Design Solutions That Align with the Microsoft Cybersecurity Reference Architectures (MCRA) and Microsoft Cloud Security Benchmark (MCSB) SC-100 Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   According to the MCRA, which capability is a foundational best practice for defending against external attacks?

   • ARelying solely on a strong perimeter firewall to block all external threats.
   • BImplementing a robust identity and access management (IAM) system with multi-factor authentication (MFA).
   • CUsing only on-premises security tools because cloud tools are less secure.
   • DDisabling all external access to the network to eliminate attack surface.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which practice aligns with the MCRA's guidance for mitigating supply chain attacks?

   • AValidating the integrity of software and dependencies through signed artifacts and secure software supply chain practices.
   • BUsing only open-source software because it is inherently more secure.
   • CTrusting all third-party software without verification because vendors are always reliable.
   • DAvoiding all third-party software to completely eliminate supply chain risk.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A multinational company is modernizing its identity and access strategy. The security team wants to align with the MCRA's external attack defense guidance while adopting a Zero Trust model. They plan to deploy Azure AD Conditional Access with device compliance policies and require MFA for all external-facing applications. Which additional control should the architect prioritize to complete the Zero Trust 'verify explicitly' principle for external attacks?

   • AEnable Azure AD password hash sync to simplify user authentication.
   • BDeploy a web application firewall (WAF) in front of all internet-facing endpoints.
   • CConfigure Azure AD Privileged Identity Management (PIM) for all global administrators.
   • DImplement continuous access evaluation (CAE) to revoke access in near real time when user risk or device status changes.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A law firm is implementing MCRA insider threat protections. The firm has a small IT team and a budget constraint. The security architect must choose a solution that provides early detection of insider threats without overwhelming the IT team with alerts. Which approach best balances detection and operational overhead?

   • ADeploy Microsoft Purview Insider Risk Management with a small set of high-fidelity policies focused on data exfiltration.
   • BEnable all Microsoft Defender for Cloud Apps anomaly detection policies and send all alerts to the IT team.
   • CUse Azure AD Identity Protection and require MFA for all users.
   • DImplement a custom SIEM solution to correlate all user activity logs.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which MCSB control domain is most directly relevant to ensuring that AI models are not exposed to unauthorized access?

   • ALogging and Monitoring
   • BData Protection
   • CIdentity and Access Management (IAM)
   • DNetwork Security
   Reveal Solution Discussion Select an answer first