SC-100 Risk Assessment 5

Question 1

A cybersecurity architect must communicate risk to a non-technical executive board. Which risk representation is most appropriate?

Accepted Answer

Heat map showing likelihood vs. impact for top risks in business terms

Answer

A risk heat map translates technical findings into business-language likelihood and impact, making it suitable for executive-level risk communication.

Question 2

During cloud security design, a Zero Trust principle states 'assume breach.' How does this principle influence risk assessment?

Accepted Answer

It requires designing controls that assume attackers are already inside, shifting risk analysis toward lateral movement and data exfiltration

Answer

Assuming breach shifts risk assessment to model attacker behavior post-compromise, emphasizing controls for lateral movement detection, segmentation, and data protection.

Question 3

Which SC-100 concept involves continuously evaluating security controls against emerging threats rather than performing assessments on an annual schedule?

Accepted Answer

Continuous threat and vulnerability management

Answer

Continuous threat and vulnerability management provides ongoing risk visibility by constantly assessing controls against new CVEs, threat intelligence, and configuration drift.

Question 4

An organization is adopting a shared responsibility model in Azure. Which risk area remains the customer's responsibility regardless of the service model (IaaS, PaaS, SaaS)?

Accepted Answer

Data classification and protection

Answer

Data classification and protection remain the customer's responsibility across all cloud service models — Microsoft secures the platform, but customers own their data.

Question 5

A security architect is assessing risk for a new Azure deployment and wants to benchmark configurations against industry best practices. Which resource should they reference first?

Accepted Answer

Microsoft Cloud Security Benchmark (MCSB)

Answer

The Microsoft Cloud Security Benchmark (MCSB) provides Azure-specific security and risk control guidance mapped to multiple compliance frameworks.

(SC-100) Microsoft Cybersecurity Architect Expert Practice Test

(SC-100) Microsoft Cybersecurity Architect Expert Practice Test

SC-100 Risk Assessment 5