SC-100 Risk Assessment 3

Question 1

Which NIST framework function focuses specifically on identifying and understanding cybersecurity risks to systems, people, assets, and data?

Accepted Answer

Identify

Answer

The NIST CSF 'Identify' function establishes the organizational understanding needed to manage cybersecurity risk to systems, assets, data, and capabilities.

Question 2

A cybersecurity architect is designing a risk assessment process for a hybrid Azure environment. Which Azure-native service provides continuous assessment of security configurations against benchmarks?

Accepted Answer

Microsoft Defender for Cloud

Answer

Microsoft Defender for Cloud continuously assesses resource configurations against the Microsoft Cloud Security Benchmark and other standards, surfacing risks as recommendations.

Question 3

In risk management terminology, what is the difference between a threat and a vulnerability?

Accepted Answer

A threat is a potential harmful event; a vulnerability is a weakness that could be exploited

Answer

A threat is any potential event that could harm an asset, while a vulnerability is a weakness that makes an asset susceptible to that threat.

Question 4

An SC-100 candidate is reviewing a risk treatment plan. Which option involves paying a premium to shift financial risk to another party?

Accepted Answer

Risk transfer

Answer

Risk transfer shifts the financial consequence of a risk to a third party, typically through cyber insurance or contractual liability clauses.

Question 5

During threat modeling for a new SaaS application on Azure, which methodology uses attack trees and stride categories to systematically identify threats?

Accepted Answer

STRIDE

Answer

STRIDE (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege) is Microsoft's threat modeling methodology used to categorize threats systematically.

(SC-100) Microsoft Cybersecurity Architect Expert Practice Test

(SC-100) Microsoft Cybersecurity Architect Expert Practice Test

SC-100 Risk Assessment 3