SC-100 Risk Assessment 2

Question 1

A cybersecurity architect is evaluating residual risk after implementing controls. Which formula correctly represents residual risk?

Accepted Answer

Inherent Risk - Control Effectiveness

Answer

Residual risk equals inherent risk minus the effectiveness of applied controls, representing remaining exposure after mitigations.

Question 2

During a cloud risk assessment, you identify that a third-party vendor has access to sensitive customer data stored in Azure. Which risk category does this primarily represent?

Accepted Answer

Supply chain / third-party risk

Answer

Third-party access to sensitive data is classified as supply chain or third-party risk, requiring vendor risk management controls.

Question 3

Which Microsoft tool provides a unified risk score by aggregating signals from Microsoft 365 Defender, Defender for Cloud, and other security products?

Accepted Answer

Microsoft Secure Score

Answer

Microsoft Secure Score aggregates security posture signals across Microsoft products into a unified risk-based score.

Question 4

A security architect must prioritize remediation across 200 vulnerabilities. Which approach best aligns with a risk-based methodology?

Accepted Answer

Prioritize by combining CVSS score with asset criticality and exploitability

Answer

Risk-based prioritization combines vulnerability severity (CVSS) with asset business value and real-world exploitability to focus effort where risk is highest.

Question 5

When performing a quantitative risk assessment, which metric expresses the expected monetary loss from a threat occurring once?

Accepted Answer

Single Loss Expectancy (SLE)

Answer

Single Loss Expectancy (SLE) = Asset Value × Exposure Factor, representing the monetary loss from one occurrence of a threat event.

(SC-100) Microsoft Cybersecurity Architect Expert Practice Test

(SC-100) Microsoft Cybersecurity Architect Expert Practice Test

SC-100 Risk Assessment 2