SC-100 Risk Assessment 5 — Questions and Answers
Question 1: A cybersecurity architect must communicate risk to a non-technical executive board. Which risk representation is most appropriate?
- Detailed CVE list with CVSS scores
- Heat map showing likelihood vs. impact for top risks in business terms (Correct answer)
- Raw vulnerability scanner output from Defender for Cloud
- Technical exploit chains with proof-of-concept code
Correct answer: Heat map showing likelihood vs. impact for top risks in business terms
A risk heat map translates technical findings into business-language likelihood and impact, making it suitable for executive-level risk communication.
Question 2: During cloud security design, a Zero Trust principle states 'assume breach.' How does this principle influence risk assessment?
- It eliminates the need to assess external threats since internal threats are the focus
- It requires designing controls that assume attackers are already inside, shifting risk analysis toward lateral movement and data exfiltration (Correct answer)
- It means all risks are classified as critical and require immediate remediation
- It focuses risk assessment solely on identity and access management
Correct answer: It requires designing controls that assume attackers are already inside, shifting risk analysis toward lateral movement and data exfiltration
Assuming breach shifts risk assessment to model attacker behavior post-compromise, emphasizing controls for lateral movement detection, segmentation, and data protection.
Question 3: Which SC-100 concept involves continuously evaluating security controls against emerging threats rather than performing assessments on an annual schedule?
- Point-in-time risk assessment
- Continuous threat and vulnerability management (Correct answer)
- Annual penetration testing
- Compliance gap analysis
Correct answer: Continuous threat and vulnerability management
Continuous threat and vulnerability management provides ongoing risk visibility by constantly assessing controls against new CVEs, threat intelligence, and configuration drift.
Question 4: An organization is adopting a shared responsibility model in Azure. Which risk area remains the customer's responsibility regardless of the service model (IaaS, PaaS, SaaS)?
- Physical datacenter security
- Hypervisor patching
- Data classification and protection (Correct answer)
- Network infrastructure maintenance
Correct answer: Data classification and protection
Data classification and protection remain the customer's responsibility across all cloud service models — Microsoft secures the platform, but customers own their data.
Question 5: A security architect is assessing risk for a new Azure deployment and wants to benchmark configurations against industry best practices. Which resource should they reference first?
- OWASP Top 10
- Microsoft Cloud Security Benchmark (MCSB) (Correct answer)
- PCI DSS SAQ
- GDPR Article 32
Correct answer: Microsoft Cloud Security Benchmark (MCSB)
The Microsoft Cloud Security Benchmark (MCSB) provides Azure-specific security and risk control guidance mapped to multiple compliance frameworks.
Question 6: When a cybersecurity architect documents risk scenarios in a risk register, which four fields are universally required as a baseline?
- Risk ID, threat actor name, exploit code, patch availability
- Risk ID, risk description, likelihood, impact (Correct answer)
- CVE number, CVSS score, affected system, vendor patch
- Risk ID, business owner, SLA, escalation path
Correct answer: Risk ID, risk description, likelihood, impact
A baseline risk register entry requires a unique identifier, a description of the risk, its likelihood of occurring, and its potential impact if it occurs.
Question 7: Which Microsoft service enables automated risk-based Conditional Access policies that block or require MFA based on real-time sign-in risk scores?
- Microsoft Defender for Endpoint
- Microsoft Entra ID Protection integrated with Conditional Access (Correct answer)
- Microsoft Sentinel SOAR playbooks
- Azure DDoS Protection
Correct answer: Microsoft Entra ID Protection integrated with Conditional Access
Entra ID Protection generates real-time risk scores that Conditional Access policies can consume to dynamically enforce MFA or block access based on risk level.
SC-100 Risk Assessment 5
A cybersecurity architect must communicate risk to a non-technical executive board.
Which risk representation is most appropriate?