View Full Microsoft SC-100 Exam Dumps and Practice Test Dumps.

 

Question 81

A security architect wants to ensure that sensitive workloads are protected even if a user’s credentials are compromised. Which combination provides the strongest architectural foundation?

1. Least privilege, segmentation, and continuous monitoring
2. Shared administrator accounts and broad permissions
3. Perimeter security without identity controls
4. Permanent access for authenticated users

Correct Answer: 2

Explanation

Least privilege limits what a compromised identity can access, segmentation restricts movement between resources, and continuous monitoring helps detect suspicious activity. Together, these controls reduce the potential impact of credential compromise and support the Zero Trust assumption that a breach may occur. Broad permissions and shared accounts increase the potential blast radius, while perimeter-only controls may not protect cloud or remote resources adequately. Permanent access also creates unnecessary exposure. A layered architecture should combine identity, resource, network, and monitoring controls.

Question 82

Which Microsoft capability can provide unified visibility into security incidents across identities, endpoints, applications, and other Microsoft security services?

1. Microsoft Defender XDR
2. Microsoft Excel
3. Microsoft SharePoint
4. Microsoft PowerPoint

Correct Answer: 1

Explanation

Microsoft Defender XDR correlates security signals across multiple Microsoft security products and domains. This unified approach can help analysts investigate incidents that involve identities, endpoints, email, applications, and other resources. Instead of investigating every alert independently, security teams can gain broader context about related activities. Excel, SharePoint, and PowerPoint are productivity and collaboration services and do not provide the same cross-domain security detection and response capabilities. XDR can therefore be an important part of an integrated security operations architecture.

Question 83

An organization wants to enforce security controls before users can access sensitive cloud applications. Which architectural model is most appropriate?

1. Identity-centric access control
2. Network location-based trust
3. Anonymous application access
4. Flat internal networking

Correct Answer: 1

Explanation

Identity-centric access control evaluates who is requesting access and can incorporate device, risk, application, and other contextual information. This model aligns with Zero Trust because access decisions are based on verified identity and relevant conditions rather than simply assuming trust based on network location. Anonymous access and flat networking increase exposure, while location-based trust becomes less effective when applications are hosted in cloud environments. Identity-centric controls can also support stronger authorization and least-privilege access to sensitive applications.

Question 84

Which Microsoft service can help protect identities by detecting risky users and risky authentication events?

1. Microsoft Entra ID Protection
2. Microsoft Intune
3. Microsoft Defender for Cloud
4. Microsoft Purview

Correct Answer: 1

Explanation

Microsoft Entra ID Protection provides capabilities for detecting and responding to identity-related risks, including risky users and risky sign-in activity. These signals can be used with Conditional Access to apply additional controls when authentication risk increases. Intune focuses on endpoint management, Defender for Cloud focuses on cloud security posture and workload protection, and Purview focuses on data governance and compliance. Identity risk detection is important in Zero Trust because authentication decisions should account for the security context surrounding an identity.

Question 85

A company wants to prevent users from accessing sensitive applications unless their devices meet defined security requirements. Which architecture combination is most appropriate?

1. Device compliance and Conditional Access
2. DNS filtering and file compression
3. Network address translation and load balancing
4. Email archiving and document sharing

Correct Answer: 1

Explanation

Device compliance can evaluate whether an endpoint meets organizational requirements, while Conditional Access can use that information when making access decisions. Together, these capabilities can prevent noncompliant devices from accessing sensitive resources or require additional controls. DNS filtering and load balancing address different technical concerns, while email archiving and document sharing do not provide equivalent device-based access enforcement. This architecture supports Zero Trust by incorporating device health into authorization decisions rather than assuming that every authenticated device is trustworthy.

Question 86

Which security architecture capability helps identify whether an application has been granted more permissions than its business function requires?

1. Permission and entitlement review
2. Unrestricted administrative access
3. Shared service credentials
4. Permanent role assignments

Correct Answer: 2

Explanation

Permission and entitlement reviews help organizations determine whether users, applications, and service identities have permissions beyond what their business functions require. This supports least privilege and can reduce exposure caused by excessive access. Shared credentials and permanent broad roles make it harder to determine which permissions are actually required and increase the consequences of compromise. Regular reviews should consider changes in business responsibilities, application functionality, and organizational risk. They are particularly important for high-value resources and privileged identities.

Question 87

An organization wants to protect its security architecture from compromised administrator credentials. Which control can reduce the duration of privileged access?

1. Just-in-time privileged access
2. Permanent administrator roles
3. Shared administrator accounts
4. Anonymous administration

Correct Answer: 1

Explanation

Just-in-time privileged access provides elevated permissions only when they are required and for an approved period. This reduces the time during which powerful privileges are available and therefore limits the exposure associated with compromised administrative credentials. Permanent roles provide attackers with a larger opportunity to abuse stolen credentials. Shared accounts also reduce accountability, while anonymous administration removes useful identity information. Just-in-time access should be combined with approval, authentication, monitoring, and auditing controls for sensitive administrative operations.

Question 88

Which architecture approach helps protect identities from credential theft by reducing reliance on traditional passwords?

1. Passwordless authentication
2. Shared passwords
3. Password reuse
4. Unrestricted legacy authentication

Correct Answer: 1

Explanation

Passwordless authentication can reduce risks associated with password theft, reuse, phishing, and credential stuffing by using stronger authentication methods such as security keys, platform credentials, or supported biometric mechanisms. Although passwordless authentication does not eliminate every identity risk, it can significantly improve the security of authentication architecture when properly implemented. Shared passwords and password reuse increase exposure, while unrestricted legacy authentication may provide weaker protection. Passwordless strategies should be integrated with Conditional Access, device security, and identity governance.

Question 89

A security architect is evaluating whether an organization can identify every privileged identity across its cloud environment. Which capability is most important?

1. Privileged identity inventory and governance
2. Anonymous administrator access
3. Unmanaged service accounts
4. Shared credentials

Correct Answer: 1

Explanation

Privileged identity inventory and governance provide visibility into which users, applications, and other identities possess elevated permissions. Without this visibility, organizations may have forgotten administrative accounts, excessive permissions, or unmanaged service identities that create security risks. Governance can include role reviews, approval processes, just-in-time access, monitoring, and lifecycle management. Anonymous administration and shared credentials reduce accountability, while unmanaged service accounts may retain access long after it is needed. Maintaining an accurate privileged identity inventory is essential for effective Zero Trust governance.

Question 90

Which security architecture capability helps prevent unauthorized use of an application identity after the workload no longer requires access?

1. Identity lifecycle management
2. Permanent service permissions
3. Shared application credentials
4. Unrestricted role assignments

Correct Answer: 1

Explanation

Identity lifecycle management ensures that identities and their permissions are created, modified, reviewed, and removed according to defined requirements. For application identities, this can prevent abandoned service principals, managed identities, or workload accounts from retaining unnecessary access. Permanent permissions and shared credentials increase the likelihood that access remains active after the original requirement disappears. Lifecycle management supports least privilege by keeping access aligned with current business and technical needs. It should include ownership, periodic review, and appropriate deprovisioning procedures.

Question 91

A company needs to determine which applications are being used by employees without formal approval. Which Microsoft security capability can provide visibility into cloud application usage?

1. Microsoft Defender for Cloud Apps
2. Microsoft Defender Antivirus
3. Microsoft Intune
4. Microsoft Sentinel alone

Correct Answer: 1

Explanation

Microsoft Defender for Cloud Apps can help organizations discover and assess cloud application usage, including services that may not be formally approved by security teams. This visibility can support governance decisions and help identify applications that introduce security, compliance, or data-protection risks. Defender Antivirus focuses on endpoint malware protection, while Intune focuses on endpoint and application management. Sentinel provides broad security analytics but is not specifically designed as the primary cloud application discovery platform. Cloud application visibility is important as SaaS adoption increases.

Question 92

Which architecture capability helps ensure that security incidents can be investigated after they occur?

1. Centralized logging and audit trails
2. Disabled event collection
3. Short-term undocumented logs
4. Anonymous administrative actions

Correct Answer: 1

Explanation

Centralized logging and audit trails provide the evidence needed to investigate security events, understand what happened, identify affected resources, and support incident response. Logs should be protected against unauthorized modification and retained according to organizational, legal, and compliance requirements. Disabling event collection or retaining undocumented logs creates significant visibility gaps. Anonymous administrative actions also reduce accountability. Security architecture should therefore define what events need to be collected, where they are stored, how long they are retained, and who can access them.

Question 93

An organization wants to prevent unauthorized users from changing security configurations in Azure. Which architectural capability should be applied?

1. Role-based access control with policy governance
2. Shared global administrator credentials
3. Anonymous access
4. Unrestricted contributor permissions

Correct Answer: 1

Explanation

Role-based access control limits administrative permissions according to defined responsibilities, while policy governance can enforce or assess required configurations. Together, these capabilities reduce the likelihood that unauthorized users can make security-sensitive changes. Shared global administrator credentials create significant accountability and compromise risks. Anonymous access is inappropriate for administrative functions, and unrestricted contributor permissions may provide more access than users require. Administrative roles should be carefully scoped, reviewed, monitored, and elevated only when necessary.

Question 94

Which architectural capability can help protect data if storage media or cloud storage credentials are compromised?

1. Encryption
2. Open access permissions
3. Plaintext storage
4. Shared storage accounts

Correct Answer: 1

Explanation

Encryption helps protect data by making information unreadable without the appropriate cryptographic key or mechanism. It can provide an additional protection layer if storage media, backups, or other storage locations are exposed. Plaintext storage and open permissions increase the consequences of unauthorized access. Shared storage accounts can also weaken accountability and make access control more difficult. Encryption should be designed alongside identity, access control, key management, data classification, and monitoring because encryption alone does not prevent unauthorized access.

Question 95

A security architect wants to reduce the impact of compromised credentials by requiring stronger authentication for sensitive resources. Which control should be considered?

1. Phishing-resistant multifactor authentication
2. Shared passwords
3. Single-factor authentication
4. Password reuse

Correct Answer: 1

Explanation

Phishing-resistant multifactor authentication provides stronger protection against credential theft because it uses authentication mechanisms designed to resist common phishing techniques. This can be particularly valuable for privileged accounts and sensitive applications. Shared passwords and password reuse increase credential exposure, while single-factor authentication provides fewer protections if credentials are stolen. Authentication strength should be selected according to resource sensitivity and risk. Combining strong authentication with device controls, Conditional Access, and least privilege creates a more resilient identity architecture.

Question 96

Which security architecture practice helps determine whether users still require access after changing roles within an organization?

1. Periodic access reviews
2. Permanent access assignments
3. Shared credentials
4. Anonymous permissions

Correct Answer: 1

Explanation

Periodic access reviews help verify that permissions remain appropriate as users change roles, projects, responsibilities, or organizational units. Without regular review, users may accumulate access that was necessary for previous responsibilities but is no longer required. Permanent assignments can therefore create privilege accumulation over time. Shared credentials and anonymous permissions further reduce accountability. Access reviews should focus especially on sensitive applications, privileged roles, and high-value data. They support identity governance and the least-privilege principle within a broader Zero Trust architecture.

Question 97

An organization wants to limit the ability of a compromised endpoint to communicate with critical servers. Which architecture control is most relevant?

1. Network segmentation
2. Universal internal access
3. Flat networking
4. Shared administrator credentials

Correct Answer: 1

Explanation

Network segmentation separates systems into controlled communication zones and can restrict which endpoints are allowed to communicate with critical resources. If an endpoint is compromised, segmentation can prevent or limit direct access to sensitive servers and reduce lateral movement. Flat networks and universal internal access provide fewer restrictions, while shared administrator credentials can increase the consequences of endpoint compromise. Segmentation should be designed around application dependencies, business requirements, and security risk so that necessary communications remain available while unnecessary paths are restricted.

Question 98

Which architectural approach allows an organization to apply different security controls according to the sensitivity of data?

1. Data classification and labeling
2. Identical protection for every file
3. Unrestricted public sharing
4. Anonymous data access

Correct Answer: 4

Explanation

Data classification and labeling allow organizations to identify information according to sensitivity, business value, or regulatory requirements. Security policies can then apply appropriate controls based on those classifications. Highly sensitive information may require stronger encryption, access restrictions, monitoring, or data-loss prevention policies than publicly available content. Applying identical protection to every file may be inefficient, while public sharing and anonymous access increase exposure. Classification provides the context required for risk-based data protection and governance.

Question 99

A company wants to reduce the security impact of a compromised endpoint by preventing it from reaching unrelated workloads. Which Zero Trust concept does this most directly support?

1. Assume breach
2. Implicit trust
3. Open access
4. Perimeter-only security

Correct Answer: 1

Explanation

The assume-breach principle encourages organizations to design environments so that compromise of one device, identity, or workload does not automatically result in broad access. Segmentation, least privilege, monitoring, and strong authorization can limit what a compromised endpoint can reach. Implicit trust and open access have the opposite effect by allowing broader connectivity. Perimeter-only security also provides limited protection once an attacker has gained internal access. Designing for assumed compromise helps reduce lateral movement and overall blast radius.

Question 100

Which activity should occur after implementing a major security architecture change to determine whether the expected security outcome was achieved?

1. Validation and effectiveness assessment
2. Immediate removal of monitoring
3. Permanent administrator access
4. Disabling security policies

Correct Answer: 1

Explanation

Validation and effectiveness assessment determine whether a newly implemented architecture or control actually meets its intended security objectives. This can involve testing configurations, reviewing telemetry, measuring policy enforcement, checking access behavior, and confirming that business requirements remain satisfied. Removing monitoring or disabling security policies would eliminate important safeguards. Permanent administrator access is unrelated to validating architectural outcomes. Security architecture should therefore include feedback mechanisms so that implemented controls can be measured, improved, and adjusted when they do not provide the expected level of protection.