View Full Microsoft SC-100 Exam Dumps and Practice Test Dumps.

 

Question 361

Which security architecture capability helps organizations discover and assess security risks associated with cloud applications used by employees?

1. Azure Load Balancer
2. Cloud application discovery
3. Azure Bastion
4. Azure Resource Manager

Correct Answer: 2
Explanation

Cloud application discovery helps security teams identify applications and services being used across an organization, including applications that may not have gone through formal approval processes. This visibility can help assess security, compliance, data-handling, and access risks associated with cloud services. Load Balancer manages network traffic, Bastion provides secure administrative access, and Resource Manager handles Azure resources. Discovery should be followed by risk assessment, governance decisions, access controls, and monitoring so that identified applications are managed according to organizational requirements.

Question 362

Which security architecture practice helps ensure that sensitive workloads remain operational if one Azure availability zone becomes unavailable?

1. Single-zone deployment
2. Local-only backup
3. Multi-zone deployment
4. Unrestricted public access

Correct Answer: 3
Explanation

Multi-zone deployment distributes workload components across separate availability zones within a supported Azure region. If one zone experiences an outage, properly designed applications can continue operating through resources in other zones. Single-zone deployment creates a larger availability dependency, while public access does not improve resilience. A multi-zone design should consider application dependencies, state management, data replication, health monitoring, failover behavior, and recovery procedures. Availability architecture should also reflect the business impact of downtime and the required service-level objectives.

Question 363

Which Microsoft security capability can help identify malicious or suspicious email messages before they reach users?

1. Microsoft Defender for Office 365
2. Azure Key Vault
3. Azure Bastion
4. Microsoft Purview Data Map

Correct Answer: 1
Explanation

Microsoft Defender for Office 365 provides security capabilities designed to help protect email and collaboration environments from threats such as phishing, malicious links, and harmful attachments. It can provide detection and protection capabilities that contribute to an organization’s email security architecture. Key Vault manages secrets and keys, Bastion provides secure administrative access, and Purview Data Map supports data governance. Email protection should be combined with strong identity security, user awareness, endpoint protection, investigation capabilities, and appropriate anti-phishing policies.

Question 364

An organization wants to make sure security policies are not changed without authorization. Which governance control is most appropriate?

1. Public policy editing
2. Unrestricted administrator access
3. Shared administrator accounts
4. Policy change control

Correct Answer: 4
Explanation

Policy change control establishes a formal process for modifying security policies, including authorization, review, testing, documentation, and approval. This helps prevent unauthorized changes that could weaken security controls or create compliance issues. Public editing and unrestricted administrative access increase the possibility of inappropriate changes, while shared administrator accounts weaken accountability. Policy changes should be traceable to authorized individuals and should include appropriate testing and rollback procedures. High-impact security policies should receive stronger review because changes can affect many workloads.

Question 365

Which architecture capability can help protect sensitive workloads by restricting which network paths they can use to communicate with other resources?

1. Network segmentation
2. Public routing
3. Universal connectivity
4. Open inbound access

Correct Answer: 1
Explanation

Network segmentation divides environments into controlled security boundaries and limits communication between workloads according to documented requirements. This can reduce unnecessary exposure and restrict lateral movement if one system is compromised. Public routing and open inbound access can increase the attack surface, while universal connectivity removes important boundaries. Segmentation should be based on workload sensitivity, application dependencies, trust relationships, and business requirements. It should also be supported by network security controls, identity-based authorization, logging, and continuous validation.

Question 366

Which Microsoft Sentinel capability provides visual dashboards that help analysts understand security data and trends?

1. Playbooks
2. Analytics rules
3. Workbooks
4. Data connectors

Correct Answer: 3
Explanation

Microsoft Sentinel workbooks provide visualization capabilities that can present security data through dashboards, charts, tables, and other visual elements. They can help analysts understand trends, investigate activity, monitor security posture, and communicate security information. Playbooks automate response actions, analytics rules identify suspicious activity, and data connectors ingest information. Workbooks should be designed around meaningful security and operational questions rather than simply displaying large volumes of data. Effective dashboards can help teams identify trends and prioritize investigation.

Question 367

Which security architecture principle requires access to be limited to only the resources and actions necessary for a user’s role?

1. Least privilege
2. Open authorization
3. Permanent access
4. Broad delegation

Correct Answer: 1
Explanation

Least privilege ensures that users, applications, and administrators receive only the permissions required to perform their legitimate responsibilities. Limiting permissions reduces the potential impact of compromised accounts and helps prevent accidental or unauthorized actions. Permanent broad access and unrestricted delegation create unnecessary exposure. Least privilege should be implemented through role-based access, resource scoping, identity governance, privileged access controls, and regular reviews. Organizations should also remove permissions when responsibilities change so that accumulated access does not become a persistent security weakness.

Question 368

Which approach helps an organization ensure that software dependencies are evaluated for known vulnerabilities before deployment?

1. Public source repositories
2. Dependency scanning
3. Manual password management
4. Unrestricted package installation

Correct Answer: 2
Explanation

Dependency scanning evaluates application libraries and third-party packages against known vulnerabilities and other security information. Integrating dependency scanning into development and CI/CD workflows can identify risks before vulnerable components reach production. Public repositories may contain useful software but do not themselves provide adequate security assurance. Manual password management and unrestricted package installation address different concerns and can introduce additional risks. Dependency management should also include version control, approved package sources, vulnerability prioritization, software inventories, and processes for updating affected components.

Question 369

Which security architecture approach can reduce the impact of a compromised user account by requiring additional verification before access to sensitive resources?

1. Anonymous access
2. Conditional access policies
3. Shared passwords
4. Permanent trusted sessions

Correct Answer: 2
Explanation

Conditional access policies can require additional verification or impose access restrictions when users attempt to access sensitive resources under specific conditions. Policies can evaluate factors such as user identity, device state, application, location, and risk. Anonymous access and shared passwords do not provide adequate identity assurance, while permanent trusted sessions can increase exposure if a session or device is compromised. Conditional access should be designed according to application sensitivity and business requirements, with appropriate authentication methods, policy testing, monitoring, and exception handling.

Question 370

Which security architecture capability helps organizations protect cryptographic keys using hardware-backed security mechanisms?

1. Azure Traffic Manager
2. Azure Load Balancer
3. Hardware-backed key protection
4. Azure DNS

Correct Answer: 3
Explanation

Hardware-backed key protection can provide stronger protection for sensitive cryptographic material by storing or processing keys within dedicated hardware security mechanisms. This can reduce exposure of high-value keys and support requirements for strong cryptographic protection. Traffic Manager, Load Balancer, and Azure DNS address traffic and networking requirements rather than key protection. Hardware-backed security should be considered according to the sensitivity of the keys, compliance requirements, application architecture, key lifecycle, administrative controls, and recovery requirements.

Question 371

Which security architecture activity helps determine how an attacker could move from an exposed application to a sensitive internal resource?

1. Threat modeling
2. Cost forecasting
3. Storage optimization
4. Capacity planning

Correct Answer: 1
Explanation

Threat modeling helps architects analyze potential attack paths by examining assets, trust boundaries, data flows, dependencies, entry points, and attacker techniques. It can reveal how compromise of one component could lead to access to more sensitive resources. Cost forecasting and capacity planning address financial and performance concerns, while storage optimization focuses on infrastructure efficiency. Threat modeling should occur during design and be revisited after significant architectural changes. Its findings can influence segmentation, authentication, authorization, monitoring, encryption, and other security controls.

Question 372

Which identity architecture approach allows a workload to obtain access tokens without storing a long-term client secret?

1. Shared service account
2. Workload identity federation
3. Hard-coded password
4. Permanent API key

Correct Answer: 2
Explanation

Workload identity federation allows supported workloads to authenticate using trusted identity assertions instead of relying on long-lived secrets. This can reduce credential-management overhead and lower the risk associated with secrets being exposed in source code, configuration, or CI/CD systems. Shared service accounts and permanent API keys can create broader access and longer-lived credentials, while hard-coded passwords are difficult to manage securely. Federation should be configured with narrowly scoped trust relationships, limited permissions, appropriate issuer conditions, and monitoring.

Question 373

Which security architecture capability helps detect unexpected changes to important system configurations or files?

1. File integrity monitoring
2. Azure Traffic Manager
3. Azure DNS
4. Storage performance monitoring

Correct Answer: 1
Explanation

File integrity monitoring detects unexpected changes to designated files, configurations, or system components. Unexpected modifications can indicate malware activity, unauthorized administrative actions, or other security events. Traffic Manager and DNS provide networking capabilities, while storage performance monitoring focuses on operational performance rather than integrity. Integrity monitoring should establish expected change processes so that legitimate modifications can be distinguished from suspicious ones. Alerts should be integrated with centralized monitoring and incident-response processes to support timely investigation.

Question 374

Which security architecture capability can help detect suspicious behavior by analyzing patterns associated with users and entities?

1. Static firewall rules
2. User and Entity Behavior Analytics
3. Storage replication
4. DNS forwarding

Correct Answer: 2
Explanation

User and Entity Behavior Analytics, or UEBA, analyzes activity patterns associated with users, devices, and other entities to identify potentially unusual behavior. This can help security teams detect activity that may not match established behavioral patterns, such as unusual access or unexpected authentication behavior. Static firewall rules and DNS forwarding address network functions, while storage replication supports resilience. UEBA should be interpreted alongside other security signals because unusual activity does not automatically indicate malicious behavior. Appropriate baselines, context, and investigation procedures are important.

Question 375

Which architecture practice helps ensure that third-party vendors receive only the access necessary to perform their contracted responsibilities?

1. Vendor-specific least-privilege access
2. Permanent global administrator access
3. Shared internal accounts
4. Unrestricted network connectivity

Correct Answer: 1
Explanation

Vendor-specific least-privilege access limits third-party permissions to the resources and activities required for their approved responsibilities. This reduces the potential impact if a vendor account is compromised or misused. Permanent global administrator access and unrestricted connectivity provide excessive privileges, while shared internal accounts reduce accountability. Third-party access should also include strong authentication, time-bound permissions where appropriate, access reviews, monitoring, contractual requirements, and defined offboarding procedures. Security architects should treat external access as a distinct trust relationship requiring explicit controls.

Question 376

Which Microsoft Purview capability helps organizations manage policies related to potentially inappropriate communications and content?

1. Communication Compliance
2. Azure Firewall
3. Azure Bastion
4. Azure Resource Manager

Correct Answer: 1
Explanation

Microsoft Purview Communication Compliance helps organizations identify and review potentially inappropriate communications according to configured policies and organizational requirements. It can support compliance programs by helping designated reviewers examine relevant communication risks. Azure Firewall provides network security, Bastion provides administrative connectivity, and Resource Manager manages Azure resources. Communication compliance should be designed with appropriate privacy protections, reviewer permissions, retention requirements, documented policies, and escalation procedures. Organizations should also ensure that monitoring practices align with applicable legal and regulatory obligations.

Question 377

Which security architecture approach helps prevent unauthorized changes to software after it has passed the required security checks?

1. Unrestricted artifact modification
2. Artifact signing and verification
3. Shared deployment passwords
4. Public package replacement

Correct Answer: 2
Explanation

Artifact signing and verification can help establish that software artifacts have not been modified after they were approved or produced by a trusted build process. Verification mechanisms can validate that the artifact corresponds to an expected publisher or build process before deployment. Unrestricted modification and public replacement weaken software supply-chain integrity, while shared passwords create credential risks. Artifact security should be combined with protected repositories, controlled build systems, dependency management, secure deployment identities, and appropriate audit logging throughout the software delivery lifecycle.

Question 378

Which architecture capability can help identify whether a cloud resource violates an organization’s required security configuration?

1. Configuration compliance monitoring
2. Public network access
3. Storage replication
4. DNS caching

Correct Answer: 1
Explanation

Configuration compliance monitoring evaluates resources against defined security and governance requirements. It can identify settings that deviate from approved standards, such as insecure network configurations, missing security controls, or unauthorized resource settings. Public network access, storage replication, and DNS caching serve different purposes and do not directly provide configuration compliance assessment. Continuous monitoring is valuable because resources can change after deployment. Findings should be prioritized, assigned to responsible teams, remediated, and rechecked to verify that compliance has been restored.

Question 379

Which security architecture principle is most important when designing access for a highly sensitive administrative function?

1. Broad permanent permissions
2. Shared administrative credentials
3. Strong authentication and least privilege
4. Anonymous administrative access

Correct Answer: 3
Explanation

Highly sensitive administrative functions require strong authentication and tightly scoped permissions because compromise of privileged access can affect many resources. Strong authentication reduces the likelihood that stolen credentials alone will be sufficient, while least privilege limits what an administrator can do after access is granted. Shared credentials reduce accountability, permanent broad permissions increase exposure, and anonymous administration is fundamentally inappropriate for sensitive operations. Additional protections can include just-in-time access, approval workflows, privileged workstations, monitoring, and separation of duties.

Question 380

Which architecture activity should be performed after a major security incident to determine whether existing controls need to be redesigned?

1. Security architecture reassessment
2. Disable security monitoring
3. Remove access controls
4. Ignore the incident findings

Correct Answer: 1
Explanation

A security architecture reassessment after a major incident helps determine whether existing controls were sufficient, correctly implemented, and appropriate for the attack scenario. The review can examine the initial attack path, detection coverage, identity controls, segmentation, application security, data protection, response processes, and architectural assumptions. Disabling monitoring or removing access controls would reduce security visibility and protection. Incident findings should feed into an improvement cycle so that weaknesses are addressed and the architecture becomes more resilient against similar or related threats.