SC-100 Security Strategy & Risk Management 3

Question 1

An SC-100 candidate is advising a board on cybersecurity governance. Which structure best positions security as a strategic business enabler rather than a cost center?

Accepted Answer

Establishing a security governance committee with C-suite participation and quarterly business risk reporting

Answer

A security governance committee with C-suite participation elevates security to a strategic function and ensures risk decisions are made with full business context.

Question 2

Which Microsoft security concept describes the practice of continuously validating that users, devices, and applications meet security requirements before granting access to resources?

Accepted Answer

Continuous Access Evaluation (CAE)

Answer

Continuous Access Evaluation enables real-time revocation of access tokens when user or device conditions change, implementing continuous validation rather than point-in-time checks.

Question 3

A security architect is assessing the risk of a proposed cloud migration. Which threat modeling methodology is MOST appropriate for identifying architectural risks in complex distributed systems?

Accepted Answer

STRIDE, focusing on Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege

Answer

STRIDE is Microsoft's recommended threat modeling methodology for systematically identifying threats across system components and data flows in architectural designs.

Question 4

When designing a security operations strategy, which metric best measures the effectiveness of an organization's incident detection capability?

Accepted Answer

Mean Time to Detect (MTTD) correlated with alert fidelity rate

Answer

MTTD combined with alert fidelity (signal-to-noise ratio) provides a meaningful measure of detection effectiveness, balancing speed with accuracy.

Question 5

An organization must demonstrate security program maturity to a regulator. Which framework provides a standardized model for measuring and communicating security capability maturity levels?

Accepted Answer

CMMI for Security (Capability Maturity Model Integration)

Answer

CMMI provides a structured model with defined maturity levels (Initial through Optimizing) that organizations use to assess and communicate security program maturity.

(SC-100) Microsoft Cybersecurity Architect Expert Practice Test

(SC-100) Microsoft Cybersecurity Architect Expert Practice Test

SC-100 Security Strategy & Risk Management 3