SC-100 Risk Assessment 4

Question 1

Which risk assessment approach relies on numerical values such as dollar amounts and statistical probabilities to express risk?

Accepted Answer

Quantitative risk assessment

Answer

Quantitative risk assessment uses objective numerical measures like ALE, SLE, and ARO to express risk in financial terms.

Question 2

A Cybersecurity Architect is designing governance for a multi-cloud environment. Which framework provides a cloud-specific risk and control catalog recognized by CSPs including Microsoft?

Accepted Answer

CSA Cloud Controls Matrix (CCM)

Answer

The CSA Cloud Controls Matrix is a cloud-specific control framework widely used for cloud risk assessments and mapped to major standards including Azure's compliance offerings.

Question 3

In the context of SC-100, what does 'attack surface reduction' primarily aim to achieve in risk management?

Accepted Answer

Reduce the number of pathways attackers can exploit to lower likelihood of risk

Answer

Attack surface reduction minimizes the number of exposed entry points and attack vectors, directly lowering the likelihood component of risk.

Question 4

When using Microsoft Defender for Cloud's regulatory compliance dashboard, what does a 'failed control' indicate from a risk perspective?

Accepted Answer

A resource configuration does not meet the required compliance control, representing a risk gap

Answer

A failed control in Defender for Cloud indicates a resource does not satisfy the compliance requirement, representing an unmitigated risk gap against that standard.

Question 5

A security architect is asked to perform a Business Impact Analysis (BIA). What is the primary output of a BIA in the context of risk assessment?

Accepted Answer

Identification of critical business processes and the impact of disruptions on them

Answer

A BIA identifies critical business processes, their dependencies, and the financial and operational impact if those processes are disrupted.

(SC-100) Microsoft Cybersecurity Architect Expert Practice Test

(SC-100) Microsoft Cybersecurity Architect Expert Practice Test

SC-100 Risk Assessment 4