SC-200 Cloud Security Architecture 2

Question 1

Your organization uses Microsoft Defender for Cloud. You need to identify which resources are exposed to the internet and have vulnerabilities. Which Defender for Cloud feature provides an attack path analysis showing how an attacker could reach sensitive resources?

Accepted Answer

Attack path analysis in Cloud Security Graph

Answer

Attack path analysis in Defender for Cloud's Cloud Security Graph visualizes chained risks showing how attackers could traverse your environment to reach sensitive assets.

Question 2

A security analyst needs to enforce that all Azure Storage accounts in a subscription require HTTPS-only access. Which service should be used to detect and remediate non-compliant resources at scale?

Accepted Answer

Azure Policy with a Deny effect

Answer

Azure Policy with a Deny effect prevents creation of non-compliant resources and can remediate existing ones through deployment policies.

Question 3

In a Zero Trust cloud architecture, which principle ensures that even authenticated users can only access resources required for their specific role?

Accepted Answer

Use least privilege access

Answer

Least privilege access limits users and workloads to only the permissions needed for their current task, reducing lateral movement risk.

Question 4

You are reviewing an Azure architecture where virtual machines in a spoke VNet must communicate with on-premises servers through a hub VNet. Which Azure service should you place in the hub to inspect and filter this traffic?

Accepted Answer

Azure Firewall

Answer

Azure Firewall is a managed, stateful firewall deployed in the hub VNet that inspects east-west and north-south traffic in a hub-and-spoke topology.

Question 5

Microsoft Defender for Cloud assigns a Secure Score to your subscription. What does a higher Secure Score indicate?

Accepted Answer

A greater number of security recommendations have been implemented

Answer

Secure Score increases as you remediate security recommendations, reflecting a stronger security posture.

(SC-200) Microsoft Security Operations Analyst Practice Test

(SC-200) Microsoft Security Operations Analyst Practice Test

SC-200 Cloud Security Architecture 2