SC-100 Security Strategy & Risk Management 4 — Questions and Answers
Question 1: A security architect is evaluating Microsoft Defender for Cloud's secure score. What does a higher secure score primarily indicate?
- The organization has experienced fewer security incidents in the past 90 days
- A greater percentage of security recommendations have been implemented across monitored resources (Correct answer)
- The organization's total attack surface has decreased by the scored percentage
- All critical and high-severity vulnerabilities have been remediated
Correct answer: A greater percentage of security recommendations have been implemented across monitored resources
Microsoft Defender for Cloud's secure score reflects the percentage of security recommendations that have been implemented, providing a point-in-time view of security posture.
Question 2: Which approach to privileged access strategy aligns with Microsoft's recommended 'tiered administration model' for securing privileged access?
- Using a single privileged account per administrator to simplify access management and auditing
- Separating administrative accounts into tiers based on the sensitivity of systems managed, with no cross-tier access (Correct answer)
- Requiring all administrators to use cloud-only accounts to eliminate on-premises attack paths
- Implementing just-in-time access exclusively through Privileged Identity Management for all admin tasks
Correct answer: Separating administrative accounts into tiers based on the sensitivity of systems managed, with no cross-tier access
Microsoft's tiered administration model separates Tier 0 (identity/domain), Tier 1 (servers/apps), and Tier 2 (endpoints) with strict boundaries to contain lateral movement from compromise.
Question 3: An organization is planning its security strategy for insider threat risk. Which combination of controls best addresses both malicious and accidental insider threats?
- Background checks during hiring and annual security awareness training
- User and Entity Behavior Analytics (UEBA) combined with data loss prevention policies and least-privilege access (Correct answer)
- Blocking USB ports and monitoring all employee emails for sensitive keywords
- Requiring manager approval for all file access requests and logging all user activity
Correct answer: User and Entity Behavior Analytics (UEBA) combined with data loss prevention policies and least-privilege access
UEBA detects anomalous behavior patterns for malicious insiders while DLP prevents accidental data loss, and least privilege limits the potential impact of both threat types.
Question 4: When applying the Microsoft Cloud Adoption Framework (CAF) security methodology, which phase establishes security baselines and hardening standards for cloud workloads?
- Strategy phase, where business outcomes and motivations are defined
- Ready phase, where landing zone environments are built with security guardrails (Correct answer)
- Adopt phase, where workloads are migrated or modernized at scale
- Govern phase, where policy compliance is continuously evaluated
Correct answer: Ready phase, where landing zone environments are built with security guardrails
The CAF Ready phase includes implementing security baselines and hardening standards within the landing zone before workloads are deployed.
Question 5: A financial services organization needs to implement a cyber resilience strategy. Which capability is MOST critical to achieving operational resilience during an active ransomware attack?
- Having a comprehensive vulnerability management program with weekly scanning
- Maintaining tested offline backups combined with documented and rehearsed incident response playbooks (Correct answer)
- Deploying next-generation antivirus on all endpoints with real-time cloud lookup
- Implementing network segmentation between business units
Correct answer: Maintaining tested offline backups combined with documented and rehearsed incident response playbooks
Tested offline backups ensure data recovery is possible even if all connected systems are encrypted, and rehearsed playbooks enable rapid coordinated response to minimize business impact.
Question 6: Which Microsoft security principle states that the identity control plane should be treated as the new security perimeter in cloud environments?
- Defense in Depth
- Identity as the Primary Security Perimeter (Correct answer)
- Network Micro-segmentation
- Data-Centric Security
Correct answer: Identity as the Primary Security Perimeter
Microsoft's Zero Trust model positions identity as the primary security perimeter because cloud resources are accessed from anywhere, making network perimeter insufficient as the sole control.
Question 7: A security architect is designing a strategy to reduce attack surface in Azure. Which combination of services best implements a defense-in-depth approach for internet-facing applications?
- Azure Firewall and Network Security Groups only
- Azure DDoS Protection, Azure Web Application Firewall, Azure Front Door, and Private Endpoints for backend services (Correct answer)
- Azure Bastion and Just-In-Time VM access only
- Microsoft Defender for Cloud and Microsoft Sentinel only
Correct answer: Azure DDoS Protection, Azure Web Application Firewall, Azure Front Door, and Private Endpoints for backend services
Layering DDoS protection, WAF, CDN/routing with Azure Front Door, and private endpoints for backends implements multiple independent defensive layers for internet-facing workloads.
SC-100 Security Strategy & Risk Management 4
A security architect is evaluating Microsoft Defender for Cloud's secure score.
What does a higher secure score primarily indicate?