SC-100 Zero Trust Architecture 5

Question 1

Under the Zero Trust 'use least privilege access' principle, which Entra ID feature limits the blast radius of compromised application identities by granting only permissions required for a specific task?

Accepted Answer

App-only permissions scoped to minimum required Microsoft Graph scopes

Answer

Scoping application permissions to the minimum required Microsoft Graph API scopes ensures compromised app credentials cannot access resources beyond their legitimate need.

Question 2

A cybersecurity architect is designing Zero Trust for a hybrid environment. Which service provides a single SIEM and SOAR platform to collect signals across on-premises and cloud workloads for Zero Trust monitoring?

Accepted Answer

Microsoft Sentinel

Answer

Microsoft Sentinel is Microsoft's cloud-native SIEM/SOAR that aggregates signals from across the entire hybrid environment to support continuous monitoring and automated response aligned to Zero Trust.

Question 3

Which capability in Microsoft Entra allows administrators to define what conditions must be met (e.g., MFA completed, compliant device, named location) before a user can access a resource?

Accepted Answer

Conditional Access policies

Answer

Conditional Access policies evaluate if-then statements (if user meets condition, then grant/block/require control) to enforce Zero Trust access decisions dynamically.

Question 4

An organization needs to provide secure access to Azure VMs for administrators without exposing RDP/SSH ports to the internet. Which service aligns with Zero Trust by eliminating direct public exposure?

Accepted Answer

Azure Bastion

Answer

Azure Bastion provides browser-based RDP/SSH access to VMs over TLS through the Azure portal without requiring public IP addresses or open RDP/SSH ports on VMs.

Question 5

In Zero Trust, continuous validation means that access should be:

Accepted Answer

Re-evaluated in real time based on changing risk signals throughout the session

Answer

Continuous validation means access decisions are re-assessed throughout a session using real-time signals such as changing location, device state, or anomalous behavior.

(SC-100) Microsoft Cybersecurity Architect Expert Practice Test

(SC-100) Microsoft Cybersecurity Architect Expert Practice Test

SC-100 Zero Trust Architecture 5