View Full Microsoft SC-100 Exam Dumps and Practice Test Dumps.

 

Question 341

Which security architecture capability helps identify security weaknesses in an organization’s cloud configuration before they are exploited?

1. Cloud security posture management
2. Azure Load Balancer
3. Azure Traffic Manager
4. Azure DNS

Correct Answer: 1
Explanation

Cloud security posture management helps organizations continuously evaluate cloud environments against security requirements and identify configuration weaknesses. It can highlight issues such as excessive permissions, insecure network settings, missing protections, or policy violations. Load Balancer and Traffic Manager provide traffic-management capabilities, while Azure DNS provides name-resolution services. Security posture management is most effective when findings are prioritized according to business risk, monitored continuously, and connected to remediation workflows so that important weaknesses are addressed rather than simply reported.

Question 342

Which architecture practice helps ensure that an application’s security requirements are considered before its design is finalized?

1. Post-production incident review
2. Security requirements analysis
3. Unrestricted deployment
4. Manual password sharing

Correct Answer: 2
Explanation

Security requirements analysis identifies the protection needs of an application before architectural decisions become difficult to change. Requirements may cover authentication, authorization, data protection, logging, availability, compliance, privacy, network boundaries, and incident response. Performing this analysis early allows architects and developers to design appropriate controls into the solution instead of adding them after deployment. Unrestricted deployment and shared passwords introduce unnecessary risk, while post-production review occurs too late to influence many foundational design decisions.

Question 343

Which Microsoft security architecture capability can help identify suspicious activity occurring within an organization’s on-premises Active Directory environment?

1. Azure Bastion
2. Microsoft Defender for Identity
3. Azure Front Door
4. Microsoft Purview Records Management

Correct Answer: 2
Explanation

Microsoft Defender for Identity is designed to help detect identity-related threats and suspicious activities within on-premises Active Directory environments. It can provide security signals related to domain controllers and identities, helping organizations investigate techniques such as credential theft and lateral movement. Azure Bastion provides administrative connectivity, Front Door supports application delivery, and Purview Records Management addresses information governance. Defender for Identity can contribute to a broader hybrid identity security architecture alongside Entra ID, endpoint protection, monitoring, and privileged access controls.

Question 344

An organization wants to prevent a security team from granting itself unrestricted access while administering a sensitive environment. Which principle should be applied?

1. Universal administration
2. Shared credentials
3. Separation of duties
4. Permanent privilege

Correct Answer: 3
Explanation

Separation of duties prevents sensitive responsibilities from being concentrated in a single person or role. For example, the person requesting a high-risk privilege change may be different from the person approving it. This provides stronger accountability and reduces the opportunity for unauthorized activity. Universal administration, shared credentials, and permanent privilege increase the potential impact of a compromised or misused administrative account. Separation of duties should be applied according to risk and can be combined with approval workflows, privileged identity management, logging, and periodic reviews.

Question 345

Which Microsoft Sentinel capability can automatically respond to an alert by calling predefined workflows and external services?

1. Watchlists
2. Playbooks
3. Workbooks
4. Data connectors

Correct Answer: 2
Explanation

Microsoft Sentinel playbooks provide automation capabilities that can execute predefined workflows in response to alerts or incidents. They can perform tasks such as notifying teams, enriching incident information, creating service-management tickets, or initiating other approved actions. Watchlists provide reference information, workbooks visualize data, and data connectors ingest information into Sentinel. Playbooks should use appropriately scoped permissions and should be thoroughly tested because automated actions can have operational consequences. Logging and monitoring should also be implemented to verify automation effectiveness.

Question 346

Which architecture capability helps ensure that only trusted software artifacts are promoted through a deployment pipeline?

1. Artifact integrity verification
2. Public deployment permissions
3. Shared administrator passwords
4. Unrestricted artifact replacement

Correct Answer: 1
Explanation

Artifact integrity verification helps ensure that software packages or deployment artifacts have not been unexpectedly modified between build and deployment stages. Organizations can use mechanisms such as cryptographic hashes, signatures, trusted repositories, and controlled promotion processes to establish confidence in artifact integrity. Shared passwords and unrestricted replacement increase supply-chain risk, while public deployment permissions weaken control over production releases. Artifact security should be combined with secure build environments, source-code protection, dependency management, access controls, and monitoring throughout the software delivery lifecycle.

Question 347

Which security architecture approach is most appropriate for workloads that require access to sensitive services without exposing those services through public endpoints?

1. Public IP architecture
2. Private endpoints
3. Anonymous service access
4. Internet-only routing

Correct Answer: 2
Explanation

Private endpoints provide private network connectivity to supported services without requiring the service to be directly exposed through a public endpoint. This can reduce public attack surface and help organizations build controlled network paths for sensitive workloads. Public IP architectures and internet-only routing can create unnecessary exposure, while anonymous service access does not provide adequate authorization. Private endpoint designs should still incorporate identity controls, authorization, DNS configuration, network segmentation, monitoring, and appropriate service-level security because private connectivity alone does not determine who is authorized.

Question 348

Which security architecture metric measures the proportion of relevant assets that have appropriate security monitoring and detection coverage?

1. Storage utilization
2. Network throughput
3. Detection coverage
4. Application response time

Correct Answer: 3
Explanation

Detection coverage measures how effectively an organization can monitor and detect threats across relevant assets, systems, and scenarios. High-value assets should have appropriate telemetry and detection capabilities based on their business importance and threat exposure. Storage utilization, network throughput, and application response time can be useful operational metrics but do not directly measure security detection coverage. Security teams can use coverage measurements to identify monitoring gaps, prioritize telemetry investments, improve analytics rules, and determine whether critical threat scenarios can be detected and investigated.

Question 349

Which architecture control helps prevent a compromised application from using credentials belonging to an unrelated workload?

1. Workload-specific identities
2. Shared service accounts
3. Global administrator credentials
4. Common application passwords

Correct Answer: 1
Explanation

Workload-specific identities allow applications and services to authenticate independently and receive permissions appropriate to their own responsibilities. This limits the impact if one workload is compromised because its credentials should not automatically provide access to unrelated resources. Shared service accounts and common passwords create broader trust relationships and make accountability more difficult. Global administrator credentials create excessive privilege. Workload identity architecture should include managed identities or appropriate federation where supported, narrowly scoped permissions, monitoring, and regular access reviews.

Question 350

Which security architecture capability helps organizations identify and prioritize vulnerabilities based on the assets and business services they could affect?

1. Vulnerability risk prioritization
2. Public network routing
3. DNS caching
4. Storage replication

Correct Answer: 1
Explanation

Vulnerability risk prioritization considers more than the technical severity of a vulnerability. It can incorporate asset criticality, exploitability, exposure, business impact, compensating controls, and the importance of affected services. This helps security teams focus remediation efforts on weaknesses that represent greater organizational risk. DNS caching and storage replication address infrastructure requirements, while public routing concerns network connectivity. Effective vulnerability management should include asset inventory, scanning, prioritization, remediation, verification, reporting, and continuous reassessment as threats and environments change.

Question 351

Which Microsoft security capability can help protect endpoints by detecting malicious behavior and providing response capabilities?

1. Azure Policy
2. Microsoft Defender for Endpoint
3. Azure Resource Manager
4. Microsoft Purview Data Map

Correct Answer: 2
Explanation

Microsoft Defender for Endpoint provides endpoint security capabilities including threat detection, endpoint detection and response, investigation, and response actions. It can help security teams identify malicious behavior occurring on supported devices and investigate associated activity. Azure Policy manages resource governance, Resource Manager manages Azure resources, and Purview Data Map supports data governance. Endpoint protection should be integrated into the broader security architecture so that endpoint signals can be correlated with identity, email, application, and cloud security information when investigating incidents.

Question 352

Which approach helps an organization maintain consistent security configurations across newly deployed cloud workloads?

1. Security baselines
2. Manual one-time configuration
3. Shared administrator passwords
4. Uncontrolled workload deployment

Correct Answer: 1
Explanation

Security baselines define approved configuration standards that can be applied consistently across workloads and environments. They can cover identity settings, logging, encryption, network controls, endpoint protections, and other requirements appropriate to the workload. Manual one-time configuration can lead to configuration drift, while shared passwords and uncontrolled deployments increase security risks. Baselines should be version-controlled, tested, monitored, and periodically updated as threats, technologies, and organizational requirements change. Exceptions should be documented and governed through an established process.

Question 353

Which security architecture model places security controls close to users, devices, applications, and data rather than relying primarily on a central network perimeter?

1. Perimeter-only security
2. Distributed Zero Trust architecture
3. Public network architecture
4. Flat network architecture

Correct Answer: 2
Explanation

A distributed Zero Trust architecture applies security controls across multiple layers rather than depending primarily on a central network perimeter. Identity, device, application, network, and data controls can each contribute to access decisions and risk reduction. Perimeter-only models may provide insufficient protection when users work remotely or when applications and services are distributed across cloud environments. A Zero Trust architecture supports continuous verification, least privilege, segmentation, monitoring, and contextual access decisions across the environment.

Question 354

Which capability helps an organization determine whether sensitive information is being accessed or shared in ways that violate organizational policies?

1. Azure Load Balancer
2. Azure Bastion
3. Data governance and monitoring
4. Azure Traffic Manager

Correct Answer: 3
Explanation

Data governance and monitoring capabilities help organizations understand how sensitive information is classified, accessed, used, and shared. Microsoft Purview capabilities can support classification, auditing, data lifecycle management, and compliance-related monitoring across supported environments. Load Balancer and Traffic Manager manage network traffic, while Bastion provides administrative connectivity. Data monitoring should be aligned with sensitivity classifications, business requirements, privacy considerations, and regulatory obligations. Appropriate controls should also be established for investigating and responding to policy violations.

Question 355

Which architecture practice can reduce the risk created by long-lived application credentials in automated deployment environments?

1. Workload identity federation
2. Permanent client secrets
3. Shared deployment passwords
4. Hard-coded credentials

Correct Answer: 1
Explanation

Workload identity federation can allow automated workloads to authenticate using trusted identity assertions rather than storing long-lived credentials. This reduces the need to manage permanent secrets within deployment systems and can lower the impact of credential leakage. Permanent client secrets, shared passwords, and hard-coded credentials create additional risks because they may be exposed through source code, configuration, or build systems. Federation should use narrowly defined trust relationships and permissions so that only approved workloads can obtain access to the required resources.

Question 356

Which architecture approach helps an organization maintain security visibility when applications are distributed across multiple cloud and on-premises environments?

1. Isolated monitoring systems with no correlation
2. Centralized security monitoring
3. Disabled logging
4. Local-only security analysis

Correct Answer: 2
Explanation

Centralized security monitoring can provide a unified view of security events across cloud, on-premises, identity, endpoint, and application environments. This is particularly useful in hybrid and multicloud architectures where individual systems may generate valuable but disconnected security signals. Isolated monitoring can make cross-environment investigation more difficult, while disabled logging removes important evidence. Centralized monitoring should include appropriate data connectors, normalization, retention, analytics, access controls, and automation so that security teams can efficiently identify and investigate relevant activity.

Question 357

Which security architecture capability can help ensure that a user who leaves the organization no longer retains access to protected resources?

1. Identity lifecycle automation
2. Public network filtering
3. Storage replication
4. DNS forwarding

Correct Answer: 1
Explanation

Identity lifecycle automation can help ensure that access is removed when users leave the organization or undergo relevant employment changes. Automated workflows can disable accounts, remove group memberships, revoke access packages, and trigger other defined offboarding activities. Manual processes can leave accounts active longer than necessary. Storage replication, DNS forwarding, and network filtering do not address identity lifecycle directly. Lifecycle automation should be integrated with authoritative HR information, identity governance, access reviews, privileged access management, and exception handling.

Question 358

Which security architecture approach provides stronger protection for highly privileged administrative activities by requiring administration from a hardened environment?

1. Standard employee laptop
2. Shared public workstation
3. Privileged Access Workstation
4. Unmanaged personal device

Correct Answer: 3
Explanation

A Privileged Access Workstation is designed specifically for sensitive administrative operations and can be hardened to reduce exposure to threats commonly encountered during ordinary user activity. Using a dedicated environment helps protect privileged credentials and administrative sessions from compromised applications, websites, or user activities. Standard employee laptops and unmanaged personal devices typically have broader exposure, while shared public workstations provide weak security boundaries. PAWs should be combined with strong authentication, restricted software, patching, monitoring, privileged identities, and controlled administrative workflows.

Question 359

Which security architecture practice helps identify whether an implemented control actually reduces the risk it was intended to address?

1. Control effectiveness testing
2. Application performance testing only
3. Storage capacity measurement
4. Network bandwidth testing

Correct Answer: 1
Explanation

Control effectiveness testing evaluates whether a security control is correctly implemented, operates as intended, and provides the expected level of risk reduction. Testing may include technical validation, simulated attacks, configuration reviews, audit evidence, operational metrics, or other appropriate assessment methods. Performance and capacity measurements can be useful for infrastructure planning but do not demonstrate security effectiveness. Control testing should be performed periodically and after major changes because an effective control can become ineffective if configurations, threats, dependencies, or business processes change.

Question 360

Which architecture principle requires security teams to design controls according to the sensitivity and importance of the resources being protected?

1. Equal controls for every resource
2. Risk-based security
3. Unrestricted access
4. Technology-first architecture

Correct Answer: 2
Explanation

Risk-based security applies controls according to factors such as data sensitivity, business criticality, threat exposure, regulatory requirements, and potential impact. High-value resources may require stronger authentication, tighter network boundaries, enhanced monitoring, and more restrictive authorization than lower-risk resources. Applying identical controls everywhere can waste resources or create unnecessary operational restrictions. Unrestricted access increases exposure, while technology-first architecture may select controls without first understanding the actual risk. Risk-based architecture helps align security investment with the consequences of compromise.