Design Solutions That Align with the Microsoft Cybersecurity Reference Architectures (MCRA) and Microsoft Cloud Security Benchmark (MCSB) SC-100 Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   Which MCRA-aligned control is specifically designed to help mitigate insider threats by limiting what users can do with sensitive data?

   • ADistributed denial-of-service (DDoS) protection that mitigates volumetric attacks.
   • BWeb application firewall (WAF) that filters HTTP requests to web apps.
   • CNetwork intrusion detection systems (NIDS) that monitor external traffic.
   • DData loss prevention (DLP) policies that block or warn on unauthorized sharing of sensitive information.
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   Which MCRA-aligned practice is most effective for detecting and responding to external attacks in a timely manner?

   • ARelying on users to report suspicious emails without any automated detection.
   • BReviewing logs manually once a month to identify potential breaches.
   • CDisabling all logging to reduce noise and storage costs.
   • DDeploying a security information and event management (SIEM) solution that collects and analyzes logs from across the environment.
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A software company is developing a new AI-powered application that uses a third-party machine learning model. The security architect must design a solution aligned with the MCRA to protect against supply chain attacks. The company wants to ensure the model is not tampered with and that the application is secure. Which approach should the architect recommend?

   • AStore the model in a private Azure Storage account and use SAS tokens for access.
   • BUse a third-party model registry and rely on its built-in security features.
   • CUse Azure Machine Learning with model registry and data signing, and integrate Microsoft Defender for Cloud for vulnerability scanning.
   • DDeploy the model using a container image and use Azure Container Registry with content trust.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A legal firm handles highly confidential client documents. The security architect must design a solution aligned with the MCRA to prevent data exfiltration by employees, whether accidental or malicious. The firm wants to monitor user activity and automatically respond to risky behavior. Which combination of controls should the architect recommend?

   • AUse Azure Monitor to collect all user activity logs and create alerts for any file access.
   • BUse Microsoft Purview Data Loss Prevention (DLP) to block sensitive data sharing and Microsoft Purview Insider Risk Management to detect and respond to risky user activities.
   • CDeploy Azure Information Protection to encrypt all documents and require a password to open them.
   • DImplement Azure AD Privileged Identity Management (PIM) to require approval for all access to sensitive documents.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A multinational corporation is implementing the Zero Trust adoption framework. The security architect must design a solution that enforces least privilege for administrative access across the organization. The company uses Azure AD and has a mix of cloud and on-premises resources. Which approach aligns with Zero Trust principles?

   • AUse Azure AD Conditional Access to require MFA for all users.
   • BAssign permanent global administrator roles to all IT staff.
   • CImplement Azure AD Privileged Identity Management (PIM) for just-in-time (JIT) access to privileged roles.
   • DDeploy Azure AD Application Proxy for all on-premises applications.
   Reveal Solution Discussion Select an answer first