Microsoft Certified: Cybersecurity Architect Expert — Practice Set 1

Question 1

You are designing a cybersecurity strategy for an organization that has experienced a ransomware attack. The organization needs to ensure that critical business systems can be recovered quickly with minimal data loss. Which ransomware mitigation priority should be addressed first according to Microsoft Security Best Practices?

Accepted Answer

According to Microsoft Security Best Practices for ransomware, securing backup and restore capabilities is the highest priority because it directly enables business resilience and recovery. EDR, firewalls, and security training are all important but secondary to ensuring the organization can recover from an attack. Without verified backups, all other controls may still result in catastrophic business disruption.

Question 2

Your organization is adopting a Zero Trust security model. You are reviewing the current architecture, which relies on network perimeter controls to protect resources. You need to identify which Zero Trust principle the current design violates most critically. Which principle is not being followed?

Accepted Answer

A perimeter-based model trusts users and devices once they are inside the network boundary without explicitly verifying identity, device health, and context for every access request. This violates the Zero Trust principle of 'Verify explicitly,' which requires always authenticating and authorizing based on all available data points. 'Assume breach' and 'Least privileged access' may also be relevant, but the fundamental flaw of perimeter trust is the absence of explicit verification.

Question 3

You are designing security architecture for an organization migrating to Azure. You need to recommend a structured approach for landing zone design that incorporates security and governance controls aligned with Microsoft best practices. Which framework should you reference?

Accepted Answer

The Microsoft Cloud Adoption Framework for Azure (CAF) provides prescriptive guidance for building Azure landing zones that incorporate security, governance, networking, and identity controls from the start. Azure landing zones are the CAF's implementation of secure, scalable enterprise environments. MCRA provides reference architectures but not landing zone design. ISO 27001 and NIST CSF are control frameworks that can be mapped to Azure but are not Azure architecture design frameworks.

Question 4

You are designing a security strategy to protect your organization against supply chain attacks. According to Microsoft Security Best Practices, which two controls should be prioritized? Choose 2.

Accepted Answer

Enforcing code signing and build pipeline integrity helps detect tampering in the software supply chain. Restricting vendor access to privileged identity systems limits blast radius if a vendor is compromised. Disabling all third-party integrations is impractical for most organizations. Developer certifications and on-premises expansion are not directly supply chain security controls aligned with Microsoft Best Practices.

Question 5

Your organization needs to design a DevSecOps process aligned with the Microsoft Cloud Adoption Framework. You need to ensure that security gates are embedded in the CI/CD pipeline without significantly slowing developer velocity. Which approach best represents this alignment?

Accepted Answer

Integrating automated security scanning tools (SAST, dependency scanning, IaC security scanning) directly as required pipeline gates embeds security as code and catches issues early with minimal developer friction, aligning with CAF DevSecOps principles of shift-left security. Manual reviews at end of cycle introduce delays. Delegating post-deployment introduces risk. Manual change requests create friction and bottlenecks without automation benefits.

Question 6

You are reviewing your organization's disaster recovery plan. You need to recommend backup and restore design principles that align with Microsoft Security Best Practices for ransomware resilience. Which backup configuration is most critical?

Accepted Answer

Immutable backups that are offline or stored in an isolated environment are the critical protection against ransomware, which commonly targets and encrypts backup infrastructure. Cloud-only backups that are accessible from the same environment can be encrypted by ransomware. Co-located backups in the same storage account are vulnerable to the same attack. Backing up only databases leaves operating systems unrecoverable.

Question 7

Your organization needs a unified security operations solution that combines security information and event management (SIEM) with security orchestration and automated response (SOAR) capabilities, and integrates with Microsoft Defender products for extended detection and response (XDR). Which Microsoft solution provides all of these capabilities?

Accepted Answer

Microsoft Sentinel is a cloud-native SIEM/SOAR solution that integrates with Microsoft Defender XDR to provide unified extended detection and response across the entire Microsoft security stack. Purview Audit provides compliance-focused audit logs. Azure Monitor with Action Groups handles operational alerts, not security incidents. Defender for Cloud provides posture management and workload protection but is not a full SIEM/SOAR solution.

Question 8

You are designing an identity solution for a multinational organization that needs to provide secure access for external partners to internal applications. Partners use their own identity providers. You need to minimize credential management overhead while maintaining security controls. Which Microsoft Entra ID capability should you design with?

Accepted Answer

Microsoft Entra B2B collaboration allows external partner users to authenticate using their own organizational identity provider via federation, eliminating the need to manage separate credentials. Conditional Access policies then apply security controls to these guest identities. Creating local accounts increases credential management burden. Entra Domain Services provides domain services for applications, not B2B federation. Separate tenants per partner create unmanageable complexity.

Question 9

You are designing a privileged access strategy for your organization. Administrators need to perform privileged operations on Azure resources and Active Directory. You need to ensure that privileged access is granted just-in-time, with approval workflows, and all activations are audited. Which solution should you design?

Accepted Answer

Microsoft Entra PIM provides just-in-time privileged access with configurable activation requirements including approval workflows, MFA challenges, and time-bound access. All activations are logged for audit purposes. Permanent Global Administrator assignments violate least privilege and PIM principles. Shared accounts lack individual accountability. Conditional Access MFA is a good baseline control but does not provide JIT elevation or approval workflows.

Question 10

You are designing a compliance solution for an organization subject to financial regulatory requirements. You need to demonstrate that controls align with PCI DSS and ISO 27001 using built-in Azure capabilities. Which Defender for Cloud feature provides automated compliance assessment against regulatory standards?

Accepted Answer

The Microsoft Defender for Cloud regulatory compliance dashboard allows you to assign regulatory standards (such as PCI DSS, ISO 27001, SOC 2) to your subscriptions and provides automated assessment of control compliance with pass/fail status. MCSB recommendations are Microsoft's own benchmark, not regulatory standards. Azure Policy reports compliance with custom policies but does not map to regulatory frameworks automatically. Purview Compliance Manager is for Microsoft 365 services, not Azure infrastructure compliance.

Question 11

You are designing a modern authentication strategy for your organization. Users must be continuously evaluated for risk even after initial authentication, and high-risk sign-ins must trigger step-up authentication. Which two Microsoft Entra ID capabilities should you include in your design? Choose 2.

Accepted Answer

Continuous Access Evaluation (CAE) extends token lifetime while enabling near-real-time revocation when conditions change (e.g., user terminated, IP change), providing ongoing security rather than relying only on token expiry. Risk-based Conditional Access policies in Microsoft Entra ID Protection use machine learning to detect risky sign-ins and require step-up authentication. Domain Services password hash sync, AD Connect writeback, and B2C user flows do not address continuous risk evaluation.

Question 12

You are designing a threat detection coverage strategy for your organization. The security team needs to evaluate which attack techniques are detected by existing security controls and identify coverage gaps. Which framework should you use to map detection coverage?

Accepted Answer

The MITRE ATT&CK Enterprise matrix provides a structured taxonomy of adversary tactics and techniques based on real-world observations, making it ideal for evaluating which attack techniques your security controls detect and identifying gaps in coverage. OWASP Top 10 focuses on web application vulnerabilities. CIS Benchmarks cover system hardening configurations. NIST SP 800-53 is a control catalog for risk management, not attack technique mapping.

Question 13

You are designing a privileged access workstation (PAW) strategy for your organization's most privileged administrators, including those with Global Administrator access. The PAW design must align with the Microsoft enterprise access model. Which statement correctly describes the PAW deployment approach?

Accepted Answer

According to the Microsoft enterprise access model and PAW guidance, privileged access workstations must be dedicated, hardened devices used only for privileged tasks. Internet browsing, email, and productivity work are prohibited on PAWs because these activities expose the device to phishing and malware that could compromise privileged credentials. Sharing PAWs undermines accountability. Cloud-only administrators with Global Administrator access are among the highest-risk users and equally require PAWs.

Question 14

Your organization operates in a hybrid environment with Azure workloads and on-premises servers. You need to design a unified security posture management solution that provides a consolidated secure score and attack surface visibility across both environments. The solution must also provide workload protection for Azure VMs and on-premises servers. Which architecture should you recommend?

Accepted Answer

Microsoft Defender for Cloud provides unified security posture management and workload protection. Azure Arc extends Defender for Cloud coverage to on-premises and multicloud servers by making them Azure Arc-enabled resources, allowing a single consolidated secure score and Defender for Servers protection across all environments. Microsoft Sentinel is a SIEM, not posture management. Separate tools with manual consolidation are fragmented and operationally inefficient. Intune manages endpoints and devices, not server security posture.

Question 15

Your organization needs to evaluate internet-facing assets that are not currently tracked in your asset inventory. You need a solution that continuously discovers and assesses your organization's external attack surface, including unknown and forgotten assets. Which Microsoft solution provides this capability?

Accepted Answer

Microsoft Defender External Attack Surface Management (EASM) continuously discovers an organization's internet-facing assets—including unknown and forgotten assets—by scanning the internet from an attacker's perspective. It identifies domains, IP addresses, certificates, and web applications that may not be in the internal asset inventory. Defender for Cloud secure score assesses known Azure resources. Sentinel threat intelligence ingests external feeds. Azure Advisor provides optimization recommendations for known Azure resources.

Question 16

You are designing security requirements for IoT devices deployed across industrial facilities. These devices run embedded operating systems and cannot have traditional endpoint agents installed. You need threat detection and network-based anomaly monitoring for these devices. Which Microsoft solution is designed for this scenario?

Accepted Answer

Microsoft Defender for IoT provides agentless, network-based monitoring for operational technology (OT) and IoT devices by passively analyzing industrial protocols and network traffic, making it suitable for embedded devices where agent installation is not possible. Defender for Endpoint requires agent installation and is designed for standard computing devices. Intune manages device compliance for manageable endpoints. Azure Security Center for IoT is the legacy name, now Defender for IoT.

Question 17

You are designing a Security Service Edge (SSE) solution for your organization. Remote employees need secure access to private internal applications without using a traditional VPN, and internet browsing must be filtered through a secure web gateway. Which Microsoft Entra product combination should you recommend?

Accepted Answer

Microsoft Entra Private Access (identity-centric ZTNA) provides secure, agentless or agent-based access to private applications without a full VPN, using Zero Trust access policies. Microsoft Entra Internet Access provides a secure web gateway with traffic filtering for internet-bound and Microsoft 365 traffic. Together they form Microsoft's Security Service Edge (SSE) solution. Azure VPN Gateway is a traditional VPN. Entra Application Proxy requires on-premises connectors and has limitations. Azure Front Door and Bastion address different use cases.

Question 18

You are designing security baseline requirements for container workloads running on Azure Kubernetes Service (AKS). You need to ensure that containers cannot escalate privileges and that container images are sourced only from trusted registries. Which two controls should be included in your AKS security baseline? Choose 2.

Accepted Answer

Deploying Azure Policy for Kubernetes to enforce pod security standards (e.g., disallowing privilege escalation, blocking privileged containers) directly enforces security baseline requirements as policy. Restricting image sources to approved registries via Azure Policy prevents supply chain attacks through untrusted images. Geo-replication is a high availability feature. Auto-upgrade improves patching but is not a security baseline control for these specific requirements. Multiple node pools address workload isolation, not these specific baseline controls.

Question 19

You are designing a security solution for Windows endpoints across your organization. You need to ensure that local administrator accounts on domain-joined Windows machines have unique, rotated passwords that are stored securely and are retrievable only by authorized administrators. Which solution should you recommend?

Accepted Answer

Windows LAPS automatically manages and rotates unique local administrator passwords on each machine, storing them securely in Microsoft Entra ID or Active Directory. Authorized administrators can retrieve the password when needed. Using the same password on all machines is a lateral movement risk. Disabling the local admin account can impair break-glass recovery. Intune scripts can rotate passwords but do not provide the secure storage, retrieval audit trail, and native integration that Windows LAPS offers.

Question 20

You are designing a cloud infrastructure entitlement management (CIEM) solution for your organization. You need to discover and remediate overprivileged identities across Azure subscriptions, AWS accounts, and GCP projects from a single platform. Which Microsoft solution provides this capability?

Accepted Answer

Microsoft Entra Permissions Management (part of Microsoft Defender for Cloud CIEM capabilities) is a cloud infrastructure entitlement management solution that provides visibility into permissions across Azure, AWS, and GCP, identifies overprivileged identities, and enables right-sizing of permissions. Microsoft Entra PIM manages Azure and Entra roles but not AWS or GCP. Azure Policy with custom roles is Azure-only and does not discover entitlements across clouds. Purview Data Map is for data governance, not identity entitlement management.

Question 21

You are evaluating security posture for productivity workloads in Microsoft 365. You need a metric that measures the security configuration of Microsoft 365 services, including Microsoft Entra ID, Microsoft Defender for Office 365, and Microsoft Intune. Which measurement should you use?

Accepted Answer

Microsoft Secure Score in the Microsoft Defender portal measures the security configuration of Microsoft 365 services including Microsoft Entra ID, Defender for Office 365, Intune, and other Microsoft services. Azure Secure Score (now part of Defender for Cloud) measures Azure infrastructure security posture. Compliance Manager measures compliance with specific regulations. Defender for Cloud Apps risk score assesses connected third-party apps.

Question 22

You are designing a solution to protect sensitive data stored in Azure SQL Database, Azure Synapse Analytics, and Azure Blob Storage. You need to discover, classify, and label sensitive data across these services and enforce access controls based on data sensitivity. Which Microsoft solution should be the primary component of your design?

Accepted Answer

Microsoft Purview provides a unified data governance solution that discovers and classifies sensitive data across Azure SQL, Azure Synapse, Azure Storage, and many other data sources. It applies sensitivity labels that can be used to enforce access controls and protection policies. Azure Security Center provides security recommendations but not data classification. Defender for SQL provides database security but not classification of cross-service data. Azure Information Protection scanner is for on-premises file servers, not cloud data services.

Question 23

Your organization is developing a new customer-facing web application that will be deployed in Azure. A threat modeling exercise has identified SQL injection and cross-site scripting (XSS) as the highest-risk vulnerabilities. The application will be fronted by Azure Application Gateway. Which control provides the most direct mitigation for these specific threats at the network layer?

Accepted Answer

Azure Web Application Firewall (WAF) configured on Application Gateway with OWASP core rule sets specifically detects and blocks SQL injection and XSS attacks at the network layer before they reach the application code. DDoS Protection Standard defends against volumetric attacks, not application-layer exploits. NSGs control network-layer port access but do not inspect HTTP/S payload for injection attacks. Azure Firewall FQDN filtering controls outbound domain access, not inbound HTTP attack patterns.

Question 24

You are designing a solution for securing AI workloads in Microsoft 365. Your organization uses Microsoft 365 Copilot and you need to assess the risk of sensitive data being exposed through AI-generated responses. Which Microsoft service provides Data Security Posture Management (DSPM) for AI workloads?

Accepted Answer

Microsoft Purview Data Security Posture Management (DSPM) for AI is specifically designed to provide visibility into how AI services interact with organizational data, identify sensitive data exposure risks through Microsoft 365 Copilot and other AI services, and recommend protective controls. Defender for Cloud AI security dashboard focuses on Azure-hosted AI workload security. Entra Conditional Access controls access but does not assess data exposure risks. Intune app protection policies protect managed apps, not AI data exposure posture.

Question 25

You are designing a workload identity solution for Azure-hosted microservices that need to authenticate to Azure resources such as Azure Key Vault and Azure SQL Database. You need to avoid storing credentials in application configuration. Which two approaches should you include in your design? Choose 2.

Accepted Answer

Managed identities for Azure resources eliminate the need for credentials by providing an automatically managed identity in Microsoft Entra ID. Microsoft Entra Workload Identities with federated credentials support workloads outside Azure (e.g., GitHub Actions, Kubernetes) authenticating with Microsoft Entra ID without secrets using federation. Both approaches eliminate secret management. Storing client secrets in config files or environment variables and using shared access keys all involve credential management that introduces security risk.

SC-100 — Cybersecurity Architect Expert