A global organization uses Microsoft Security Exposure Management to reduce risk. They want to identify the most critical attack paths that combine vulnerabilities and misconfigurations across their hybrid environment. Which capability should they use?

Attack path analysis in Microsoft Security Exposure Management.

Microsoft Sentinel's UEBA analytics.

Microsoft Secure Score recommendations filtered by severity.

Defender for Cloud's regulatory compliance dashboard.

A company has a Secure Score of 60%. They want to reach 80% within six months. They have a limited security team and must balance quick wins with long-term improvements. They also need to maintain compliance with the Microsoft Cloud Security Benchmark. What should they do?

Implement all recommendations with 'high severity' first, regardless of score impact.

Use Azure Policy to auto-remediate all recommendations at once.

Focus only on recommendations that are easy to implement, ignoring score impact.

Prioritize recommendations with the highest score impact and implement them in phases, starting with quick wins.

Contoso has a hybrid environment with 200 on-premises servers, 50 Azure VMs, and a Google Cloud project. The CISO wants a single dashboard to compare security posture across all workloads and to track improvements against the Microsoft Cloud Security Benchmark. What should you configure?

Use Microsoft Defender for Cloud Apps to connect the GCP project and on-premises servers, then view the Secure Score.

Deploy Microsoft Sentinel and ingest logs from all three environments, then create custom workbooks to compare posture.

Enable Azure Policy on the GCP project and on-premises servers, then assign the Microsoft Cloud Security Benchmark initiative.

Enable Defender for Cloud on the Azure subscription and connect the on-premises servers and GCP project as cloud connectors.

A company has 500 on-premises servers across multiple sites. They want to enable Defender for Cloud's posture management and also enforce custom Azure Policy definitions on these servers. However, they have limited network bandwidth and cannot install agents on all servers at once. What should you do to minimize disruption?

Deploy the Azure Arc agent to all servers simultaneously using a script.

Use Azure Policy's guest configuration to enforce policies without installing the Arc agent.

Deploy Azure Arc agents in phases, starting with the most critical servers, and enable Defender for Cloud as each server is onboarded.

Enable Defender for Cloud on the on-premises servers without Azure Arc.

Microsoft Certified:Cybersecurity Architect Expert

Domain 3Objective 1

Design Solutions for Security Posture Management in Hybrid and Multicloud Environments SC-100 Practice Questions (Page 6)

Part of the Design security solutions for infrastructure domain, which accounts for 25–30% of the SC-100 exam. Microsoft does not publish an official question count, but from its 120-minute exam (~50–80 total, ~13–24 in this domain), expect 3–6 from this objective — we provide 40 practice questions to prepare you well beyond it. (estimate)

40questions here

8free pages

7concepts

25–30%of the exam

7 Concepts in This Objective

Microsoft Defender for Cloud Evaluation
Microsoft Secure Score Evaluation
Integrated Security Posture Management Design
Cloud Workload Protection Selection
Azure Arc Integration Design
Defender EASM Solution Design
Posture Management Process Requirements

Questions 26–30

26application · medium
A global organization uses Microsoft Security Exposure Management to reduce risk. They want to identify the most critical attack paths that combine vulnerabilities and misconfigurations across their hybrid environment. Which capability should they use?
Select an answer first
27expert · hard
A company has a Secure Score of 60%. They want to reach 80% within six months. They have a limited security team and must balance quick wins with long-term improvements. They also need to maintain compliance with the Microsoft Cloud Security Benchmark. What should they do?
Select an answer first
28application · medium
Contoso has a hybrid environment with 200 on-premises servers, 50 Azure VMs, and a Google Cloud project. The CISO wants a single dashboard to compare security posture across all workloads and to track improvements against the Microsoft Cloud Security Benchmark. What should you configure?
Select an answer first
29expert · hard
A company has 500 on-premises servers across multiple sites. They want to enable Defender for Cloud's posture management and also enforce custom Azure Policy definitions on these servers. However, they have limited network bandwidth and cannot install agents on all servers at once. What should you do to minimize disruption?
Select an answer first
30foundation · easy
When specifying requirements for a security posture management process using Microsoft Security Exposure Management, which capability is most directly associated with reducing the number of potential entry points for attackers?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to SC-100

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Microsoft. “SC-100” is a trademark of its owner, used for identification only.

Design Solutions for Security Posture Management in Hybrid and Multicloud Environments SC-100 Practice Questions (Page 6)

Questions 26–30

A global organization uses Microsoft Security Exposure Management to reduce risk. They want to identify the most critical attack paths that combine vulnerabilities and misconfigurations across their hybrid environment. Which capability should they use?

A company has a Secure Score of 60%. They want to reach 80% within six months. They have a limited security team and must balance quick wins with long-term improvements. They also need to maintain compliance with the Microsoft Cloud Security Benchmark. What should they do?

Contoso has a hybrid environment with 200 on-premises servers, 50 Azure VMs, and a Google Cloud project. The CISO wants a single dashboard to compare security posture across all workloads and to track improvements against the Microsoft Cloud Security Benchmark. What should you configure?

When specifying requirements for a security posture management process using Microsoft Security Exposure Management, which capability is most directly associated with reducing the number of potential entry points for attackers?

Keep studying — Design security solutions for infrastructure