs privilege timing, eDiscovery handles evidence, and access packages manage entitlement lifecycle.
Open this question’s page →218. A region restriction must be evaluated for unintended deployment impact before enforcement. Which initial effect is appropriate?
Regulatory compliance and controls
✓ Correct answer
- Audit
Audit exposes impact without blocking. Immediate Deny risks disruption, unrelated Modify does not test the restriction, and a blanket exemption bypasses it rather than evaluates it.
Open this question’s page →219. Existing resources are missing settings required by a DeployIfNotExists assignment. What operational step is needed?
Regulatory compliance and controls
✓ Correct answer
- Create an appropriate remediation task using the authorized assignment identity
Remediation uses a task and authorized assignment identity. Deny does not repair existing resources, caller rights do not substitute for the deployment identity’s rights, and definition changes alone do not remediate the estate.
Open this question’s page →220. A custom policy adds a new remediation role to roleDefinitionIds, but the existing assignment identity lacks it. What must be done?
Regulatory compliance and controls
✓ Correct answer
- Grant the newly required minimal role to the assignment identity and validate remediation
Changing a definition does not automatically update the identity’s role grants. Broad directory administration is unnecessary, and removing checks conceals noncompliance rather than authorizes deployment.
Open this question’s page →221. Which two statements correctly separate policy effects? Select two.
Regulatory compliance and controls
✓ Correct answers
- Audit reports applicable noncompliance
- Deny prevents applicable noncompliant requests
Audit observes and Deny blocks requests. Deny is not automatic repair, broad RBAC does not inherently bypass policy, and initiatives group policy definitions rather than grant a user role.
Open this question’s page →222. A management-group policy denies a resource type, while a more permissive child assignment does not deny it. Which two conclusions are correct? Select two.
Regulatory compliance and controls
✓ Correct answers
- The inherited applicable Deny still prevents the request
- The denying assignment must be changed or appropriately scoped for the exception
The inherited applicable Deny still blocks the request. A governed exception must address that denying assignment through appropriate scope, assignment changes, or an applicable exemption. The most permissive assignment does not win; Contributor cannot ignore Deny, and adding an unrelated tag does not convert the effect to Audit.
Open this question’s page →223. What is the primary purpose of the regulatory compliance dashboard?
Regulatory compliance and controls
✓ Correct answer
- Show resource assessments against enabled standards and controls
The dashboard shows control assessments and gaps. It does not grant auditor approval, replace all organizational work, or store employee credentials.
Open this question’s page →224. A standard is enabled for Azure but not the organization’s AWS account. What should the architect do?
Regulatory compliance and controls
✓ Correct answer
- Validate AWS onboarding and assign the appropriate supported standard/plan
AWS scope, onboarding and standard/plan support must be explicit. Azure assignment alone, guest log collection, and MFA do not establish AWS resource compliance coverage.
Open this question’s page →225. A control fails for several storage resources. What is the most useful next dashboard action?
Regulatory compliance and controls
✓ Correct answer
- Expand the assessment, inspect affected resources, and follow remediation guidance
Resource drilldown connects the failing assessment to remediation. Suppression and standard removal hide the gap; provider-only actions do not correct the customer resources.
Open this question’s page →226. A resource was corrected, but the dashboard still reports failure immediately afterward. What should be checked?
Regulatory compliance and controls
✓ Correct answer
- The actual configuration and timing of the next relevant assessment
The actual state and next assessment determine whether remediation is reflected. Updates are periodic, an overall score can obscure the resource result, and manipulating standard assignment is not validation.
Open this question’s page →227. Which two capabilities support broader compliance assurance? Select two.
Regulatory compliance and controls
✓ Correct answers
- Integration of resource compliance data into Compliance Manager
- Manual attestation with relevant control evidence
Manual evidence and centralized compliance workflows broaden assurance. Automated checks do not prove all procedures, one resource does not certify an organization, and customer duties remain.
Open this question’s page →228. A downloaded report shows green automated controls but leaves manual obligations unresolved. Which two conclusions are justified? Select two.
Regulatory compliance and controls
✓ Correct answers
- Manual and customer responsibilities still require scoped testing and evidence
- The report is evidence of the assessed resource scope
The report summarizes assessed scope while remaining obligations need evidence. It is not universal certification, provider actions do not remove customer duties, and ongoing assessment is needed to detect drift.
Open this question’s page →229. An architect needs a free starting point for cloud asset inventory, recommendations, and secure score. Which option fits?
Hybrid multicloud posture and exposure
✓ Correct answer
- Foundational CSPM
Foundational CSPM supplies these basic posture capabilities without cost. Defender CSPM adds advanced paid posture features. Defender for Servers Plan 2 protects server workloads. Defender for Office 365 protects collaboration threats, not cloud resource posture.
Open this question’s page →230. Azure and AWS teams need one set of security principles with implementation guidance adapted to each platform. Which foundation should they use?
Hybrid multicloud posture and exposure
✓ Correct answer
- Microsoft Cloud Security Benchmark
MCSB directly provides shared cloud security principles with platform-specific implementation guidance. CIS Benchmarks are useful platform-specific hardening standards, but are not the requested Microsoft cloud-neutral foundation. NIST CSF supports risk-management outcomes, and ISO/IEC 27001 defines management-system requirements rather than detailed Azure and AWS implementation controls.
Open this question’s page →231. A team already sees basic cloud recommendations but needs contextual prioritization and attack-path analysis. Which change addresses that requirement?
Hybrid multicloud posture and exposure
✓ Correct answer
- Enable Defender CSPM for supported resources
Defender CSPM adds contextual risk prioritization and cloud attack-path analysis. Foundational assessments or a workbook can expose configuration findings but do not enable those paid analysis capabilities. Servers Plan 1 primarily adds endpoint detection and response for servers.
Open this question’s page →232. A compliance dashboard shows passing automated controls. A manager proposes declaring the entire business legally compliant. What should the architect recommend?
Hybrid multicloud posture and exposure
✓ Correct answer
- Use the results as technical evidence and assess remaining manual and organizational obligations
Technical assessment is evidence for supported controls, while remaining obligations still need review. Mapping to industry standards does not confer legal certification. Posture checks are not complete runtime incident evidence. Manual process controls remain necessary where automation cannot assess them.
Open this question’s page →233. A subscription has excessive public exposure and suspicious processes executing on VMs. Which two capabilities address these distinct needs? Select two.
Hybrid multicloud posture and exposure
✓ Correct answers
- Relevant CWPP runtime threat protection
- CSPM recommendations for configuration weaknesses
CSPM addresses configuration and CWPP addresses runtime threat activity. MCSB assessments and secure score do not provide continuous process detection. External discovery observes the internet-facing surface rather than internal VM execution.
Open this question’s page →234. A central team enables Defender CSPM across several cloud environments. Which two assumptions should it reject during the architecture review? Select two.
Hybrid multicloud posture and exposure
✓ Correct answers
- Every runtime workload protection plan is automatically enabled
- Every advanced feature is identical across Azure, AWS, GCP, and Arc
Defender CSPM does not automatically activate all CWPP plans, and advanced feature coverage varies by environment. Recommendations for supported configurations, environment-specific support validation, and Foundational CSPM secure score are valid expectations. Plan selection must follow required controls and support matrices.
Open this question’s page →235. A Microsoft 365 administrator wants an overview of recommended improvements for identities, apps, and devices. Which tool most directly fits?
Hybrid multicloud posture and exposure
✓ Correct answer
- Microsoft Secure Score
Microsoft Secure Score consolidates recommended improvements for supported Microsoft 365 identities, apps, and devices. Defender for Cloud secure score focuses on assessed cloud resources. Compliance Manager evaluates compliance improvement actions, while the vulnerability-management exposure score focuses on vulnerability exposure rather than this broader Microsoft 365 posture view.
Open this question’s page →236. A board presentation claims that a high Secure Score guarantees protection from ransomware. Which correction is appropriate?
Hybrid multicloud posture and exposure
✓ Correct answer
- The score shows recommended controls implemented, while residual risks still require assessment
Secure Score indicates recommended actions taken but does not guarantee security. It is not a legal certification or an exact attack forecast. Recovery testing verifies business resilience and cannot be replaced by a posture score.
Open this question’s page →237. An analyst compares two organizations with similar scores but different assets and business priorities. What is the sound interpretation?
Hybrid multicloud posture and exposure
✓ Correct answer
- The comparison is useful context but does not establish equal risk
Benchmarks provide context; exposure, critical assets, coverage, and recovery can differ. A similar score does not imply identical attack surfaces, licensing, or recovery capabilities. Interpret the measurement alongside the actual control environment.
Open this question’s page →238. A company can either gain many points from a low-impact recommendation or immediately reduce exposure of a critical identity. Which decision best uses Secure Score?
Hybrid multicloud posture and exposure
✓ Correct answer
- Prioritize the critical identity risk and track score improvements alongside residual exposure
Business risk should drive remediation while Secure Score tracks recommended improvements. Maximizing points can miss urgent exposure. Waiting for a benchmark delays protection. A posture metric is not an incident-response queue.
Open this question’s page →239. Which two uses of Microsoft Secure Score support a security improvement program? Select two.
Hybrid multicloud posture and exposure
✓ Correct answers
- Track trends in recommended-control implementation
- Establish posture KPIs with benchmark context
Secure Score supports trends and posture KPIs with comparison context. It does not prove complete access review coverage, replace vulnerability assessments, or guarantee freedom from compromise. Those require separate evidence and controls.
Open this question’s page →240. A recommended action is protected by another product, while leadership wants an honest progress report. Which two steps are appropriate? Select two.
Hybrid multicloud posture and exposure
✓ Correct answers
- Record the alternate protection and validate that it meets the recommendation’s intent
- Report the score trend together with important residual risks
Alternate protection should be documented and verified, and the score should be presented with residual-risk context. Unverified completion creates misleading evidence. Removing identity findings hides exposure. A score benchmark cannot establish that an alternate implementation works.
Open this question’s page →241. A company operates Azure, AWS, and GCP and wants to design a unified protection rollout. What should it establish first?
Hybrid multicloud posture and exposure
✓ Correct answer
- An inventory and security requirements for each environment
Inventory and requirements determine scope and suitable collection methods. One agent cannot protect every resource type. Exempting external clouds removes coverage. A score target without owners does not identify what must be protected or remediated.
Open this question’s page →242. AWS resources are missing from Defender for Cloud after an account restructure. Which investigation is most useful?
Hybrid multicloud posture and exposure
✓ Correct answer
- Check connector scope and cloud permissions against the expected account inventory
Reconcile connector scope and permissions with the restructured account inventory to restore provider-API resource visibility. EDR onboarding concerns endpoint telemetry; standards assignments concern assessment of discovered resources. Log retention preserves collected records but does not grant discovery access to missing accounts.
Open this question’s page →243. A central dashboard has recommendations, but no team accepts remediation work. Which design gap is most directly responsible?
Hybrid multicloud posture and exposure
✓ Correct answer
- The process lacks accountable owners and remediation workflows
Owners and remediation workflows convert posture findings into fixes. Healthy collection does not require replacing the connector. The SOC investigates threats but cannot be the sole accountable owner for every configuration change. Waiting for feature parity by exempting findings abandons available protection.
Open this question’s page →244. A team wants to replace every VM EDR agent with agentless disk scanning to reduce deployment overhead. Its requirement includes continuous suspicious-process detection. What should the architect recommend?
Hybrid multicloud posture and exposure
✓ Correct answer
- Retain suitable EDR telemetry and use agentless scanning as complementary posture coverage
EDR supports continuous process telemetry, while agentless scanning provides complementary supported findings. Snapshots do not record every real-time process. Compliance checks evaluate posture, and EASM observes the external surface rather than internal process execution.
Open this question’s page →245. Which two checks demonstrate that a multicloud pilot has operational coverage? Select two.
Hybrid multicloud posture and exposure
✓ Correct answers
- Expected resources appear with healthy collection permissions
- Test findings and alerts reach their responsible teams
Expected visible resources with valid collection and delivery of findings demonstrate operational coverage. Plan billing does not prove sensor health. A connector object can omit scope. Dashboard availability does not establish completeness.
Open this question’s page →246. A multicloud environment grows through acquisitions. Which two design decisions reduce future blind spots? Select two.
Hybrid multicloud posture and exposure
✓ Correct answers
- Automate onboarding of new accounts and projects with scoped permissions
- Monitor connector health and reconcile discovered assets with an authoritative inventory
Automated scoped onboarding and inventory reconciliation with health monitoring maintain coverage. A fixed rollout drifts over time. Unrestricted administration adds risk without proving necessity. Delaying alerts for feature parity suppresses protection that can already operate.
Open this question’s page →247. A supported server fleet requires EDR and an entry-level Defender for Servers plan. Which plan matches that emphasis?
Hybrid multicloud posture and exposure
✓ Correct answer
- Defender for Servers Plan 1
Plan 1 emphasizes server EDR through Defender for Endpoint. Foundational CSPM assesses configuration. Storage protection targets storage threats. Defender for Office 365 targets collaboration threats.
Open this question’s page →248. A server design needs Plan 1 EDR plus supported agentless vulnerability and secret scanning. Which plan should be evaluated?
Hybrid multicloud posture and exposure
✓ Correct answer
- Defender for Servers Plan 2
Defender for Servers Plan 2 combines Plan 1 EDR with supported agentless server scanning. Plan 1 alone and Foundational CSPM do not supply the requested combination. Defender CSPM can supply agentless posture capabilities, but the stated alternative omits the required EDR coverage.
Open this question’s page →249. A platform team needs container image vulnerability assessment and Kubernetes runtime threat detection. Which protection solution fits?
Hybrid multicloud posture and exposure
✓ Correct answer
- Defender for Containers with required components
Defender for Containers supplies the requested combination when its components and access are configured. Node EDR is useful defense but does not by itself establish container image assessment and Kubernetes runtime coverage. Posture-only assessment or pipeline image scanning leaves the runtime requirement unmet.
Open this question’s page →250. A team enabled a protection plan on non-Azure servers and assumes all Azure VM-specific features now work there. What should the architect require?
Hybrid multicloud posture and exposure
✓ Correct answer
- Validate each required capability against platform and environment support
The support matrix establishes capability applicability. Matching plan names do not imply parity. Public management exposure creates risk and does not extend service support. Billing settings do not replace host firewall controls.
Open this question’s page →251. A workload estate contains production databases and storage accounts with untrusted file uploads. Which two selections are appropriate? Select two.
Hybrid multicloud posture and exposure
✓ Correct answers
- Defender for Storage with relevant detection and scanning features
- Database protection matching the supported engine and hosting model
Database protection must fit the engine and host, while storage detection and scanning address the upload workload. Office 365 protection does not provide database runtime protection. EASM is external discovery. Secure Score does not quarantine files.
Open this question’s page →252. A Kubernetes subscription shows an enabled Defender for Containers plan but runtime alert tests fail. Which two checks best address the missing capability? Select two.
Hybrid multicloud posture and exposure
✓ Correct answers
- Validate required permissions and connectivity for the cluster environment
- Verify deployment and health of the required in-cluster runtime component
Runtime protection depends on its components, health, permissions, and connectivity. Billing proves plan activation, not telemetry. Registry scanning and runtime protection are separate capabilities. A score export cannot replace a runtime sensor.
Open this question’s page →253. Which service brings supported on-premises servers into Azure resource management without relocating them?
Hybrid multicloud posture and exposure
✓ Correct answer
- Azure Arc-enabled servers
Azure Arc-enabled servers registers supported machines as Azure resources while they remain in place. Site Recovery handles recovery replication, Azure Migrate supports migration assessment and discovery, and Azure Monitor Agent collects telemetry; these alone do not provide the Arc resource-management bridge.
Open this question’s page →254. An operator can deploy arbitrary extensions to an Arc-enabled Linux server. How should this privilege be classified?
Hybrid multicloud posture and exposure
✓ Correct answer
- Potential root-level host administration
Extensions can execute as root, so extension deployment is an administrative capability. It exceeds read-only inventory, application-user access, and recommendation viewing. Scope and protect the role accordingly.
Open this question’s page →255. A firewall administrator proposes opening public inbound SSH solely to make Arc communicate with Azure. What is the better design?
Hybrid multicloud posture and exposure
✓ Correct answer
- Provide required outbound agent connectivity and keep unnecessary inbound management closed
Provide the required ongoing outbound connectivity. Arc agent communication does not depend on opening public inbound SSH or HTTPS to the host. Allowing endpoints only during installation breaks subsequent agent operation and management.
Open this question’s page →256. A company grants its enrollment automation Owner on the entire subscription. It only needs to connect servers. What should the architect change?
Hybrid multicloud posture and exposure
✓ Correct answer
- Use narrowly scoped onboarding permissions and separate later host-administration roles
Use scoped onboarding permissions and separate later administration. Owner and Contributor contain powers beyond enrollment, including sensitive management actions. Reader is insufficient to create the Arc resource. The role should match the operation rather than default to a broad administrator or a read-only role.
Open this question’s page →257. Which two responsibilities remain with the customer after Arc registration? Select two.
Hybrid multicloud posture and exposure
✓ Correct answers
- Maintain and secure the host and Connected Machine agent
- Control Azure RBAC and extension privileges
Customers retain access-control and machine/agent security duties. Microsoft operates its cloud service infrastructure. Resource visibility is not a security guarantee, and local administrative activity still needs monitoring.
Open this question’s page →258. A highly sensitive Arc server needs inventory but does not require extension-based administration. Which two measures reduce unnecessary privilege? Select two.
Hybrid multicloud posture and exposure
✓ Correct answers
- Restrict management roles and monitor privileged operations
- Disable or restrict extension operations according to the requirement
Reducing extension operations and protecting management roles limit administrative reach. Inventory readers do not need host-administration powers. Azure delivery does not make every extension appropriate. Unrestricted token access exposes the managed identity’s permissions.
Open this question’s page →259. An acquisition may include forgotten public domains and hosts. Which Microsoft solution best discovers the external surface?
Hybrid multicloud posture and exposure
✓ Correct answer
- Defender External Attack Surface Management
Defender EASM follows public infrastructure relationships to find external assets beyond the known estate. Resource Graph covers existing Azure resource scope, endpoint inventory covers discovered or onboarded devices, and a connected-account cloud inventory is bounded by its onboarded cloud scope.
Open this question’s page →260. What should an architect provide to begin EASM discovery for a known business?
Hybrid multicloud posture and exposure
✓ Correct answer
- Known legitimate assets such as organizational domains
Known legitimate public assets such as company domains seed recursive discovery. Subscription identifiers, a private-only address range, and an internal OU tree do not by themselves establish the public infrastructure relationships needed for this external discovery.
Open this question’s page →261. EASM finds a domain linked to a company asset, but a supplier may own it. What should happen before internal remediation is assigned?
Hybrid multicloud posture and exposure
✓ Correct answer
- Validate ownership and classify the asset appropriately
Inferred relationships need ownership validation and appropriate classification. Deletion is not justified by discovery. A relationship alone does not prove ownership. Automatically ignoring third-party links can conceal relevant external dependencies.
Open this question’s page →262. A security team wants to use EASM findings as proof that every discovered server has healthy EDR. What is the key architectural correction?
Hybrid multicloud posture and exposure
✓ Correct answer
- Validate internal runtime protection separately because EASM observes external exposure
External observation cannot establish internal sensor health. A certificate does not prove EDR deployment, and DNS ownership does not prove patch state. Endpoint inventories provide complementary evidence and should remain.
Open this question’s page →263. Which two tasks are within an EASM-led external-surface program? Select two.
Hybrid multicloud posture and exposure
✓ Correct answers
- Identify external exposure findings for risk prioritization
- Discover related internet-facing hosts and domains
EASM discovers and evaluates the external surface. Local password rotation is LAPS, process telemetry is EDR, and Kubernetes admission enforcement belongs to cluster policy controls. Those may complement the program but are not EASM functions.
Open this question’s page →264. A neglected public management interface appears in EASM inventory. Which two next actions form a defensible response? Select two.
Hybrid multicloud posture and exposure
✓ Correct answers
- Confirm ownership and route the finding to an accountable service owner
- Assess business exposure and verify the chosen remediation
Ownership and business risk guide remediation, which must be verified. Unrelated score improvements do not close this exposure. Discovery does not automatically patch the host. Blanket approval ignores the uncertainty of inferred asset relationships.
Open this question’s page →265. Which description best defines an attack path in Security Exposure Management?
Hybrid multicloud posture and exposure
✓ Correct answer
- A route connecting an entry point and weaknesses to critical assets
An attack path models a potential end-to-end route to critical assets through connected weaknesses and permissions. A flat vulnerability ranking lacks relationships. A network route alone lacks exploitation and privilege context. The modeled path does not require a confirmed incident.
Open this question’s page →266. A server vulnerability links an internet entry point to a privileged identity and sensitive data. Why is context valuable?
Hybrid multicloud posture and exposure
✓ Correct answer
- It shows how the weakness can contribute to business impact
Path context connects weakness, permissions, and critical data to potential impact. It does not establish a confirmed compromise, eliminate ownership, or prove unrelated vulnerabilities harmless. Context supports priority and response.
Open this question’s page →267. Teams need coordinated progress metrics for ransomware protection rather than unrelated dashboard totals. Which feature should structure the effort?
Hybrid multicloud posture and exposure
✓ Correct answer
- A security initiative with related metrics and recommendations
A security initiative groups metrics and recommendations around ransomware protection to track preventive improvement. An OS inventory, one saved path query, and incident severity reporting can provide useful inputs, but none by itself organizes coordinated posture progress against that objective.
Open this question’s page →268. Attack paths disappear after a connector loses permissions. How should the architect interpret the result?
Hybrid multicloud posture and exposure
✓ Correct answer
- Treat missing paths as a possible data-coverage failure and restore collection
Incomplete data can suppress paths, so collection and inventory need verification. Absence is not proof of safety or remediation. Deleting the connector preserves the blind spot rather than reducing risk.
Open this question’s page →269. An attacker route involves a public service and an unnecessarily privileged identity. Which two changes can interrupt the path? Select two.
Hybrid multicloud posture and exposure
✓ Correct answers
- Reduce the identity’s excessive permissions
- Restrict unnecessary public reachability
Restricting the unnecessary entry point and reducing excessive identity privilege directly changes the modeled route. Certificate rotation unrelated to the exploited weakness, patching an unrelated asset, and additional logging do not remove the stated exposure or permission path. Reassess feasibility after remediation.
Open this question’s page →270. Which two requirements make a security exposure improvement process measurable and accountable? Select two.
Hybrid multicloud posture and exposure
✓ Correct answers
- Define critical assets and responsible remediation owners
- Track relevant initiative metrics and verify residual exposure
Criticality and ownership align remediation with business risk, while metrics and verification show progress. Raw finding count ignores impact. Missing telemetry creates uncertainty. Permanent unreviewed exceptions allow exposure to persist.
Open this question’s page →271. Which capability most directly detects and investigates malicious process activity on a supported server?
Server client IoT and OT security
✓ Correct answer
- Endpoint detection and response
EDR detects and investigates endpoint execution behavior. Configuration assessment examines posture, vulnerability scanning identifies known weaknesses, and EASM observes external assets. These complementary controls do not replace runtime process telemetry.
Open this question’s page →272. A company will protect Windows and several Linux distributions. What must the architect validate before specifying one feature set for all servers?
Server client IoT and OT security
✓ Correct answer
- Supported OS versions and feature prerequisites for each platform
Platform support and prerequisites establish which controls work. Policy assignment and a plan name do not prove feature support or effective enforcement. Windows-only settings cannot be assumed to work across Linux distributions.
Open this question’s page →273. A server vulnerability dashboard is current, but critical weaknesses remain open for months. Which requirement addresses the core gap?
Server client IoT and OT security
✓ Correct answer
- Prioritized remediation ownership, deadlines, and verification
Ownership, deadlines, and verification close assessed weaknesses. More scans alone refresh evidence. Suppression hides unresolved exposure. A paid plan can surface findings but does not implement a remediation process by itself.
Open this question’s page →274. An Arc-connected business server is compromised. The owner says registration transferred OS patching and administrator control to Microsoft. What is the correct responsibility statement?
Server client IoT and OT security
✓ Correct answer
- The customer retains host maintenance and access-control responsibilities
Arc is a management bridge and customers retain host security and access duties. It does not make Microsoft the administrator of local accounts or prove application patching. Inventory visibility is not a substitute for monitoring.
Open this question’s page →275. Which two requirements reduce server exposure before a vulnerability becomes an incident? Select two.
Server client IoT and OT security
✓ Correct answers
- Remediate prioritized vulnerabilities and remove unnecessary services
- Establish and assess a platform-appropriate secure configuration
Secure configurations and prioritized vulnerability remediation reduce exploitable conditions. Unsupported software without review retains risk. Universal host administration broadens compromise impact. A score target does not patch systems.
Open this question’s page →276. A server EDR rollout appears complete in the deployment tool, but the SOC receives no incidents. Which two checks best verify the security requirement? Select two.
Server client IoT and OT security
✓ Correct answers
- Confirm actual endpoint onboarding and usable threat telemetry
- Validate the alert integration and investigation workflow end to end
Operational EDR requires actual telemetry and a functioning response path. Installation and inventory records alone do not prove detection. Disabling integration suppresses evidence rather than fixing delivery or tuning legitimate noise.
Open this question’s page →277. Which Intune policy type primarily evaluates whether a device meets the organization’s access requirements?
Server client IoT and OT security
✓ Correct answer
- Device compliance policy
Compliance policies evaluate requirements and report status. Configuration profiles and firewall policies set device settings. App protection policies protect supported app data and do not replace full device compliance assessment.
Open this question’s page →278. A company permits personal phones but needs to protect corporate information within supported apps. Full-device enrollment is outside the requirement. Which design fits?
Server client IoT and OT security
✓ Correct answer
- Intune app protection policies with suitable access requirements
App protection policies govern corporate data in supported apps and can pair with suitable access requirements. A compliance-only policy does not supply app-data controls on these unmanaged phones. Full-device configuration requires enrollment beyond the stated scope. MFA authenticates users but does not govern copying or handling corporate app data.
Open this question’s page →279. How should a mobile threat-risk signal influence corporate access in an Intune-integrated design?
Server client IoT and OT security
✓ Correct answer
- Use supported threat-level signals in compliance or app protection and associated access decisions
Risk signals can feed compliance or app protection and access evaluation. A static firewall rule cannot consume the dynamic device-risk decision. Policy assignment does not establish cleared risk. Disabling compliance removes a needed enforcement input.
Open this question’s page →280. Two configuration sources assign contradictory antivirus values to a client. The architect proposes relying on whichever policy was created most recently. What is the better approach?
Server client IoT and OT security
✓ Correct answer
- Identify and resolve the overlap, then verify the effective device setting
Conflicting configuration values need deliberate resolution and effective-state verification. Creation time is not a universal precedence rule. Marking compliance without state evidence is misleading. Adding another contradiction worsens the conflict.
Open this question’s page →281. Which two controls are directly recommended to strengthen Defender for Endpoint protection? Select two.
Server client IoT and OT security
✓ Correct answers
- Cloud-delivered protection
- Tamper protection
Tamper protection guards settings and cloud-delivered protection strengthens threat prevention. Shared administrator credentials enable lateral movement. Disabling network protection and excluding all downloads weaken coverage rather than strengthening it.
Open this question’s page →282. A mixed-device estate has policy assignments but inconsistent protection. Which two architecture requirements address the gap? Select two.
Server client IoT and OT security
✓ Correct answers
- Validate supported controls separately for each device platform
- Measure resulting device configuration and health after policy deployment
Platform support and actual resulting state establish effective coverage. Windows settings do not map universally to mobile systems. Assignment alone does not prove receipt or enforcement. Removing risk signals weakens the ability to make informed access decisions.
Open this question’s page →283. A manufacturer wants to limit compromise to one device identity. Which design is better than embedding one secret in the entire fleet?
Server client IoT and OT security
✓ Correct answer
- Unique device credentials with protected key storage
Unique protected credentials limit the identity blast radius. Shared secrets and shared certificate private keys let compromise spread across devices. An unauthenticated endpoint cannot establish a trustworthy device identity.
Open this question’s page →284. A constrained device design needs hardware-backed identity protection during provisioning. Which component should the architect evaluate?
Server client IoT and OT security
✓ Correct answer
- A TPM or suitable hardware security capability
TPM or suitable hardware protects device key material and supports attestation. Cloud-only storage does not address credentials on the device. A shared fleet key expands compromise impact. TLS protects transport and does not by itself provide hardware key storage.
Open this question’s page →285. An IoT update download is completed over an encrypted channel. Which check still establishes the content’s intended authenticity and integrity?
Server client IoT and OT security
✓ Correct answer
- Validate the signed manifest and its trusted binary hashes
A trusted signed manifest authenticates the expected hashes, which the agent then compares with downloaded binaries. A hash from the same unauthenticated location could be replaced with the malicious binary. TLS certificate verification secures the connection but does not by itself authorize the intended firmware content.
Open this question’s page →286. A team chooses X.509 authentication but budgets only for initial certificate installation. Devices must operate for years. What requirement is missing?
Server client IoT and OT security
✓ Correct answer
- A practical certificate lifecycle and renewal process
X.509 authentication needs issuance, renewal, replacement, and trust lifecycle management for long-lived devices. Initial trust alone omits later change, long validity does not handle compromise or eventual expiry, and connectivity tests do not renew or replace credentials.
Open this question’s page →287. Which two security areas remain necessary for a cloud-connected embedded-device solution? Select two.
Server client IoT and OT security
✓ Correct answers
- Protect data and connections across device, edge, and cloud boundaries
- Protect device and edge assets and their credentials
A complete design protects assets and credentials as well as the data path. Cloud-only protection leaves the device boundary exposed. Possession is not trustworthy authentication. Low bandwidth does not remove confidentiality and integrity requirements.
Open this question’s page →288. A fleet lifecycle includes provisioning and updates but no retirement process. Which two actions should retirement explicitly address? Select two.
Server client IoT and OT security
✓ Correct answers
- Handle retained sensitive data and ongoing access according to the disposal policy
- Revoke or remove retired device identities and credentials
Retirement must remove identity/access and address retained data. Reusing active old credentials defeats isolation. Unplugging does not revoke cloud authorization. Removing inventory before verification loses evidence of successful decommissioning.
Open this question’s page →289. An industrial controller cannot install endpoint software. Which protection approach best provides security visibility?
Server client IoT and OT security
✓ Correct answer
- Defender for IoT agentless network monitoring
Defender for IoT network monitoring provides agentless OT-aware visibility. The controller cannot host the endpoint agent. VM disk scanning targets supported compute disks, while firewall connection logs do not by themselves supply industrial protocol and behavior analysis.
Open this question’s page →290. A plant deploys an OT sensor but connects it to no mirrored traffic feed. What is the most direct missing requirement?
Server client IoT and OT security
✓ Correct answer
- A suitable SPAN or TAP traffic source
SPAN or TAP supplies the industrial packets needed by the OT sensor. A connector or license alone does not supply observed traffic. An agent on another workstation does not guarantee visibility of controller communications.
Open this question’s page →291. A site must keep OT monitoring data fully on premises. Which configuration should the architect evaluate?
Server client IoT and OT security
✓ Correct answer
- Locally managed OT sensors with local console operations
Locally managed sensors provide analysis and console access on premises without mandatory Azure connectivity. Cloud-connected sensors or cloud-only console operations violate the stated data boundary. EASM observes public infrastructure rather than internal OT traffic.
Open this question’s page →292. An alert suggests isolating a controller that governs a safety-critical process. Which response principle should guide the design?
Server client IoT and OT security
✓ Correct answer
- Validate containment through the plant’s operational safety process and coordinated OT response
Safety-critical actions need operational validation and coordinated response. Blanket shutdown can create physical harm. Ignoring alerts retains compromise risk. A dashboard supplies information rather than replacing industrial safety or control systems.
Open this question’s page →293. Which two statements about OT sensor deployment are accurate? Select two.
Server client IoT and OT security
✓ Correct answers
- Locally managed sensors require manual threat-intelligence package updates
- Sensors can analyze mirrored industrial traffic without agents on every controller
Network sensors analyze observed traffic agentlessly, and local management requires manual intelligence updates. Analysis and alerting occur on the sensor rather than requiring all raw packets in Azure. Visibility depends on the feed. Cloud connectivity does not authorize unsafe control actions.
Open this question’s page →294. A large OT rollout has a healthy sensor in each building but several controller communications are absent from inventory. Which two checks best assess coverage? Select two.
Server client IoT and OT security
✓ Correct answers
- Validate sensor placement and SPAN/TAP configuration against expected device inventory
- Compare monitored traffic feeds with the network’s actual industrial communication paths
Feed-path comparison and expected-inventory validation determine observed coverage. A healthy sensor may receive incomplete traffic. Unsupported agents can be infeasible or disruptive. Dashboard availability does not establish visibility of every segment.
Open this question’s page →295. Which description best matches an Intune security baseline?
Server client IoT and OT security
✓ Correct answer
- A customizable group of recommended Windows security settings
An Intune security baseline groups recommended Windows configuration settings and allows customization. A compliance policy evaluates conditions, and an EDR policy configures a focused protection area. A baseline is not immutable or equally appropriate unchanged for every role.
Open this question’s page →296. A default baseline setting breaks a required business workflow during a pilot. What is the appropriate next step?
Server client IoT and OT security
✓ Correct answer
- Assess a justified tailored setting and document its security implications
Baselines support customization where justified, with risk and compatibility assessment. Immediate broad deployment repeats the disruption. Blanket permanent disablement abandons useful controls. One incompatible setting does not invalidate the whole baseline.
Open this question’s page →297. A baseline configures endpoint settings. Which complementary mechanism should evaluate whether resulting device state meets access requirements?
Server client IoT and OT security
✓ Correct answer
- Intune compliance policies with appropriate Conditional Access integration
Compliance policies assess required device-state conditions and supply that status to appropriate Conditional Access enforcement. Another configuration profile sets values rather than providing that evaluation. EDR onboarding and a location-only access rule do not establish the full required device compliance state.
Open this question’s page →298. A team assumes assigning the newest baseline version proves all clients use its intended values. What is the strongest verification requirement?
Server client IoT and OT security
✓ Correct answer
- Inspect resulting per-setting status, assignments, and conflicts on target devices
Effective device settings and status prove rollout better than template version alone. Offline devices may have stale settings. Deleting profiles without comparison can remove needed configuration or obscure differences.
Open this question’s page →299. Which two practices help deploy baselines safely? Select two.
Server client IoT and OT security
✓ Correct answers
- Pilot and tailor settings for validated business requirements
- Review overlapping policies for conflicting values
Piloting and justified tailoring manage compatibility, while overlap review prevents conflicts. Different roles can require different controls. Guidance evolves and must be reassessed. Assignment alone does not prove effective enforcement.
Open this question’s page →300. A baseline was correctly deployed last year, but new servers now have inconsistent settings. Which two measures address this drift? Select two.
Server client IoT and OT security
✓ Correct answers
- Continuously assess resulting configuration and remediate deviations
- Integrate secure configuration into new-resource deployment
Deployment guardrails prevent new gaps, and ongoing assessment detects drift. Old reports do not describe current resources. Permanent exemptions preserve risk. Inventory tags identify resources but do not enforce hardening.
Open this question’s page →301. Many workstations share the same local administrator password. Which Windows feature directly addresses that credential reuse?
Server client IoT and OT security
✓ Correct answer
- Windows LAPS
Windows LAPS directly manages and rotates each device local administrator password. PIM governs privileged role activation, BitLocker escrow supports disk recovery, and Windows Hello for Business changes user sign-in authentication. Those controls do not alone rotate the shared local administrator passwords.
Open this question’s page →302. An AD domain runs below Windows Server 2016 DFL. Which limitation must the LAPS architect account for?
Server client IoT and OT security
✓ Correct answer
- AD password encryption cannot be enabled until the DFL requirement is met
AD LAPS encryption requires DFL 2016 or later; clear-text attributes protected by ACLs remain possible below that level. Entra ID does not support DSRM backup. DSRM management also requires suitable DC operating-system support.
Open this question’s page →303. An administrator can read an encrypted LAPS attribute but cannot recover its clear-text password. Which permission most directly determines whether decryption succeeds?
Server client IoT and OT security
✓ Correct answer
- Authorization as the designated decryption principal, directly or through group membership
Encrypted LAPS passwords target a designated user or group for decryption. A caller must be authorized by that principal as well as able to read the attribute. Expiration-write rights, OU policy-link editing, and legacy clear-text attribute access do not authorize ciphertext decryption.
Open this question’s page →304. A domain has DFL 2016 and both Server 2016 and LAPS-capable Server 2019 DCs. Which DSRM design is supported?
Server client IoT and OT security
✓ Correct answer
- Manage DSRM passwords on the supported Server 2019+ DCs with AD encryption enabled
At DFL 2016+, supported Server 2019+ DCs can use LAPS DSRM management with AD encryption. Server 2016 DCs do not support that feature. Entra ID backup and clear-text DSRM backup are unsupported.
Open this question’s page →305. Which two requirements apply to Windows LAPS DSRM password backup? Select two.
Server client IoT and OT security
✓ Correct answers
- Enable the required AD password encryption
- Use Windows Server Active Directory as the backup directory
DSRM backup is supported in AD with encryption enabled. Entra ID is not a DSRM backup destination. Post-authentication reset is not supported for DSRM. Shared passwords conflict with managed per-device credentials and create reuse risk.
Open this question’s page →306. A team is preparing AD-backed encrypted Windows LAPS. Which two steps belong in the readiness checklist? Select two.
Server client IoT and OT security
✓ Correct answers
- Meet the DFL 2016+ requirement and update the LAPS AD schema
- Configure attribute access and the authorized decryption principal
Encrypted AD-backed deployment requires the domain prerequisite, schema preparation, and scoped access/decryption configuration. Broad read rights expose sensitive data. Entra-only backup does not require the AD schema steps. Ciphertext-read permission is distinct from decryption authority.
Open this question’s page →307. Who is responsible for guest OS patching on an Azure IaaS virtual machine?
SaaS PaaS IaaS containers and AI services
✓ Correct answer
- The customer
The customer retains responsibility for IaaS guest OS patching. Microsoft maintains the underlying physical platform, while Defender for Cloud and Arc can support assessment or management. Enabling either service does not automatically transfer the guest-OS patching responsibility to Microsoft.
Open this question’s page →308. A team migrates a web app from VMs to App Service. Which responsibility remains with the team?
SaaS PaaS IaaS containers and AI services
✓ Correct answer
- Securing its application configuration, identities, and data
PaaS moves underlying OS and physical infrastructure duties to Microsoft, while customer application settings, identities, and data remain customer responsibilities. Host firmware, platform OS operation, and datacenter access are provider responsibilities.
Open this question’s page →309. An architect wants all new storage services to begin with approved configurations. Which baseline approach fits best?
SaaS PaaS IaaS containers and AI services
✓ Correct answer
- Apply service-specific configuration requirements through deployment automation and policy
Service-specific requirements enforced through deployment automation and policy establish the approved configuration from the start. Audit-only assessments and runtime alerts identify issues but do not establish the initial configuration. An OS template does not express the relevant cloud-storage access, network, and data settings.
Open this question’s page →310. A SaaS team says provider-managed infrastructure means it can stop reviewing user access. Which design correction is required?
SaaS PaaS IaaS containers and AI services
✓ Correct answer
- Retain account, access, data, and controlled-setting governance
The customer retains identity, access, data, and configuration governance. Provider infrastructure security does not determine customer user entitlements. Physical-access review and OS patch reports do not establish SaaS access appropriateness.
Open this question’s page →311. Which two baseline responsibilities normally remain customer controlled across cloud service models? Select two.
SaaS PaaS IaaS containers and AI services
✓ Correct answers
- Protect and govern customer data
- Manage user permissions and access requirements
Customer identity/access and data governance remain necessary across models. Datacenter power, physical hypervisors, and provider backbone operation are underlying provider infrastructure responsibilities.
Open this question’s page →312. A company introduces policy guardrails for future deployments. Which two follow-up measures make the baseline program complete? Select two.
SaaS PaaS IaaS containers and AI services
✓ Correct answers
- Assign owners and reassess configuration drift
- Assess and remediate existing resources against the intended baseline
Existing-resource remediation and ongoing drift/ownership processes close the full lifecycle. New-deployment guardrails need not retroactively fix existing assets. Services require tailored controls. Template approval does not establish effective live configuration.
Open this question’s page →313. Which identity design most directly supports revoking one compromised IoT device without replacing every fleet credential?
SaaS PaaS IaaS containers and AI services
✓ Correct answer
- Distinct device identities and scoped credentials
Distinct identities permit targeted revocation. A shared hub-owner secret grants excessive service authority and creates fleet-wide exposure. Anonymous ingestion cannot reliably identify a device. A shared administrator account prevents proper per-device isolation.
Open this question’s page →314. A backend service needs only a specific IoT Hub operation. What access design best follows least privilege?
SaaS PaaS IaaS containers and AI services
✓ Correct answer
- Use supported Entra authentication with the appropriate scoped role
Use supported Entra authentication with a role and scope matching the required service operation. A full hub-owner key or unnecessarily broad Data Contributor scope grants excess authority. A management-plane Reader role does not automatically authorize IoT Hub data-plane operations.
Open this question’s page →315. A hub uses private endpoints. A developer wants to remove device authentication because the path is private. What is the correct design?
SaaS PaaS IaaS containers and AI services
✓ Correct answer
- Retain device authentication and authorization in addition to private connectivity
Private connectivity controls reachability, not device identity or allowed operations. DNS resolution and IP reachability do not establish a trustworthy device. Hub-wide administration violates least privilege.
Open this question’s page →316. An IoT analytics dashboard is proposed as the sole authority for an emergency industrial shutdown. Which architecture change is required?
SaaS PaaS IaaS containers and AI services
✓ Correct answer
- Keep safety-critical decisions governed by validated operational safety processes
Cloud monitoring should not be the sole safety authority; validated operational processes must govern critical control. Telemetry presence does not authorize shutdown. Reader roles should not imply unrestricted commands. Monitoring remains useful alongside safety systems.
Open this question’s page →317. Which two requirements strengthen an IoT Hub security design? Select two.
SaaS PaaS IaaS containers and AI services
✓ Correct answers
- Limit backend service access to required operations
- Use protected renewable device credentials
Renewable device credentials and scoped backend operations reduce compromise and privilege risks. Shared service-owner keys enlarge the blast radius. Private paths do not replace authorization. Managed services still require customer security monitoring and access governance.
Open this question’s page →318. An edge gateway connects industrial devices to cloud analytics. Which two boundaries need explicit controls? Select two.
SaaS PaaS IaaS containers and AI services
✓ Correct answers
- The OT-to-edge network and permitted command paths
- The edge-to-cloud identity, data, and service-access paths
The local operational path and cloud connection both carry sensitive data and authority. Securing only the subscription leaves gateway risk. Telemetry encryption does not authorize commands. Device names do not compensate for shared credentials.
Open this question’s page →319. An internet-facing web app needs inspection for SQL injection and cross-site scripting patterns. Which control fits?
SaaS PaaS IaaS containers and AI services
✓ Correct answer
- Web application firewall
WAF inspects web application patterns. DDoS protection addresses volumetric availability threats. An NSG allows or denies network flows without application attack inspection. DNS supplies name resolution rather than HTTP payload inspection.
Open this question’s page →320. An App Service application must be reachable only through a private network. Which design best meets the requirement?
SaaS PaaS IaaS containers and AI services
✓ Correct answer
- Configure a private endpoint, disable public access, and provide correct private DNS
A private endpoint, disabled public access, and working private DNS establish the intended private-only ingress. A private endpoint can coexist with public access. VNet integration controls outbound connectivity. Public-IP access restrictions narrow public ingress but retain a public path rather than implementing the requested private-only connection.
Open this question’s page →321. A web app has an App Service private endpoint, but its outbound calls to a private database fail. Which distinction should guide diagnosis?
SaaS PaaS IaaS containers and AI services
✓ Correct answer
- Private endpoint is inbound; evaluate outbound integration, routing, DNS, and dependency permissions
The app’s private endpoint serves ingress, so outbound connectivity and authorization need separate review. It does not guarantee dependency routes. WAF inspection does not build private routing. A network address does not grant database permission.
Open this question’s page →322. A developer who can change a production app cannot directly read its secrets. The app’s identity can read sensitive data. What risk should the architect assess?
SaaS PaaS IaaS containers and AI services
✓ Correct answer
- Deployment rights can let the developer execute code under the app’s identity
Deployment authority can become access through code running as the app identity. Direct secret-reading permission is not the only route. Private ingress does not constrain trusted code’s service permissions. WAF does not establish deployment provenance.
Open this question’s page →323. Which two controls address different layers of public web workload protection? Select two.
SaaS PaaS IaaS containers and AI services
✓ Correct answers
- DDoS protection for supported volumetric availability attacks
- WAF for supported application-layer web attacks
WAF and DDoS protection address distinct web and volumetric threats. TLS secures the channel rather than application input. NSGs filter flows instead of payloads. A private endpoint serves a private path and does not supply public ingress attack inspection.
Open this question’s page →324. After making an App Service private, which two checks demonstrate the intended ingress boundary? Select two.
SaaS PaaS IaaS containers and AI services
✓ Correct answers
- Public internet clients cannot use an unintended public entry point
- Authorized private clients resolve and reach the private endpoint
Positive private-path testing and negative public-path testing verify ingress. DNS resolution should not confer application administration. Untested creation is insufficient. Outbound integration is a separate direction and cannot prove inbound isolation.
Open this question’s page →325. Which capability most directly identifies known vulnerable packages in a supported container image?
SaaS PaaS IaaS containers and AI services
✓ Correct answer
- Container image vulnerability assessment
Image vulnerability assessment checks software packages for known vulnerabilities. Signing verifies trusted provenance and integrity, runtime sensing observes execution behavior, and registry network and access restrictions protect artifact access. Those alone do not assess package vulnerability.
Open this question’s page →326. A container receives privileged host access but only needs to serve HTTP requests. Which change most directly reduces compromise impact?
SaaS PaaS IaaS containers and AI services
✓ Correct answer
- Remove unnecessary privilege and host access
Remove the unnecessary privilege and host access to reduce post-compromise reach. Image signing and scanning are valuable artifact controls, while ingress restrictions narrow entry paths; none of the stated alternatives removes the excessive host authority available after the container is compromised.
Open this question’s page →327. A clean image scan is used to justify removing container runtime detection. Why is that reasoning incomplete?
SaaS PaaS IaaS containers and AI services
✓ Correct answer
- Known-package assessment does not detect every malicious action after execution
Image assessment and runtime telemetry address different conditions. A scan is not a continuous execution record, does not justify host-administrator trust, and does not automatically enforce all admission policies.
Open this question’s page →328. A registry image was rebuilt to fix a critical vulnerability, but deployed pods remain pinned to the old image digest. What should the architect require?
SaaS PaaS IaaS containers and AI services
✓ Correct answer
- Deploy the corrected image and verify the effective running artifact
Deploy the corrected image digest and verify that running pods use it. A fixed but unused registry image does not change existing workloads. Scanning only the replacement artifact misses running exposure. Restarting with the old pinned digest continues to execute the vulnerable artifact.
Open this question’s page →329. Which two practices strengthen container artifact security? Select two.
SaaS PaaS IaaS containers and AI services
✓ Correct answers
- Keep production credentials out of image layers
- Limit who can push or replace production images
Registry write protection and avoiding embedded credentials limit supply-chain and secret exposure. Shared secrets broaden compromise. Read access should not imply deployment authority. Unverified mutable changes weaken artifact traceability.
Open this question’s page →330. A container platform needs both known-vulnerability visibility and detection of suspicious process execution. Which two capabilities should it retain? Select two.
SaaS PaaS IaaS containers and AI services
✓ Correct answers
- Healthy runtime sensor telemetry
- Supported image vulnerability assessment
Image vulnerability assessment and healthy runtime telemetry supply known-package findings and suspicious-execution detection. Signature checks verify integrity and provenance, admission checks enforce configuration, and private registry access restricts artifact paths. Those alone do not provide both required detection capabilities.
Open this question’s page →331. Which control most directly limits a development team’s Kubernetes authority to its required resources?
SaaS PaaS IaaS containers and AI services
✓ Correct answer
- Appropriate namespace-scoped RBAC
Namespace-scoped RBAC binds permitted operations to the resources the team needs. Namespace separation alone does not define user permissions. Cluster-wide bindings exceed the scope, and network policy constrains workload traffic rather than administrative operations.
Open this question’s page →332. Two workloads use separate namespaces but can still communicate freely. What requirement should the architect add?
SaaS PaaS IaaS containers and AI services
✓ Correct answer
- Enforced network policies for permitted workload communication
Network policies constrain pod flows when enforced. Namespaces alone do not guarantee network separation. API privacy secures administration rather than all workload traffic. RBAC controls operations and is not a substitute for pod packet filtering.
Open this question’s page →333. A team needs to reject workloads whose configuration violates approved cluster rules before deployment. Which capability fits?
SaaS PaaS IaaS containers and AI services
✓ Correct answer
- Azure Policy for Kubernetes admission enforcement
Azure Policy admission enforcement can reject disallowed configuration before deployment. Audit-only policy reports violations without denying admission. Image findings assess packages, and runtime sensors observe execution after admission. Those do not provide the requested rejection at admission.
Open this question’s page →334. An AKS API server is private, but an application service exposes sensitive workloads publicly. What is the correct assessment?
SaaS PaaS IaaS containers and AI services
✓ Correct answer
- Private API access does not establish workload ingress protection; review service exposure and authorization
Control-plane privacy and workload ingress are separate boundaries. Private API access does not make every Service private or provide WAF inspection. Kubernetes administrative RBAC does not replace application authorization for external users.
Open this question’s page →335. Which two controls address different Kubernetes trust boundaries? Select two.
SaaS PaaS IaaS containers and AI services
✓ Correct answers
- Network policies for permitted workload traffic
- RBAC for authorized cluster operations
RBAC controls operations while network policies constrain traffic. Names do not automatically firewall namespaces. Image tags are not authentication. Universal cluster-admin grants excessive deployment authority.
Open this question’s page →336. A cluster has agentless posture discovery, but the requirement includes suspicious runtime activity and policy rejection at admission. Which two additional capabilities should be evaluated? Select two.
SaaS PaaS IaaS containers and AI services
✓ Correct answers
- Azure Policy for Kubernetes or equivalent admission enforcement
- The supported Defender runtime sensor
A supported runtime sensor and admission enforcement provide the two missing capabilities. Image assessment identifies package weaknesses, RBAC governs authorized operations, and network policy constrains traffic. Those controls complement the design but do not themselves supply suspicious runtime detection and configuration rejection at admission.
Open this question’s page →337. An Azure AI application should avoid storing a long-lived service API key where supported. Which authentication approach fits?
SaaS PaaS IaaS containers and AI services
✓ Correct answer
- Microsoft Entra managed identity with scoped permissions
A managed identity provides supported service tokens with scoped permissions and avoids a stored API key. A service principal client secret introduces another stored credential. Private connectivity does not change API-key authentication, and frontend authentication alone can leave the static backend key in place.
Open this question’s page →338. A private AI endpoint still depends on a publicly exposed storage account and unrestricted outbound access. Which design principle addresses this gap?
SaaS PaaS IaaS containers and AI services
✓ Correct answer
- Review and secure the full dependency and data-flow boundary
AI security includes supporting services, DNS, egress, and permissions. A private endpoint does not automatically secure all dependencies. Disabling private DNS can break the intended path. Content filtering is not a substitute for storage network controls.
Open this question’s page →339. A team needs to reduce abusive AI API consumption and malformed requests. Which gateway controls are appropriate?
SaaS PaaS IaaS containers and AI services
✓ Correct answer
- Rate limiting and schema validation
Rate limiting constrains consumption and schema validation rejects malformed requests. WAF rules alone do not define API usage quotas. Network isolation can still allow abusive authenticated calls. Output filtering occurs after request processing and does not replace gateway request controls.
Open this question’s page →340. An AI agent can propose transferring confidential data to an external service. What design best limits high-risk action impact?
SaaS PaaS IaaS containers and AI services
✓ Correct answer
- Require an independent approved workflow and scoped action permissions
Human approval for high-risk operations and scoped permissions control authority independently of the model. System prompts guide behavior but do not confer safety guarantees. Private networking and output format do not establish transfer authorization.
Open this question’s page →341. Which two networking controls help secure Azure AI platform services? Select two.
SaaS PaaS IaaS containers and AI services
✓ Correct answers
- Private endpoints with correct private name resolution
- Restricted outbound access to approved dependencies
Private paths with DNS and approved egress constrain network exposure. Cloud management does not eliminate exfiltration risk. WAF complements rather than replaces authentication. At-rest encryption does not control network reachability.
Open this question’s page →342. A design already uses scoped identities and private endpoints. Which two AI-specific controls provide complementary protection? Select two.
SaaS PaaS IaaS containers and AI services
✓ Correct answers
- Layered input and output content filtering
- Adversarial testing and monitoring of suspicious AI usage
Layered content filtering and adversarial testing with monitoring address AI interaction threats beyond the existing identity and network controls. Another private endpoint or additional service-role scoping strengthens those same boundaries, while rate limits constrain volume. These alone do not detect malicious prompt content or test adversarial model behavior.
Open this question’s page →343. A design needs to allow only specific network ports between Azure subnets. Which control directly meets that flow-filtering requirement?
Network security and Security Service Edge
✓ Correct answer
- Network security groups
NSG rules directly filter permitted subnet flows and ports. WAF inspects supported web traffic. An application security group identifies resources for rules but does not enforce a filter by itself. A route table selects paths rather than defining port-based allow and deny decisions.
Open this question’s page →344. A security requirement includes outbound TLS inspection and signature-based intrusion prevention in Azure Firewall. Which SKU should be evaluated?
Network security and Security Service Edge
✓ Correct answer
- Azure Firewall Premium
Premium provides TLS inspection and IDPS. Standard and Basic do not provide those Premium inspection capabilities. NSGs filter flows and cannot act as an equivalent TLS or signature inspection engine.
Open this question’s page →345. A private endpoint is approved, but an on-premises client resolves the service name to an unsuitable public path. What should be reviewed first?
Network security and Security Service Edge
✓ Correct answer
- Private DNS resolution and forwarding from the client’s network
Private DNS and forwarding determine the resolved connection address. Certificate renewal affects TLS trust, role assignments affect authorization, and WAF detection mode affects inspection. None fixes an incorrect public resolution path.
Open this question’s page →346. A firewall is healthy, but sensitive workloads have an alternate direct route to the internet. What is the principal security concern?
Network security and Security Service Edge
✓ Correct answer
- Traffic can bypass intended egress inspection and destination controls
Security enforcement requires traffic to traverse the intended appliance. Appliance health does not prove routing. Private endpoints do not remove every unrelated public route. NSG flow identification does not provide TLS inspection.
Open this question’s page →347. An NSG allow rule is removed during containment, but an established SSH session remains connected. Which two statements explain this behavior? Select two.
Network security and Security Service Edge
✓ Correct answers
- Existing established connections can remain active after the allow rule is removed
- New connections are evaluated against the updated NSG rules
NSGs are stateful, and rule changes apply to new connections rather than necessarily interrupting established flows. Return traffic for an allowed established flow does not need a separate explicit opposite-direction rule. Lower numeric priorities are evaluated first. Verify new connections and use suitable session termination when immediate containment is required.
Open this question’s page →348. A team using Azure Firewall wants to block one HTTPS path while allowing other paths on the same host. Which two requirements follow from the inspection model? Select two.
Network security and Security Service Edge
✓ Correct answers
- Plan supported TLS inspection and client trust for encrypted traffic
- Use full URL filtering rather than only FQDN filtering
Path-specific decisions require URL visibility, and HTTPS visibility requires a supported inspection/trust design. FQDN rules identify hosts, not every path. NSGs inspect flow attributes. Disabling certificate validation weakens security instead of establishing safe inspection.
Open this question’s page →349. Remote employees need identity-aware filtering for public internet and SaaS browsing. Which Microsoft service fits?
Network security and Security Service Edge
✓ Correct answer
- Microsoft Entra Internet Access
Entra Internet Access provides the identity-aware cloud-edge SWG for public internet and SaaS browsing. Private Access targets private resources. Browser session controls apply to their supported app sessions rather than providing this general SWG. An Azure Firewall deployment supplies Azure-network filtering but does not by itself provide the requested Entra user-aware cloud-edge access service.
Open this question’s page →350. A user group must block a web category but allow one approved domain in that category. Which policy design should the architect evaluate?
Network security and Security Service Edge
✓ Correct answer
- An ordered security profile with a higher-priority domain exception and a lower-priority category rule
Place the specific domain allow at a higher priority than the broad category block. An undifferentiated block omits the exception, and placing the category block first can prevent the domain exception from being reached. A private app definition does not configure the public web filtering exception.
Open this question’s page →351. No Conditional Access policy is linked to the Internet Access baseline security profile. What is the documented behavior for routed internet traffic?
Network security and Security Service Edge
✓ Correct answer
- The baseline still applies as a lowest-priority catch-all
The baseline applies to all Internet Access traffic routed through the service at the lowest priority. It does not require a linked Conditional Access policy, does not replace higher-priority rules, and does not treat device compliance as universal destination approval.
Open this question’s page →352. A filtering design relies on host identity from TLS SNI but claims to distinguish every encrypted path on that host. Which correction is required?
Network security and Security Service Edge
✓ Correct answer
- Full path decisions need supported URL visibility and TLS inspection where required
SNI identifies a host, so full path inspection requires additional supported visibility. It does not carry every HTTP path. Category assignment does not establish every page’s safety. Policy assignment is not evidence of payload decryption or inspection.
Open this question’s page →353. Which two objects form the basic identity-aware filtering policy model? Select two.
Network security and Security Service Edge
✓ Correct answers
- Filtering policies grouped in security profiles
- Conditional Access policies that target the relevant users and profiles
Filtering policies are ordered in security profiles, and Conditional Access links the appropriate profiles to user context. Traffic profiles acquire traffic but do not replace filtering policies. Private connector groups route private apps, and device compliance policies evaluate device state rather than containing SWG category rules.
Open this question’s page →354. A pilot has an assigned policy, but some user traffic bypasses the service. Which two checks establish effective SWG coverage? Select two.
Network security and Security Service Edge
✓ Correct answers
- Inspect traffic logs and test expected allowed and denied destinations
- Verify the intended traffic profile and actual acquisition path
The acquisition path determines coverage, and traffic evidence plus positive/negative tests demonstrate enforcement. Licensing alone does not route traffic. Private connector health does not prove public SWG acquisition. Missing logs may reflect bypass and must be investigated.
Open this question’s page →355. Which profile should acquire supported SharePoint Online and Entra ID authentication traffic in Global Secure Access?
Network security and Security Service Edge
✓ Correct answer
- Microsoft traffic profile
The Microsoft traffic profile acquires its supported Microsoft services. The Internet Access profile cannot replace that acquisition, and a private application profile targets internal resources. The compliant-network named location is an enforcement signal rather than the traffic acquisition profile.
Open this question’s page →356. A company permits collaboration with one partner tenant but wants acquired authentication attempts to other unauthorized tenants blocked. Which design fits?
Network security and Security Service Edge
✓ Correct answer
- Configure tenant restrictions v2 exceptions and enable universal tenant restrictions signaling
Tenant restrictions v2 defines permitted external tenant access; universal restrictions signaling makes that policy available on acquired authentication traffic. Inbound B2B policies address entry into the company tenant rather than all external-tenant authentication. Forwarding alone does not define tenant restrictions. Geographic location does not identify which external tenant is permitted.
Open this question’s page →357. A resource tenant requires its compliant network signal. A guest connects through Global Secure Access for a different tenant. What should the architect expect?
Network security and Security Service Edge
✓ Correct answer
- That connection does not automatically satisfy the resource tenant’s tenant-specific network requirement
The compliant network requirement is tenant specific. Another tenant’s service does not automatically satisfy it. Guest status does not inherently bypass policy, and a public IP match is not equivalent to the tenant-bound network signal.
Open this question’s page →358. A user disables the Global Secure Access client but an existing app session still works. The tester concludes the compliant-network policy is broken. What test should be run?
Network security and Security Service Edge
✓ Correct answer
- Start a fresh sign-in session and compare access with the client enabled and disabled
Compliant-network checks are reevaluated when sign-in is required, so a fresh session is needed. Existing access does not prove the next authentication outcome. Geographic locations are a different signal. Deleting the requirement abandons validation rather than testing it.
Open this question’s page →359. Which two steps are necessary for a universal tenant restrictions deployment? Select two.
Network security and Security Service Edge
✓ Correct answers
- Define the tenant restrictions v2 default and partner-specific policy
- Enable Global Secure Access tenant restriction signaling
The restrictions policy defines the decision and signaling delivers the policy context on acquired authentication traffic. Forwarding alone does not define allowed tenants. Private connectors serve private resources, and EASM asset discovery is not an Entra tenant policy.
Open this question’s page →360. Which two requirements improve the validity of a compliant-network pilot? Select two.
Network security and Security Service Edge
✓ Correct answers
- Test fresh sign-ins through and outside the required tenant’s Global Secure Access path
- Enable the required source IP restoration prerequisite
Source IP restoration is a documented prerequisite, and fresh sign-in tests verify the tenant-bound path. Compliant network does not require maintaining egress IP ranges. Existing sessions may persist until reevaluation. Other-tenant paths do not automatically satisfy the required signal.
Open this question’s page →361. A remote user needs TCP access to an internal SMB file share without broad legacy VPN network access. Which product should be evaluated?
Network security and Security Service Edge
✓ Correct answer
- Microsoft Entra Private Access
Entra Private Access supports identity-aware access to designated private TCP resources such as this file share. Internet web filtering protects public destinations. Application proxy web publishing and browser session controls target web applications rather than brokering the stated SMB connection.
Open this question’s page →362. A finance app needs stricter Conditional Access than general private resources. Which definition provides the finer policy boundary?
Network security and Security Service Edge
✓ Correct answer
- A separate per-app Global Secure Access application
A separate per-app definition provides its own resource scope, user assignment, and Conditional Access boundary. A broad Quick Access app with identical permissions cannot differentiate finance. Connector placement and DNS aliases do not by themselves create a separate enterprise-application policy boundary.
Open this question’s page →363. A network team wants to publish inbound internet ports to an internal connector solely for Private Access. What should the architect recommend?
Network security and Security Service Edge
✓ Correct answer
- Use the connector’s required outbound service connections and private backend reachability
The connector uses outbound cloud connections and private backend reachability. Inbound NAT is not required for that channel. A site-to-site route alone does not establish the Private Access connector service. Direct public backend access bypasses the intended private-access boundary.
Open this question’s page →364. The cloud app assignment and Conditional Access succeed, but only one connector in a group cannot reach the backend FQDN. What should be investigated?
Network security and Security Service Edge
✓ Correct answer
- That connector’s DNS, routing, and destination connectivity
The failure is connector specific after user policy succeeds, so inspect its backend path. User assignment and sign-in success validate identity stages rather than this route. A peer connector’s health does not prove the failing connector shares its reachability.
Open this question’s page →365. Which two measures support a resilient Private Access connector design? Select two.
Network security and Security Service Edge
✓ Correct answers
- Deploy at least two connectors in the relevant group
- Ensure each connector can reach required services and private backends
At least two connectors in the relevant group plus verified cloud and backend reachability provide a usable failover path. Current single-connector health does not remove that failure point. An unmapped backup group does not participate in the app group failover, and a larger sole VM adds capacity without connector redundancy.
Open this question’s page →366. A proposed VPN replacement grants every employee a broad private IP range. Payroll needs a smaller authorized group and different access conditions. Which two changes fit the requirement? Select two.
Network security and Security Service Edge
✓ Correct answers
- Assign only the required users and apply payroll-specific Conditional Access
- Define payroll as a scoped per-app private resource
Per-app scope with explicit users and Conditional Access reduces the network-access boundary. Broad tunnel access does not establish data authorization. Payroll authorization remains necessary. Connector administration should not imply business-data entitlements.
Open this question’s page →367. An architect needs a tenant-wide metric for recommended security actions affecting Microsoft 365 identities, apps, and devices. Which metric should be selected?
Microsoft 365 Intune Purview and Copilot
✓ Correct answer
- Microsoft Secure Score
Microsoft Secure Score covers recommended improvements for supported Microsoft 365 identities, apps, and devices. Defender for Cloud secure score concerns cloud-resource posture. Vulnerability severity and mail delivery success are narrower measures and do not replace the requested tenant posture metric.
Open this question’s page →368. A collaboration team increases its score after applying a protection policy to half its users. Which conclusion is best supported?
Microsoft 365 Intune Purview and Copilot
✓ Correct answer
- The control may have earned partial points and coverage still requires review
Some Secure Score actions award proportional points, so coverage must be checked. An increase does not prove universal assignment, regulatory compliance, or the absence of successful attacks.
Open this question’s page →369. An organization already satisfies a recommended control through a validated third-party product. What is the best way to handle the recommendation?
Microsoft 365 Intune Purview and Copilot
✓ Correct answer
- Record the applicable alternate mitigation and retain validation evidence
Secure Score supports non-Microsoft solutions and alternate mitigations. Duplicating protection solely for points is unnecessary; accepting unrelated risk misrepresents posture, and removing a working control increases exposure.
Open this question’s page →370. Two proposed actions compete for the same maintenance window. One earns more points but protects a low-value pilot; the other closes broad access to a merger workspace. What should determine the decision?
Microsoft 365 Intune Purview and Copilot
✓ Correct answer
- Prioritize the exposed business-critical data and verify the resulting access boundary
Business impact and exposure should drive priority, so the merger workspace deserves attention. Point totals alone cannot rank local risk, waiting for a benchmark leaves exposure open, and peer performance does not justify accepting access to critical data.
Open this question’s page →371. A board asks for evidence that a rising Secure Score represents meaningful improvement. Which two supporting measures should the architect include? Select two.
Microsoft 365 Intune Purview and Copilot
✓ Correct answers
- Validation of major exceptions and control effectiveness
- Protection coverage across intended users and devices
Coverage and validation connect the posture metric to effective protection. Policy-object counts do not prove enforcement. Approved exceptions need validation rather than mere counting. A point increase cannot guarantee freedom from compromise.
Open this question’s page →372. A high score coexists with an unmanaged collaboration exception for a critical partner. Which two actions are appropriate? Select two.
Microsoft 365 Intune Purview and Copilot
✓ Correct answers
- Document the exception, business risk, owner, and compensating control
- Test the partner's actual access and data movement against the requirement
An accountable exception and practical access testing expose residual risk. A peer benchmark does not justify permanent acceptance, excluded sessions need their own coverage evidence, and posture scoring does not replace incident detection.
Open this question’s page →373. Users receive links that can become malicious after message delivery. Which capability directly addresses supported click-time link protection?
Microsoft 365 Intune Purview and Copilot
✓ Correct answer
- Safe Links
Safe Links protects supported link clicks. Safe Attachments analyzes attachments, SaaS posture management assesses app configuration, and device configuration does not provide this email link service.
Open this question’s page →374. A security team needs controlled phishing simulations and automated investigation of email threats. Which selection fits?
Microsoft 365 Intune Purview and Copilot
✓ Correct answer
- Defender for Office 365 Plan 2 with the relevant capabilities configured
Plan 2 adds attack simulation and automated investigation capabilities. Built-in filtering and Plan 1 do not provide the requested complete feature set, while SaaS discovery addresses application usage.
Open this question’s page →375. A supported SaaS app must remain usable from unmanaged browsers, but downloads of confidential files must be restricted. Which design should be evaluated?
Microsoft 365 Intune Purview and Copilot
✓ Correct answer
- Conditional Access App Control session policies for the supported app and session path
Supported session controls can restrict downloads while retaining approved unmanaged-browser use. Blocking all unmanaged devices violates the availability requirement. SaaS posture assessment addresses configuration, and OAuth consent review addresses app permissions rather than interactive browser downloads.
Open this question’s page →376. A recently consented OAuth application reads many mailboxes while users are offline. Browser download restrictions are enabled. What is the most relevant next control?
Microsoft 365 Intune Purview and Copilot
✓ Correct answer
- Investigate app permissions and behavior through app governance and consent controls
App governance and consent controls address app-to-app permissions and behavior. Browser timeouts do not govern offline API access, Safe Attachments focuses on malicious attachments, and discovery alone does not govern the granted permissions.
Open this question’s page →377. A company wants to strengthen email protection against both sender spoofing and malicious attachments. Which two measures fit? Select two.
Microsoft 365 Intune Purview and Copilot
✓ Correct answers
- Configure Safe Attachments for intended recipients and supported workloads
- Configure SPF, DKIM, and DMARC for the relevant domains
Sender authentication complements Safe Attachments. Authentication alone does not prove benign content, SaaS posture scoring is not attachment analysis, and disabling user reporting weakens response.
Open this question’s page →378. An architect evaluates a SaaS protection proposal. Which two statements correctly identify limits or dependencies? Select two.
Microsoft 365 Intune Purview and Copilot
✓ Correct answers
- Session enforcement requires support for the target application and client access path
- OAuth permission abuse can require governance beyond browser session policies
App and client support determine session coverage, and OAuth API access requires appropriate app governance. Connected apps do not all offer identical enforcement, discovery is not proof of blocking, and email protection does not replace consent governance.
Open this question’s page →379. A company allows personal mobile devices and wants corporate data protected inside supported apps without managing the entire device. Which approach best fits?
Microsoft 365 Intune Purview and Copilot
✓ Correct answer
- Use Intune app protection policies
App protection policies protect corporate information in supported apps without full enrollment. Full MDM exceeds the stated management boundary. Device-wide wipe risks personal data. Compliance evaluation alone does not provide in-app data-transfer protections.
Open this question’s page →380. A policy sets required device settings, another evaluates required device state, and access must depend on that state. Which component makes the access decision?
Microsoft 365 Intune Purview and Copilot
✓ Correct answer
- Conditional Access consuming the compliance signal
Conditional Access makes the resource-access decision using compliance. A local app PIN protects app entry, configuration sets device state, and EDR onboarding enables endpoint protection. None alone implements the required cloud access decision.
Open this question’s page →381. A departing contractor used corporate mail in a supported protected mobile app on a personal phone. The organization should remove its data while preserving personal photos. What should be selected?
Microsoft 365 Intune Purview and Copilot
✓ Correct answer
- A selective app wipe of organizational data
Selective app wipe removes supported corporate app data while preserving personal content. Factory reset exceeds that boundary. Compliance evaluation does not itself remove local corporate data. Mail retention preserves server content rather than wiping the protected mobile app.
Open this question’s page →382. A BYOD pilot enforces app protection for one mail app. Users can access the same corporate data through another client that does not participate in the protection design. What is the most appropriate architecture change?
Microsoft 365 Intune Purview and Copilot
✓ Correct answer
- Validate supported clients and enforce the intended protected access path with Conditional Access
Supported client validation and access enforcement close the bypass path. App protection does not automatically govern every app, abandoning all protection is unnecessary, and a PIN in one app leaves the other route open.
Open this question’s page →383. Which two requirements are directly addressed by supported Intune app protection policies? Select two.
Microsoft 365 Intune Purview and Copilot
✓ Correct answers
- Restrict organizational data transfer to personal apps
- Require additional access protection such as an app PIN
App PINs and supported transfer restrictions are app protection controls. OS patching and universal device-wide configuration exceed the app-data boundary. Mobile app protection does not classify all SharePoint content.
Open this question’s page →384. An Intune design must protect corporate mobile data without confusing policy roles. Which two statements are correct? Select two.
Microsoft 365 Intune Purview and Copilot
✓ Correct answers
- Conditional Access can require the relevant compliance or app protection state
- Compliance evaluates required device conditions
Compliance evaluates state and Conditional Access enforces supported access requirements. Evaluation alone does not guarantee cloud access blocking, apps must participate in the protection framework, and selective app wipe targets organizational rather than all personal data.
Open this question’s page →385. Sensitive spreadsheets must retain classification and supported encryption when shared as files. Which Purview capability is the primary fit?
Microsoft 365 Intune Purview and Copilot
✓ Correct answer
- Sensitivity labels configured with encryption and rights
Configured sensitivity labels can attach classification and encryption rights to supported files. Retention addresses lifecycle, audit supplies activity evidence, and peer comparison measures posture rather than protecting the file.
Open this question’s page →386. A bank wants to stop matching account information from being shared with an unauthorized audience through a supported Microsoft 365 location. Which policy type should be evaluated?
Microsoft 365 Intune Purview and Copilot
✓ Correct answer
- A DLP policy with suitable classifiers, conditions, scope, and actions
DLP detects sensitive content and context and applies supported transfer actions. A marking-only label does not enforce the required audience restriction. Retention governs preservation/deletion. eDiscovery investigates and preserves content rather than providing the stated transfer-policy enforcement.
Open this question’s page →387. The legal team needs to preserve, review, and produce mail relevant to a dispute. Which capability is most appropriate?
Microsoft 365 Intune Purview and Copilot
✓ Correct answer
- Purview eDiscovery
eDiscovery supports the complete preservation, review, and production workflow. Retention supports lifecycle preservation but not the full legal review and production case. Audit searches activity records rather than producing the relevant mail corpus. Label publishing classifies/protects content rather than conducting the case.
Open this question’s page →388. A project site receives a confidentiality label. Administrators assume that all documents downloaded from it are now encrypted. What should the architect verify first?
Microsoft 365 Intune Purview and Copilot
✓ Correct answer
- Whether file-level labeling and encryption are actually configured for the required content
Container labels and file protection have different scopes, so actual file-level labeling and encryption must be tested. Container sharing restrictions do not automatically encrypt downloaded files, retention addresses lifecycle, and an activity record alone is not proof of encryption.
Open this question’s page →389. An organization needs to both prevent inappropriate transfers and preserve contracts for seven years. Which two control families should be combined? Select two.
Microsoft 365 Intune Purview and Copilot
✓ Correct answers
- DLP with conditions and actions for the transfer requirement
- Retention or records controls for the preservation requirement
DLP and retention solve the two distinct requirements. A watermark does not enforce all transfers, cloud discovery does not preserve records for a period, and disabling audit weakens evidence.
Open this question’s page →390. Which two validation checks prevent common mistakes in a Purview protection deployment? Select two.
Microsoft 365 Intune Purview and Copilot
✓ Correct answers
- Test DLP matches, scope, exceptions, and user impact with representative content
- Test whether the chosen label actually encrypts the supported file and restricts the intended rights
Testing file rights and DLP behavior validates actual enforcement. Container labels do not automatically encrypt each file, retention does not remove readers, and catalog metadata is not proof of DLP enforcement.
Open this question’s page →391. An employee can directly open a widely shared strategy file. The architect expects Copilot to remove that excessive source access automatically. What is the correct assessment?
Microsoft 365 Intune Purview and Copilot
✓ Correct answer
- Copilot inherits source permissions, so the underlying oversharing must be remediated
Copilot uses the initiating user's existing permissions. License assignment, device compliance, and a posture score do not repair broad SharePoint source access.
Open this question’s page →392. Authorized users must continue reading labeled board documents directly, but supported Copilot responses must not use their contents. Which control specifically addresses this requirement?
Microsoft 365 Intune Purview and Copilot
✓ Correct answer
- Apply a supported label-based DLP rule for the Microsoft 365 Copilot and Copilot Chat location
Copilot DLP can exclude supported labeled content while ordinary source access remains. Revoking source access violates the requirement. Retention controls lifecycle. A marking-only label without the supported processing rule does not establish the requested Copilot exclusion.
Open this question’s page →393. A label-based Copilot DLP rule excludes a file's content, yet its citation remains visible in a response. What does the documented behavior indicate?
Microsoft 365 Intune Purview and Copilot
✓ Correct answer
- Citations can remain even though excluded item content is not used in the response
The label-based control explicitly allows excluded items to appear in citations without using their content. Citation visibility alone does not prove processing failure; retention is a different control, and this is not evidence that all labels are ignored.
Open this question’s page →394. A tenant is piloting the external-email Copilot DLP preview to reduce untrusted grounding. Which interpretation of its boundary is accurate?
Microsoft 365 Intune Purview and Copilot
✓ Correct answer
- It excludes matching external email using sender-domain metadata, while ordinary email access remains separate
The external-email preview compares sender metadata with accepted domains and excludes matching email from grounding, summarization, and citation. It does not inspect bodies for every injection, revoke ordinary mail access, or govern every externally originated document.
Open this question’s page →395. Which two limitations or deployment checks are documented for label-based Copilot DLP? Select two.
Microsoft 365 Intune Purview and Copilot
✓ Correct answers
- Labeled email coverage includes emails sent on or after January 1, 2025
- Calendar invites are unsupported by this content coverage
The documentation gives the email date boundary and excludes calendar invites. It says direct prompt uploads are not content-scanned by this DLP control, file-open evaluation can require reopening after a mid-session label change, and source authorization remains separate.
Open this question’s page →396. A design distinguishes restricting web search from blocking a sensitive Copilot prompt entirely. Which two statements are correct? Select two.
Microsoft 365 Intune Purview and Copilot
✓ Correct answers
- Sensitive-prompt blocking is documented as preview and rolling out, so availability must be verified
- The web-search action can allow a response grounded in permitted internal sources
Web-search restriction preserves allowed internal grounding, while prompt blocking requires preview availability checks. Neither action inherently revokes source access; directly uploaded file contents are not inspected by this control, and SIT and label conditions cannot be combined in the same rule.
Open this question’s page →397. A company has acquired a portfolio of applications without reliable ownership records. What should the architect establish first?
Application lifecycle workload identities and APIs
✓ Correct answer
- An inventory linked to owners, criticality, data, identities, and dependencies
An accountable inventory supplies scope and context for portfolio assessment. Flat findings without ownership cannot identify responsible remediation. Uniform risk ignores business consequences. Rewriting all applications before assessment is premature and can disrupt dependencies.
Open this question’s page →398. A library vulnerability is disclosed. The team needs to find applications actually running the affected version. Which evidence is most useful?
Application lifecycle workload identities and APIs
✓ Correct answer
- Deployed component and dependency inventories tied to each workload
Deployed dependency records identify affected runtime versions. Ticket counts and general posture scores do not locate a specific component, and the default branch may differ from production.
Open this question’s page →399. A supposedly retired service still has a public endpoint and a privileged credential. What should the posture review recommend?
Application lifecycle workload identities and APIs
✓ Correct answer
- Verify dependencies, decommission the unused service, and revoke unneeded access
Unused assets should be safely decommissioned and unnecessary permissions removed. Lack of recent use does not remove exposure, longer credentials increase persistence risk, and a paper retirement is not operational evidence.
Open this question’s page →400. The portfolio team must choose between a low-impact internal finding and an exploitable public API handling payment data. What is the strongest prioritization approach?
Application lifecycle workload identities and APIs
✓ Correct answer
- Assess exploitability, exposure, data sensitivity, and business impact, then assign an accountable deadline
Risk factors and ownership support meaningful prioritization. Counts alone, severity without local exposure or business context, and identical deadlines ignore differences in practical consequences.
Open this question’s page →401. Which two findings can Defender for APIs help expose for supported onboarded APIs? Select two.
Application lifecycle workload identities and APIs
✓ Correct answers
- APIs receiving or returning sensitive data
- Unused or unauthenticated API endpoints
Defender for APIs provides endpoint posture findings and API data classification. Its supported API coverage does not imply complete desktop, unrelated SaaS consent, or business-logic analysis.
Open this question’s page →402. A portfolio owner claims that patching source code closes a production finding. Which two checks should the architect require? Select two.
Application lifecycle workload identities and APIs
✓ Correct answers
- Confirm the corrected component or configuration reached the deployed workload
- Retest the vulnerable behavior and check related dependencies
Deployment verification and targeted retesting connect the fix to the affected workload. A commit or generic build status alone cannot establish runtime remediation, and deleting inventories removes useful evidence.
Open this question’s page →403. A caller forges an identity assertion to appear to be a trusted service. Which STRIDE category describes the primary threat?
Application lifecycle workload identities and APIs
✓ Correct answer
- Spoofing
Spoofing concerns impersonating an identity. Repudiation concerns denial of actions, denial of service concerns availability loss, and information disclosure concerns unauthorized exposure.
Open this question’s page →404. A signed-in customer changes a request field and performs an operation reserved for administrators. Which STRIDE concern is most directly illustrated?
Application lifecycle workload identities and APIs
✓ Correct answer
- Elevation of privilege
Executing an administrator-only operation as an ordinary user illustrates elevation of privilege. Disclosure concerns unauthorized data exposure, repudiation concerns denial of actions, and denial of service concerns availability loss. Those outcomes are not the primary behavior described.
Open this question’s page →405. A payroll application lacks trustworthy activity records, and users can plausibly deny modifying payment details. Which mitigation most directly addresses the threat?
Application lifecycle workload identities and APIs
✓ Correct answer
- Protected audit records tied to trusted identities and relevant actions
Attributable protected records address repudiation. At-rest encryption protects stored bytes, shorter sessions reduce exposure windows, and schema checks validate input format. None supplies trustworthy evidence of who changed payment details.
Open this question’s page →406. An application adds a third-party document importer that executes under a privileged workload identity. What should happen to its threat model?
Application lifecycle workload identities and APIs
✓ Correct answer
- Update assets, dependencies, data flows, and trust boundaries, then evaluate misuse and mitigations
New dependencies and privileged flows require architecture reassessment. An unchanged user interface does not preserve trust assumptions, a vendor scan does not analyze the customer integration, and secretless authentication does not prove appropriate authorization.
Open this question’s page →407. Which two inputs are essential when modeling a business-critical application's threats? Select two.
Application lifecycle workload identities and APIs
✓ Correct answers
- Its components, dependencies, data flows, and trust boundaries
- Its sensitive assets and business-critical user flows
Architecture boundaries plus sensitive assets and user flows form the system model. Scanner output and compliance checklists provide useful inputs but cannot replace it. A network-only diagram omits application and identity trust relationships needed for threat analysis.
Open this question’s page →408. A threat model identifies a privileged import flow and a possible control failure. Which two follow-up actions support a usable security design? Select two.
Application lifecycle workload identities and APIs
✓ Correct answers
- Document detection or response if the preventive control fails
- Assign mitigation ownership and a validation plan
Ownership, validation, and response turn analysis into operational protection. A diagram does not implement controls, category assignment does not justify acceptance, and reassessment is required as architecture changes.
Open this question’s page →409. A team proposes adding security only after feature development is complete. Which lifecycle strategy should the architect recommend?
Application lifecycle workload identities and APIs
✓ Correct answer
- Embed security requirements, design analysis, testing, and operational feedback throughout the lifecycle
Continuous lifecycle security addresses design, code, supply chain, and operations. A final test cannot replace earlier controls, WAF cannot implement every requirement, and dependencies can become vulnerable after release.
Open this question’s page →410. An application passes static code analysis but fails when a running endpoint exposes unintended behavior. Which additional assessment best complements SAST?
Application lifecycle workload identities and APIs
✓ Correct answer
- DAST against the running application
DAST evaluates running behavior and complements SAST. Repeating unchanged static analysis may miss the runtime issue. Dependency scans target known component weaknesses. WAF rules provide ingress protection but do not replace testing the deployed endpoint’s behavior.
Open this question’s page →411. A dependency was approved six months ago but now has a critical published vulnerability. What lifecycle practice best prevents the approval from becoming a blind spot?
Application lifecycle workload identities and APIs
✓ Correct answer
- Continuously reassess dependencies and prioritize affected deployed versions
Continuous scanning and reassessment catch newly disclosed risks. Approval dates and exemptions do not make software permanently safe, and freezing findings prevents timely remediation.
Open this question’s page →412. A production incident requires a rapid security fix, but the release process is designed only for monthly deployments. What should the architect design?
Application lifecycle workload identities and APIs
✓ Correct answer
- A controlled emergency release path with defined approvals, essential validation, and rollback or roll-forward
A controlled emergency path balances speed with accountable validation and recovery. Uncontrolled direct edits and automatic blanket bypass introduce risk, while refusing urgent changes leaves active exposure unresolved.
Open this question’s page →413. Which two controls address different phases of the secure application lifecycle? Select two.
Application lifecycle workload identities and APIs
✓ Correct answers
- Threat modeling during design and after material changes
- Runtime monitoring and production feedback after deployment
Design reassessment and operational feedback protect different phases. One-time scans cannot guarantee future safety, broad production access increases attack paths, and unused endpoints should be decommissioned.
Open this question’s page →414. A mature application is being retired. Which two security actions should the lifecycle strategy include? Select two.
Application lifecycle workload identities and APIs
✓ Correct answers
- Revoke unneeded workload permissions and credentials after dependency review
- Remove unused endpoints and handle retained data under applicable requirements
Revoking unnecessary access and safely retiring endpoints and data closes residual attack surface. Forgotten credentials, anonymous sensitive publication, and paper-only retirement leave substantial risks.
Open this question’s page →415. A team wants one default authorization rule for new services. Which standard is most appropriate?
Application lifecycle workload identities and APIs
✓ Correct answer
- Deny access unless the caller is explicitly authorized
Default deny requires explicit authorization. Default permit, URL knowledge, and user-interface visibility do not establish server-side permission.
Open this question’s page →416. A build pipeline consumes an unknown extension with access to deployment credentials. Which standard addresses the main risk?
Application lifecycle workload identities and APIs
✓ Correct answer
- Validate trusted pipeline components and restrict their privileges
Trusted component review and limited privilege reduce supply-chain risk. Popularity alone is insufficient, shared administrator credentials amplify impact, and removing inventories prevents ongoing assessment.
Open this question’s page →417. A repository scanner finds a valid production secret in a commit. What is the best response?
Application lifecycle workload identities and APIs
✓ Correct answer
- Rotate or revoke the exposed credential and fix storage and pipeline controls
An exposed credential requires rotation or revocation and preventive correction. Deleting one line leaves history and copies, private repositories still have compromise risks, and longer validity increases the exposure window.
Open this question’s page →418. A developer environment connects directly to production using broad data permissions. Which design change best aligns with secure development standards?
Application lifecycle workload identities and APIs
✓ Correct answer
- Separate environments and provide only justified controlled access and protected test data
Environment separation, justified access, and protected test data reduce lateral movement and exposure. Training does not authorize every production action, encryption does not limit every permitted reader, and code review does not establish a network or data-access boundary.
Open this question’s page →419. Which two standards directly reduce compromise of the development supply chain? Select two.
Application lifecycle workload identities and APIs
✓ Correct answers
- Least-privilege access and structured review for source repositories
- Trusted build tasks and protected build-agent credentials
Repository governance and protected trusted builds reduce source and pipeline compromise. Broad rights, unrestricted inbound access, and exempting open-source dependencies enlarge the attack surface.
Open this question’s page →420. An architect audits a secure development program. Which two findings show material weaknesses? Select two.
Application lifecycle workload identities and APIs
✓ Correct answers
- Nonproduction jobs can access production data without equivalent controls
- Production credentials are hard-coded in configuration checked into source control
Hard-coded credentials and weak environment boundaries are material risks. Training, structured review, and trusted component inventories are positive controls rather than weaknesses.
Open this question’s page →421. An application must store a third-party secret that cannot yet be replaced with a secretless identity. Which service is the most direct fit?
Application lifecycle workload identities and APIs
✓ Correct answer
- Azure Key Vault with scoped permissions and lifecycle controls
Key Vault is designed for restricted secret management. WAF protects web requests, caching does not provide a secret lifecycle boundary, and plaintext source storage exposes the credential.
Open this question’s page →422. A requirement calls for centralized API token validation, throttling, and a facade for backend services. Which technology maps best?
Application lifecycle workload identities and APIs
✓ Correct answer
- Azure API Management
API Management provides the gateway facade and policies for credentials and usage control. Row-level security governs database rows, infrastructure encryption protects stored data, and score benchmarking measures posture.
Open this question’s page →423. A finance application must prevent database administrators without client keys from reading selected sensitive column values. Which control should be evaluated?
Application lifecycle workload identities and APIs
✓ Correct answer
- Always Encrypted with properly separated client key access
Always Encrypted addresses supported column plaintext separation from the database engine. TDE protects files at rest, masking is not an adversarial encryption boundary, and a private endpoint limits network paths rather than administrator query rights.
Open this question’s page →424. A WAF and API token policy are enabled, yet valid users can request other users' invoices. Which missing control best maps to the requirement?
Application lifecycle workload identities and APIs
✓ Correct answer
- Object-level authorization in the application or data layer
Object-level authorization binds access to the correct user's records. WAF and token validation do not replace it; quotas regulate volume, encryption layers protect stored bytes, and token lifetime does not determine invoice ownership.
Open this question’s page →425. A public API needs complementary protections for web exploits and API-specific access rules. Which two controls fit? Select two.
Application lifecycle workload identities and APIs
✓ Correct answers
- Backend authorization for allowed objects and functions
- WAF rules for supported common HTTP attacks
WAF and backend authorization meet distinct web and business-access requirements. TDE encrypts stored database files rather than authenticating callers. Subscription keys do not prove individual object rights. Rate limits constrain volume but do not replace attack inspection or authorization.
Open this question’s page →426. An architect evaluates a proposed private data service. Which two statements accurately map technology to requirements? Select two.
Application lifecycle workload identities and APIs
✓ Correct answers
- A managed identity avoids stored workload credentials but still needs the correct data permissions
- Private networking constrains access paths but does not replace resource authorization
Network paths and identity authorization are separate, and managed identity requires explicit permissions. Vault encryption cannot make an authorized reader trustworthy, rate limits do not prove record ownership, and authorized code can still export decrypted data.
Open this question’s page →427. An Azure-hosted service must obtain tokens without a developer storing a password or certificate. Which capability should be evaluated first?
Application lifecycle workload identities and APIs
✓ Correct answer
- A managed identity
Managed identity provides platform-managed authentication credentials. Shared employee credentials and source account keys retain credential-management risks, while anonymous access removes authentication rather than securing it.
Open this question’s page →428. A service's compute instances are frequently replaced, but the same preauthorized identity must persist across replacements. Which identity design best fits?
Application lifecycle workload identities and APIs
✓ Correct answer
- A user-assigned managed identity with carefully scoped permissions
A user-assigned identity has an independent lifecycle and can be preauthorized. System-assigned identities are tied to their resources, image passwords require stored credentials, and personal administrator identities are inappropriate workload access.
Open this question’s page →429. A workload obtains a managed identity token successfully but Storage denies data access. Which requirement must be satisfied independently of token acquisition?
Application lifecycle workload identities and APIs
✓ Correct answer
- The required data-plane permission at the intended scope
The required data role and scope determine authorization independently of successful token acquisition. Enabling a managed identity does not automatically grant downstream access. Resource-management permissions are not an equivalent replacement for the required data-plane role. Increasing token lifetime does not grant missing permission.
Open this question’s page →430. A GitHub Actions workflow uses OIDC federation. The incoming subject refers to a different environment than the configured trusted subject. What is the most appropriate correction?
Application lifecycle workload identities and APIs
✓ Correct answer
- Align the intended issuer, subject, and audience trust with the exact supported workload token
Federation validates the configured trust values against the external token. Broad secrets, disabling validation, and Owner permissions do not safely correct a mismatched trust relationship.
Open this question’s page →431. Which two statements distinguish managed identity types correctly? Select two.
Application lifecycle workload identities and APIs
✓ Correct answers
- A user-assigned identity can exist independently and be assigned to multiple resources
- A system-assigned identity is tied to the lifecycle of one resource
Lifecycle coupling defines system-assigned identities; independent reuse defines user-assigned identities. System-assigned identities are not shared this way, deleting one consumer does not delete the independent identity, and both need authorization.
Open this question’s page →432. A deployment workflow outside Azure must access one resource group without stored credentials. Which two design elements are necessary? Select two.
Application lifecycle workload identities and APIs
✓ Correct answers
- Least-privilege resource authorization for the resulting Entra identity
- A supported federated trust for the intended external workload identity
Federation supplies secretless authentication and scoped authorization permits the intended deployment. Public access and shared humans are poor substitutes, and token exchange does not automatically provide resource permissions.
Open this question’s page →433. A solution needs an API facade that applies consistent routing, authentication policies, quotas, and monitoring. Which Azure service is the primary fit?
Application lifecycle workload identities and APIs
✓ Correct answer
- Azure API Management
API Management provides the API facade and configured gateway policies. WAF supplies web inspection, private endpoints restrict network access, and Defender for APIs adds posture and detection. They complement rather than replace the requested API routing, quota, and policy service.
Open this question’s page →434. An API accepts correctly signed tokens intended for a different application. Which validation gap should be corrected?
Application lifecycle workload identities and APIs
✓ Correct answer
- Validate the expected token audience along with other required checks
The audience binds a token to its intended API. Raising quotas and response caching do not validate that target, while disabling signatures weakens authentication further.
Open this question’s page →435. A partner has a valid subscription key and token but can change a shipment ID to read another partner's shipment. What is the key missing control?
Application lifecycle workload identities and APIs
✓ Correct answer
- Backend object-level authorization bound to trusted partner context
Object-level authorization controls access to each shipment. Key length and cache capacity do not decide ownership, and public backend access can add bypass risk.
Open this question’s page →436. The gateway enforces all intended policies, but the backend remains publicly callable without equivalent checks. Which architecture change best closes the bypass?
Application lifecycle workload identities and APIs
✓ Correct answer
- Restrict backend access to the intended path and require appropriate backend authentication and authorization
The origin needs an enforced access boundary and suitable identity controls. Gateway policies alone do not block direct calls, undisclosed URLs are not security boundaries, and larger limits do not prevent bypass.
Open this question’s page →437. Which two controls address different API security requirements? Select two.
Application lifecycle workload identities and APIs
✓ Correct answers
- Validate the intended issuer, audience, and required token claims
- Enforce business-object permissions in trusted backend logic
Token validation establishes suitable identity evidence, while backend authorization controls the requested objects. Subscription keys and rate limits are not ownership checks, and untrusted tenant identifiers can enable cross-tenant access.
Open this question’s page →438. A financial API exposes sensitive data and must control resource use without assuming one tool solves everything. Which three measures are appropriate? Select three.
Application lifecycle workload identities and APIs
✓ Correct answers
- Onboard supported APIs to Defender for APIs and route actionable detections
- Apply suitable request validation and usage limits at the gateway
- Restrict direct backend access and enforce object/function authorization
Validation and limits reduce malformed or excessive requests, protected backend authorization controls business access, and Defender for APIs adds detection. At-rest encryption does not enforce caller object rights, and a subscription key does not replace user identity.
Open this question’s page →439. An Internet-facing web application needs protection against common SQL injection and cross-site scripting attempts. Which service family most directly addresses this ingress requirement?
Application lifecycle workload identities and APIs
✓ Correct answer
- Azure Web Application Firewall
WAF inspects supported web attack patterns. NSGs admit or deny flows without HTTP attack inspection. DDoS protection addresses volumetric availability threats. Subscription keys identify API subscriptions rather than inspecting SQL injection or XSS payloads.
Open this question’s page →440. A new Application Gateway WAF logs malicious requests but allows them through. It is running in detection mode. What is the correct interpretation?
Application lifecycle workload identities and APIs
✓ Correct answer
- This is expected; enforcement requires the intended prevention configuration
Detection mode intentionally logs without blocking. Managed-rule matches do not override that mode. Policy attachment does not prove every route or request is enforced. Observation cannot prove absence of backend vulnerabilities.
Open this question’s page →441. A valid business request triggers one managed rule. What is the best next action?
Application lifecycle workload identities and APIs
✓ Correct answer
- Investigate the match and apply the narrowest justified tuning or exclusion, then retest
Targeted evidence-based tuning preserves useful inspection while addressing a false positive. Global disablement and broad allow rules unnecessarily weaken protection, and suppressing logs removes diagnostic evidence.
Open this question’s page →442. A proposal uses Front Door Standard but requires Azure-managed WAF rule sets. What should the architect do?
Application lifecycle workload identities and APIs
✓ Correct answer
- Select a tier that supports the required managed rules, such as Front Door Premium
Premium supplies the required integrated managed-rule capability. Standard custom rules are not Azure-managed sets. Replacing the requirement with custom rules misstates compliance with the design. A separate Application Gateway policy does not change the Front Door tier’s capabilities.
Open this question’s page →443. Which two statements accurately define a WAF deployment's boundary? Select two.
Application lifecycle workload identities and APIs
✓ Correct answers
- Supported common web attack inspection complements secure application code
- Object and function authorization still need application or data-layer enforcement
WAF complements coding and authorization controls. It cannot guarantee all business-logic protection or secure bypass paths, and detection-mode logging does not necessarily deny requests.
Open this question’s page →444. A WAF must be moved from observation to production enforcement. Which two activities support a safe transition? Select two.
Application lifecycle workload identities and APIs
✓ Correct answers
- Enable the intended prevention behavior and validate both legitimate and attack requests
- Review representative logs and investigate false positives before narrowly justified tuning
Log-based tuning and practical enforcement tests validate the change. Authenticated users can still attack, disabling diagnostics removes evidence, and saving policy does not prove route coverage or runtime behavior.
Open this question’s page →445. An architect cannot reliably locate sensitive data across an application's databases, exports, and caches. What should be established first?
Data classification encryption databases and storage
✓ Correct answer
- A data inventory and discovery scope covering stores and processing copies
Discovery and inventory establish the real data footprint. Size and filenames do not determine sensitivity, and undocumented repositories can be important exposure points.
Open this question’s page →446. A central governance team provides a classification taxonomy, but each product team plans to invent incompatible labels. What is the best architectural response?
Data classification encryption databases and storage
✓ Correct answer
- Use the shared taxonomy and define explicit scope and handling meanings
Shared meanings support consistent protection. Production-only scope misses sensitive copies. Incompatible labels without governance can lead to inconsistent handling. Abandoning classification removes needed business context.
Open this question’s page →447. An analyst can view a dataset's metadata in Purview Unified Catalog but cannot query the underlying database. Which explanation is correct?
Data classification encryption databases and storage
✓ Correct answer
- Catalog roles do not themselves grant underlying data access
Purview governance roles address metadata; actual data permissions remain separate. Public access, encryption status, and blanket Owner access are not appropriate conclusions.
Open this question’s page →448. A production system is classified, but an unclassified analytics export retains the same customer records. What should the architect recommend?
Data classification encryption databases and storage
✓ Correct answer
- Extend classification scope and appropriate handling controls to the export and its processing path
Classification must follow sensitive data through copies and components. Derivation alone does not lower sensitivity, catalog metadata does not implement every protection, and source database encryption does not automatically protect a separate export.
Open this question’s page →449. Which two inputs should guide classification of a workload's data? Select two.
Data classification encryption databases and storage
✓ Correct answers
- Information type and applicable obligations
- Sensitivity and business impact
Sensitivity, consequences, information type, and obligations define suitable classification. Size is not sensitivity. Default encryption describes one protection rather than business classification. An unvalidated inherited label can misrepresent the data’s meaning or current handling obligations.
Open this question’s page →450. A discovery program claims it is complete after cataloging primary databases. Which two additional checks are needed? Select two.
Data classification encryption databases and storage
✓ Correct answers
- Validate scan coverage and automated classifications with accountable owners
- Identify sensitive copies in backups, caches, exports, analytics, and preproduction paths
Replicated data and classification quality require explicit review. Connector support does not prove configuration or coverage, metadata alone does not enforce every control, and filenames can conceal sensitive content.
Open this question’s page →451. An assessment finds an anonymous public export containing customer identity data and a minor configuration gap in an isolated test app. Which finding should generally receive priority?
Data classification encryption databases and storage
✓ Correct answer
- The exposed customer export because of its sensitivity and accessible attack path
Publicly exposed customer identity data has the higher described risk. Remediation ease and score points alone do not establish priority. Uniform urgency ignores differences in sensitivity, exposure, and consequences.
Open this question’s page →452. Sensitive data is encrypted at rest, but an overprivileged service routinely exports it to an uncontrolled location. Which mitigation best addresses the main threat?
Data classification encryption databases and storage
✓ Correct answer
- Narrow the service's permissions and control the authorized export path
Permissions and export controls address authorized misuse. Extra at-rest encryption does not prevent service-mediated plaintext exports, higher quotas can increase volume, and encryption alone does not govern permitted reads.
Open this question’s page →453. A business-critical dataset has strict recovery objectives. Which evidence should the architect prioritize?
Data classification encryption databases and storage
✓ Correct answer
- Restore testing that includes data, keys, permissions, and required dependencies
End-to-end restore testing verifies whether recovery objectives can be met. Encryption status does not establish restorability. Backup success alone does not prove usable restored data and dependencies. Classification identifies importance but is not recovery evidence.
Open this question’s page →454. A team proposes one identical data control for public marketing content and highly restricted health records. What should the architect recommend?
Data classification encryption databases and storage
✓ Correct answer
- Align protection with classification, business consequences, and obligations
Classification, consequences, and obligations support proportional protection. Public handling can expose health data, encryption alone does not implement access or retention requirements, and platform management does not remove customer data-handling responsibilities.
Open this question’s page →455. Which two actions reduce unnecessary sensitive-data exposure across a workload? Select two.
Data classification encryption databases and storage
✓ Correct answers
- Minimize unnecessary collection and retained copies
- Apply appropriate handling to sensitive exports and test datasets
Minimization and consistent handling of copies reduce exposure. Primary controls do not automatically protect separate copies, indefinite retention increases risk, and unrestricted service access violates least privilege.
Open this question’s page →456. A high-impact data risk cannot be fully remediated before a deadline. Which two activities support an accountable interim decision? Select two.
Data classification encryption databases and storage
✓ Correct answers
- Record the affected data, residual risk, owner, compensating measures, and review date
- Validate the interim control against the actual exposure path
An explicit residual-risk record and tested compensating controls support accountable acceptance. Unsupported closure and point totals conceal the risk, and a management note cannot erase legal obligations.
Open this question’s page →457. An application must keep an unavoidable connection secret outside its source repository and audit access to it. Which service is most directly suitable?
Data classification encryption databases and storage
✓ Correct answer
- Azure Key Vault
Key Vault stores and controls secrets with audit and access safeguards. WAF inspects web requests, response caching serves data, and source comments do not establish secure credential storage.
Open this question’s page →458. A storage account uses a customer-managed key. The team assumes that this automatically adds infrastructure encryption. What is the correct assessment?
Data classification encryption databases and storage
✓ Correct answer
- Key ownership and infrastructure double encryption are separate settings and requirements
Customer-managed keys control service-level key management; infrastructure encryption adds a distinct layer. It does not disable service encryption, and key ownership does not automatically remove valid service data access.
Open this question’s page →459. A requirement demands account-wide infrastructure encryption on a new Storage account. When must the setting be planned?
Data classification encryption databases and storage
✓ Correct answer
- At account creation
Account-level infrastructure encryption is fixed at creation. Incident timing and key rotation do not enable it later, and the documented account setting cannot be changed after creation.
Open this question’s page →460. An existing account lacks account-level infrastructure encryption. The requirement can be limited to future data under a newly created encryption scope. Which option is documented?
Data classification encryption databases and storage
✓ Correct answer
- Creating an encryption scope with infrastructure encryption enabled at scope creation
The documentation supports selecting infrastructure encryption for a new scope when account-level infrastructure encryption is absent. Customer-managed service keys change key ownership rather than adding the layer, an existing scope setting is fixed, and secure transfer protects transport rather than adding at-rest encryption.
Open this question’s page →461. Which two controls help protect a Key Vault-based encryption dependency? Select two.
Data classification encryption databases and storage
✓ Correct answers
- Restrict key permissions and audit cryptographic access
- Use required recovery safeguards such as soft delete and purge protection
Constrained audited access and deletion recovery safeguards protect keys. Broad purge rights and disabled logs increase risk, and simply creating a vault does not prove lifecycle operations succeed.
Open this question’s page →462. A critical service uses customer-managed keys and private networking. Which three checks are necessary to validate the design? Select three.
Data classification encryption databases and storage
✓ Correct answers
- Test rotation and recovery dependencies without losing data availability
- Verify transport protection and endpoint validation on relevant access paths
- Verify the service identity has only required key permissions and can reach the key service
Identity access, key availability across lifecycle events, and secure transport are complementary checks. At-rest encryption does not stop valid plaintext exports, and networking does not grant permissions.
Open this question’s page →463. A private assistant grounds answers using a shared search identity that can read every department's content. What must protect each user's data boundary?
Data classification encryption databases and storage
✓ Correct answer
- Retrieval-time document authorization using the authenticated user’s trusted permissions
Trusted document authorization constrains content before grounding. Content-safety filtering does not repair source permissions. Broad shared-search authority does not define each user’s rights. A system prompt is not an authorization boundary.
Open this question’s page →464. A search filter compares document group strings with group strings sent by the browser. Users can submit arbitrary group names. What should the architect correct?
Data classification encryption databases and storage
✓ Correct answer
- Derive allowed principal information from the authenticated trusted context and prevent filter bypass
A security filter is string-based and depends on trusted application context. More results increase potential exposure, a client string is not authentication, and at-rest encryption does not fix forged permission context.
Open this question’s page →465. An application calls the Prompt Shields API, receives an attack result, and still forwards the content to the model. What is missing?
Data classification encryption databases and storage
✓ Correct answer
- Application logic that uses the detection result to block, route, or otherwise enforce the intended handling
The application must act on the Content Safety API result according to its handling policy. Repeated detection without enforcement retains the attack path. Prompt Shields does not repair source authorization. A warning that ignores the result does not implement the required response.
Open this question’s page →466. A retrieved document contains hidden instructions telling an agent to export secrets through a tool. Which combined assessment is most appropriate?
Data classification encryption databases and storage
✓ Correct answer
- Evaluate document injection and constrain both grounding and the agent's tool privileges
Document attack detection and limited grounding/tool authority address the malicious instruction path. It is more than a factual error, broader privilege increases harm, and successful retrieval does not establish source trust.
Open this question’s page →467. Which two measures directly protect an AI retrieval boundary? Select two.
Data classification encryption databases and storage
✓ Correct answers
- Enforce supported access checks or trusted security filters before content enters grounding
- Preserve appropriate document permission metadata during ingestion
Permission metadata and trusted retrieval enforcement establish the boundary. Post-retrieval model judgment, arbitrary caller groups, and response formatting do not provide reliable authorization.
Open this question’s page →468. A document-grounded agent can invoke business tools. Which three design actions address distinct security risks? Select three.
Data classification encryption databases and storage
✓ Correct answers
- Limit tool identity permissions and validate sensitive operations independently of model output
- Detect adversarial user or document instructions and enforce the application's chosen response
- Constrain retrieval using the authenticated user's intended document rights
Retrieval authorization, enforced attack handling, and least-privilege tool execution address different failures. Subscription Owner expands potential damage, and injection detection does not certify truth or access rights.
Open this question’s page →469. Employees should query only their department's rows in an Azure SQL table using a trustworthy execution context. Which feature is most directly relevant?
Data classification encryption databases and storage
✓ Correct answer
- Row-level security with a suitable predicate and security policy
Row-level security enforces row predicates. Dynamic masking alters displayed field values, TDE encrypts stored files, and a Storage SAS does not define SQL department row access.
Open this question’s page →470. An administrator manages Azure SQL but must not see selected column plaintext without separately controlled application keys. Which feature should be evaluated?
Data classification encryption databases and storage
✓ Correct answer
- Always Encrypted with appropriate client-side key separation
Always Encrypted separates supported column plaintext from the engine through client keys. TDE protects stored files. Masking does not provide a complete adversarial encryption boundary. Row-level security controls rows rather than keeping selected plaintext outside the engine.
Open this question’s page →471. An Azure service uses a managed identity to read items in one Cosmos DB for NoSQL container. Which permission design fits?
Data classification encryption databases and storage
✓ Correct answer
- Assign a suitable native data-plane role at the needed scope
Cosmos DB for NoSQL data-plane roles authorize item operations with appropriate scope. Resource management roles have a different purpose, account keys are broad credentials, and directory administrator roles exceed the workload requirement.
Open this question’s page →472. A Synapse analyst can edit a notebook but cannot query a SQL pool table. What should the architect assess before changing access?
Data classification encryption databases and storage
✓ Correct answer
- The identity and separate SQL data permission involved in the failed operation
Workspace capabilities and SQL data permissions are separate. Notebook editing is not proof of table access, broad workspace administration expands privilege without diagnosing SQL rights, and removing network restrictions before assessing the described permission boundary is unjustified.
Open this question’s page →473. Which two statements about Azure SQL data controls are correct? Select two.
Data classification encryption databases and storage
✓ Correct answers
- TDE protects stored database files and backups
- Dynamic masking is not encryption and does not replace sound authorization
TDE is at-rest protection and masking changes applicable query output. RLS controls rows rather than encrypting them, authorized queries can return TDE plaintext, and masking does not rewrite the stored values.
Open this question’s page →474. A Synapse pipeline author cannot read a dataset interactively but can run a pipeline using a linked-service identity that reads it. Which two assessments are necessary? Select two.
Data classification encryption databases and storage
✓ Correct answers
- Scope the linked identity's data permissions to the approved sources and destinations
- Review execution rights and the credentials or identity available to that pipeline
Execution capability and linked identity permissions can create a separate data path. Personal interactive rights do not automatically limit the execution identity, broad workspace administration increases risk, and Git access is a distinct permission plane.
Open this question’s page →475. An Azure-hosted reporting service must read one Blob container without stored account keys. Which design should be selected?
Data classification encryption databases and storage
✓ Correct answer
- A managed identity with an appropriate scoped Blob data role
Managed identity and a scoped data role provide secretless authorized access. Anonymous access removes the protection boundary, Owner is overly broad and not a substitute for a carefully scoped data design, and repository SAS storage exposes a bearer credential.
Open this question’s page →476. A supplier needs temporary access to a supported storage resource using a SAS. Which configuration best matches least privilege?
Data classification encryption databases and storage
✓ Correct answer
- Only required resource scope and permissions, short validity, HTTPS, and appropriate revocation planning
Narrow scope, permissions, expiry, and secure transport limit token exposure. Broad indefinite access and public token logs increase misuse risk even for a trusted supplier.
Open this question’s page →477. A virtual network has a Blob private endpoint, but a workload also uses Azure Files. What must be assessed?
Data classification encryption databases and storage
✓ Correct answer
- The required File subresource endpoint, DNS, routing, and supported authentication path
The File subresource and client path need separate planning. Blob encryption does not create a File endpoint. Storage protocols do not universally share one subresource. Endpoint approval establishes connectivity rather than SMB identity permissions.
Open this question’s page →478. A service SAS uses a stored access policy. The design needs a central way to change the delegated policy without treating every SAS type alike. Which statement is accurate?
Data classification encryption databases and storage
✓ Correct answer
- A service SAS can reference a stored access policy; account and user delegation SAS do not use one
Stored access policies are supported for service SAS, not account or user delegation SAS. They do not make bearer-token leakage impossible, and revocation behavior remains part of the design.
Open this question’s page →479. Which two practices reduce Storage bearer-token risk? Select two.
Data classification encryption databases and storage
✓ Correct answers
- Avoid logging full SAS credentials
- Limit SAS permissions, scope, and lifetime and use HTTPS
Protecting the token and limiting its reach reduce risk. Account-wide permissions and indefinite validity expand exposure, and a recipient can forward a bearer URL.
Open this question’s page →480. An architect must secure a sensitive Blob workload and validate protection rather than infer it. Which three activities are appropriate? Select three.
Data classification encryption databases and storage
✓ Correct answers
- Select and test recovery or immutable retention controls according to business requirements
- Use scoped data permissions and restrict unnecessary key retrieval or Shared Key access where compatible
- Validate private endpoint DNS and public-access settings for the intended path
Data authorization, validated network paths, and appropriate lifecycle protection cover distinct risks. Encryption alone does not block authorized exports, and private networking does not replace identity permissions.
Open this question’s page →481. A storage protection requirement calls for agentless detection of suspicious access and supported sensitive-data threats. Which product should be evaluated?
Data classification encryption databases and storage
✓ Correct answer
- Defender for Storage
Defender for Storage supplies supported activity and sensitive-data threat detection. Foundational CSPM assesses configuration. SQL protection covers database threats. Service encryption protects stored data rather than detecting suspicious access.
Open this question’s page →482. A download service publishes files immediately after upload while malware scanning runs separately. No unverified file may be served. What architecture change is necessary?
Data classification encryption databases and storage
✓ Correct answer
- Keep uploads isolated and release only after the required scan result and business validation
An isolated release workflow accounts for asynchronous scanning. Upload acceptance does not certify clean content, a longer SAS does not control publication, and removing logs weakens visibility.
Open this question’s page →483. An organization requests the documented Defender for Azure Cosmos DB plan for an account using the Gremlin API. What is the correct assessment?
Data classification encryption databases and storage
✓ Correct answer
- The current support table lists NoSQL and excludes Gremlin, so an alternative supported protection design must be assessed
The documented plan supports NoSQL and excludes Gremlin. A product family name does not imply uniform API support, email protection does not supply Cosmos coverage, and encryption does not create the missing detector.
Open this question’s page →484. A storage account's on-upload scan cap is reached, but the application continues accepting files. How must the security release logic behave?
Data classification encryption databases and storage
✓ Correct answer
- Keep files without an acceptable result outside the approved release path and surface the scanning gap
The cap can halt scanning, so missing results must not be treated as clean. Plan enrollment and silence do not prove scanning, and arbitrary timers cannot guarantee completion.
Open this question’s page →485. Which two capabilities are provided by Defender for Azure SQL Databases? Select two.
Data classification encryption databases and storage
✓ Correct answers
- Vulnerability assessment of supported databases
- Alerts for anomalous or suspicious database activities
Defender SQL provides assessment and threat alerts. It does not replace authorization or prohibit every legitimate administrator query. TDE is a separate at-rest encryption feature rather than the Defender detection mechanism.
Open this question’s page →486. A service accepts untrusted files and uses data threat alerts. Which three operational design measures are appropriate? Select three.
Data classification encryption databases and storage
✓ Correct answers
- Monitor coverage gaps such as caps, failures, or unsupported content
- Keep clean, malicious, and nonfinal scan states distinct in release decisions
- Route actionable alerts to owners with triage and containment procedures
Explicit result states, coverage monitoring, and accountable response make detections useful. Immediate absence of an alert does not prove clean content, and threat detection complements rather than replaces prevention.
Open this question’s page →487. A software supplier contributes code through pull requests. The enterprise uses GitHub Actions federation, but the federated identity accepts every branch and the build job can update production infrastructure. Audit streaming is already healthy. Which change best reduces the remaining supply-chain path while retaining automated deployment?
MCRA MCSB and Zero Trust · CAF Well Architected and secure adoption · Application lifecycle workload identities and APIs
✓ Correct answer
- Bind production federation to a protected approved workflow and environment, and narrow its deployment scope
Bind production federation to a protected approved workflow and environment, and narrow its deployment scope: Federation removes a stored secret, but its trust conditions and permissions still need to restrict the production path. Keep the broad federation trust and retain audit events for longer: Evidence is useful but leaves untrusted build execution able to change production. Replace federation with a shared production Owner secret: A standing shared secret does not resolve the broad authority and increases exposure. Add an internet WAF while keeping unrestricted build-to-production access: A web-edge control does not constrain authenticated deployment operations. Permit production access to all pull-request jobs if dependency scanning passes: Dependency findings cannot establish trust in arbitrary workflow code.
Open this question’s page →488. A regional recovery rehearsal restores a database in 45 minutes, meeting the technical restore estimate. Customers still cannot use the service because private name resolution and key access take another 80 minutes to recover. The business RTO is 90 minutes. Which assessment is most accurate?
Business resilience and ransomware · CAF Well Architected and secure adoption · Data classification encryption databases and storage
✓ Correct answer
- The full service requires 125 minutes, so redesign the dependency recovery path before declaring the RTO met
The full service requires 125 minutes, so redesign the dependency recovery path before declaring the RTO met: The sequential dependency delay and data restoration together exceed the business restoration target. The RTO is met because the database restore took less than 90 minutes: A component estimate is insufficient when the business service is still unusable. The RPO is 125 minutes because key access was delayed: RPO measures tolerated data loss rather than restoration duration. Keep the plan unchanged and remove encryption to make the recovery report simpler: The requirement calls for secure, usable recovery and a tested dependency design. Double replication frequency and assume dependency timing no longer matters: Replication frequency does not repair name resolution or key authorization.
Open this question’s page →489. An approved AI agent retrieves support documents and can issue customer refunds. Prompt Shields detects adversarial text, but the refund tool accepts any customer account and amount presented by the agent. Which architecture best satisfies least privilege and human oversight?
MCRA MCSB and Zero Trust · CAF Well Architected and secure adoption · Application lifecycle workload identities and APIs
✓ Correct answer
- Authorize customer and refund scope in the tool service and enforce approval before designated high-impact refunds
Authorize customer and refund scope in the tool service and enforce approval before designated high-impact refunds: Independent constraints limit execution even if a model follows malicious retrieved instructions. Repeat the refund limit in the safety prompt without changing the tool: Natural-language instructions leave the underlying excessive authority intact. Approve every tool request automatically if Prompt Shields returned no detection: Detection does not establish transaction authorization or complete safety. Give the agent more data rights so it can independently decide all exceptions: Broader authority increases the consequences of agent manipulation. Review only a daily refund report after irreversible actions finish: Retrospective review does not provide the required pre-action approval boundary.
Open this question’s page →490. Two applications have similar vulnerability severity. One is an isolated training system. The other is a supplier-payment service whose deployment identity also controls the shared production identity infrastructure. The security budget covers one immediate intervention. Which prioritization best aligns enterprise controls with business resilience?
Business resilience and ransomware · MCRA MCSB and Zero Trust · Hybrid multicloud posture and exposure
✓ Correct answer
- Prioritize the path to the payment and identity services using exposure, control influence, and business impact
Prioritize the path to the payment and identity services using exposure, control influence, and business impact: The connected authority can affect multiple high-value functions and should be considered with severity. Treat the two issues as identical because their severity scores match: Severity alone omits the different business impact and administrative influence. Prioritize whichever application uses the most expensive VM size: Compute cost does not establish criticality or attacker impact. Choose only the application with the oldest framework version without evaluating its reachable paths: Version age alone does not resolve the stated business-risk comparison. Wait for the next license renewal before evaluating either attack path: Procurement timing is not a risk-based treatment decision.
Open this question’s page →491. A regulated enterprise has deployed an MCSB-related policy initiative. All evaluated Azure resources are compliant, but there is no evidence of operator access review, incident rehearsal, or recovery-key availability. What should an architect report to the board?
CAF Well Architected and secure adoption · Regulatory compliance and controls
✓ Correct answer
- The configuration assessment is useful evidence; validate the unmeasured operational and access controls against the actual obligations
The configuration assessment is useful evidence; validate the unmeasured operational and access controls against the actual obligations: A policy compliance state does not attest to every organizational control or recovery dependency. The compliant policy result is a complete regulatory attestation: The stated evidence gaps prevent that conclusion. Azure Policy has no governance value because it does not evaluate every control: Automated configuration assessment remains valuable within a broader assurance process. Replace the initiative with a reference-architecture diagram and declare assurance complete: A diagram also cannot establish control operation. Give auditors Owner permissions as the primary remedy for all gaps: Broad resource control does not itself validate access review, response, or recovery.
Open this question’s page →492. A lending assistant is about to receive a connector that can submit decisions directly into the loan system. It passes code scanning and latency tests, but previously only drafted recommendations. Which release decision best addresses the changed use case?
CAF Well Architected and secure adoption · Application lifecycle workload identities and APIs
✓ Correct answer
- Reassess consequential decision risks, evaluate fairness and reliability, and enforce accountable approval and scoped execution before rollout
Reassess consequential decision risks, evaluate fairness and reliability, and enforce accountable approval and scoped execution before rollout: New write capability changes impact; responsible AI and authorization need validation beyond code and performance tests. Reuse the drafting-only approval because no model weights changed: The tool and consequential action path changed even without a different model. Approve release based only on the static code scan result: That does not evaluate decision quality, fairness, or the allowed autonomy. Grant administrator access to reduce failed submissions: Excess permissions increase risk and do not establish responsible decision-making. Add a general user disclaimer as a replacement for transaction approval: A disclaimer does not constrain consequential execution.
Open this question’s page →493. An organization prepares a document assistant for all employees. Its retrieval system accurately respects permissions, but sensitive project folders are already shared with an overly broad employee group. What should happen before broad adoption?
MCRA MCSB and Zero Trust · CAF Well Architected and secure adoption · Data classification encryption databases and storage
✓ Correct answer
- Review and narrow overshared permissions, then validate retrieval and data handling with the approved user population
Review and narrow overshared permissions, then validate retrieval and data handling with the approved user population: Correctly applying excessive entitlements can still expose sensitive information through the assistant. Release immediately because authorization checks correctly return allowed: The checks faithfully reflect a scope that is too broad for the business requirement. Replace authorization with a prompt telling users to avoid sensitive documents: Instructions do not remediate the underlying sharing permissions. Block all identity authentication and use an anonymous retrieval service: This removes the access boundary rather than improving it. Treat higher model accuracy as a fix for overshared access: Model accuracy does not reduce existing entitlements.
Open this question’s page →494. A platform deny policy blocks a legacy workload requirement. The team proposes removing the entire security initiative from the common parent management group. The workload has a documented six-week remediation plan. Which action best preserves governed adoption?
CAF Well Architected and secure adoption · Hybrid multicloud posture and exposure
✓ Correct answer
- Evaluate a narrowly scoped, time-bound exemption with an accountable risk owner, compensating controls, and monitored remediation
Evaluate a narrowly scoped, time-bound exemption with an accountable risk owner, compensating controls, and monitored remediation: This treats the justified workload exception without weakening unrelated controls across the estate. Remove the common initiative from all subscriptions until the legacy team finishes: This exposes unrelated workloads to the same governance gap. Move the workload into an unmonitored subscription with no exception record: That avoids governance rather than managing risk. Give the deployment identity broader RBAC and assume it overrides a deny policy: More role permissions do not generally bypass applicable Policy deny enforcement. Rename the blocked resource so the documented exception becomes unnecessary: Naming does not reliably change the requirement or its policy condition.
Open this question’s page →495. A ransomware review finds that the vault administrator also holds permanent Resource Guard authority and the database recovery procedure has never been tested with the original production identity disabled. Which TWO corrections directly strengthen recovery under production-admin compromise? Select TWO.
Business resilience and ransomware · Privileged access and governance · Data classification encryption databases and storage
✓ Correct answers
- Remove the vault administrator standing rights that satisfy Resource Guard checks and require independent temporary authorization
- Test restoration with approved recovery identities, usable keys, and required dependencies under the compromise scenario
Remove the vault administrator standing rights that satisfy Resource Guard checks and require independent temporary authorization: This restores separation for the configured critical vault operations. Test restoration with approved recovery identities, usable keys, and required dependencies under the compromise scenario: This validates the practical recovery path when production authority is unsafe or unavailable. Increase production administrator rights so the same identity can handle every recovery task: That reinforces the concentrated compromised authority. Treat a successful replication job as proof of clean historical recovery: Replication may copy destructive changes and does not exercise restoration. Retain MUA but give its independent guard permissions back to the vault administrator permanently: Standing guard authority defeats the stated independent boundary. Declare every source-database operation protected automatically by Resource Guard: MUA has a defined vaulted-operation scope rather than every source operation.
Open this question’s page →496. A product team wants a secure supply chain without removing automated deployment. Which THREE controls together address source, artifact, and runtime risk? Select THREE.
MCRA MCSB and Zero Trust · CAF Well Architected and secure adoption · Application lifecycle workload identities and APIs
✓ Correct answers
- Deploy threat detection and route actionable runtime findings to accountable owners
- Protect source and workflow changes with review and controlled release permissions
- Scan components and validate artifact integrity and provenance before release
Protect source and workflow changes with review and controlled release permissions: This constrains unauthorized changes before deployment. Scan components and validate artifact integrity and provenance before release: This checks dependency and artifact risks along the delivery path. Deploy threat detection and route actionable runtime findings to accountable owners: Runtime controls address attacks and weaknesses after deployment. Trust a valid artifact signature as proof that all dependencies are vulnerability-free: Signing alone does not establish dependency safety. Give the build runner broad standing production authority to avoid approval delays: That creates an unnecessary compromise path. Remove runtime monitoring once all pre-release tests pass: Pre-release success cannot cover all future runtime threats.
Open this question’s page →497. An AI agent pilot gains a new external-content connector and a private data source in a governed landing zone. The prior evaluation covered only fixed internal documents. Which TWO validations directly address the newly introduced security boundaries? Select TWO.
MCRA MCSB and Zero Trust · CAF Well Architected and secure adoption · Data classification encryption databases and storage
✓ Correct answers
- Test indirect prompt injection from the external connector and verify independent downstream authorization
- Validate approved data scope, identity permissions, and sensitive-data handling for the new source
Test indirect prompt injection from the external connector and verify independent downstream authorization: New untrusted content can manipulate behavior, so authorization must remain enforced. Validate approved data scope, identity permissions, and sensitive-data handling for the new source: Private connectivity and platform guardrails do not automatically set the correct data entitlements. Reuse the fixed-document evaluation without testing the new connector: The new content path was outside the prior evaluation. Assume a landing-zone deployment automatically certifies every model and connector: It provides a foundation rather than complete AI assurance. Make the agent platform Owner so private endpoints cannot cause access errors: This broadens authority without validating the needed data boundary. Let the connector publish secrets into prompts for more reliable authentication: Prompts are not appropriate credential stores.
Open this question’s page →498. A hybrid enterprise allows remote administrators to reach a critical application. It wants Zero Trust protection when an endpoint or credential is compromised. Which THREE design elements form complementary controls? Select THREE.
Business resilience and ransomware · MCRA MCSB and Zero Trust · Identity authentication and access · Network security and Security Service Edge
✓ Correct answers
- Verify identity and relevant device or risk context for supported access paths
- Collect actionable telemetry and retain independently protected recovery capability
- Restrict administrative permissions and segment access to the specific required systems
Verify identity and relevant device or risk context for supported access paths: Explicit verification evaluates the requesting principal and context. Restrict administrative permissions and segment access to the specific required systems: Least privilege and segmentation constrain an established compromise. Collect actionable telemetry and retain independently protected recovery capability: Assume breach requires detection, containment, and recoverability. Trust all requests after they pass through a corporate tunnel: Network origin is insufficient trust evidence. Use device compliance to grant unrestricted database access automatically: A posture signal does not establish all resource entitlements. Use one unrestricted administrator for production and all recovery controls: Concentrated authority increases the effect of compromise.
Open this question’s page →Sources and content
Published for public study on StudyByteLearn with the maintainer's permission. No permission for further redistribution is granted. Rights in the supplied source material remain with their respective holders. · Updated 2026-10-21
Original study items created by Codex AI agents for the requester on 2026-10-21 against the Microsoft SC-100 objectives effective 2026-10-21 and freshly retrieved Microsoft Learn documentation. Every item received author self-review and independent AI-agent peer review; no human or Microsoft endorsement is implied. StudyByteLearn schema, importer, answer scoring, objective coverage, and fixed-exam references were separately validated.