SC-100 Security Posture Management 2

Question 1

A security architect is designing posture management for a hybrid environment. Which Defender for Cloud feature provides agentless assessment of on-premises servers onboarded through Azure Arc?

Accepted Answer

Agentless scanning available in Defender CSPM and Defender for Servers Plan 2

Answer

Defender for Servers Plan 1 with MMA agent

Answer

Log Analytics workspace direct connection

Answer

Microsoft Monitoring Agent (MMA) only

Question 2

Which metric in Microsoft Defender for Cloud represents the maximum achievable Secure Score if all recommendations are remediated?

Accepted Answer

Max score

Answer

Current score

Answer

Potential score increase

Answer

Security health percentage

Question 3

An architect needs to exempt a specific resource from a Defender for Cloud recommendation without affecting the overall Secure Score calculation for other resources. What should they configure?

Accepted Answer

Create an exemption rule on the recommendation for that specific resource

Answer

Disable the entire security policy for the subscription

Answer

Remove the resource from the monitored scope

Answer

Set the recommendation severity to Informational

Question 4

What is the role of 'security initiatives' in Microsoft Defender for Cloud?

Accepted Answer

They are collections of Azure Policy definitions grouped to achieve a specific security goal

Answer

They are automated runbooks that respond to security alerts

Answer

They define RBAC roles for security team members

Answer

They are pre-built threat hunting queries in Microsoft Sentinel

Question 5

Which Defender for Cloud feature continuously monitors the security configuration of Azure resources and provides prioritized recommendations to reduce attack surface?

Accepted Answer

Continuous assessment with security recommendations

Answer

Microsoft Defender Threat Intelligence

Answer

Microsoft Defender for Endpoint EDR

Answer

Azure Security Benchmark audit logs

Question 6

A company wants to track posture improvements over time and share progress reports with executive leadership. Which Defender for Cloud capability supports this need?

Accepted Answer

Workbooks and the Governance feature with SLA tracking

Answer

Alert suppression rules

Answer

Adaptive network hardening

Answer

Just-in-time VM access logs

Question 7

What does the 'Microsoft Cloud Security Benchmark' (MCSB) replace, and what is its primary purpose?

Accepted Answer

It replaces the Azure Security Benchmark and provides prescriptive best-practice recommendations aligned to common compliance frameworks

Answer

It replaces NIST SP 800-53 as the global security standard

Answer

It replaces CIS Controls specifically for AWS workloads

Answer

It replaces Secure Score as the primary posture metric