Microsoft Cybersecurity Architect (SC-100) practice questions

A financial services organisation wants its backup design to survive a ransomware operator who has already gained Global Administrator rights in Microsoft Entra ID and intends to delete or encrypt all backups before detonating. Which backup design property most directly satisfies this resiliency requirement?

• ABackups are written to immutable, time-locked storage that no administrator role can delete or alter until the retention period expires.check_circle Correct
• BBackups are replicated to a second Azure region so that a regional outage cannot make the restore points unavailable.
• CBackups are encrypted at rest with customer-managed keys held in an Azure Key Vault that the backup service can read automatically.
• DBackups run more frequently so that the recovery point objective is reduced to under fifteen minutes for every protected workload.

Why A is correct: Immutability with a retention lock enforces the assume-breach principle so that even a fully compromised privileged identity cannot delete or encrypt the protected restore point, which is exactly what the requirement demands.

Why B is wrong: Geo-replication defends against a datacentre or regional failure and seems resilient, but a privileged attacker can issue deletion against replicated copies just as easily, so it does not counter a malicious insider-level identity.

Why C is wrong: Encryption at rest protects backup confidentiality and is tempting because it sounds like hardening, but it does nothing to stop a Global Administrator from deleting the backups outright, so it misses the stated threat.

Why D is wrong: A tighter recovery point objective improves data freshness and is appealing for resilience metrics, but more frequent copies in deletable storage are equally destroyable by the compromised admin, so the threat is unaddressed.

A product team is about to begin building a new customer-facing payments service and asks a security architect when, in the application lifecycle, design-level security flaws such as missing authorisation boundaries and unsafe trust assumptions should be identified. The architect wants the practice that surfaces these flaws before code is written, by reasoning about the system's data flows and trust boundaries. Which practice best meets this requirement?

• APerform threat modeling during the design phase, enumerating data flows and trust boundaries to identify and rank design weaknesses before any code exists.check_circle Correct
• BRun dynamic application security testing against a deployed staging build so that exploitable runtime weaknesses are discovered before the service reaches production traffic.
• CAdd static application security testing to the build pipeline so that insecure coding patterns are flagged automatically every time a developer commits source.
• DSchedule an external penetration test ahead of launch so that an independent team validates the service's defences against realistic attacker techniques first.

Why A is correct: Threat modeling is the design-phase activity that maps data flows and trust boundaries to expose architectural weaknesses such as missing authorisation, so it identifies and ranks design flaws exactly when the requirement demands, before implementation begins.

Why B is wrong: Dynamic testing is valuable and tempting because it finds real exploitable issues, but it runs against built, deployed code and so cannot surface the design-level trust-boundary flaws the requirement targets before code is written.

Why C is wrong: Static analysis catches insecure code patterns and feels like the earliest control, but it operates on committed source rather than the architecture, so it misses design flaws that exist before code and that no scanner reads from a diagram.

Why D is wrong: A penetration test gives independent assurance and is appealing as a gate, but it happens against a near-complete system late in the lifecycle, so it finds design flaws only after they are expensively built rather than before code is written.

While designing a ransomware resiliency strategy, an architect is asked to identify the single highest-leverage protection to prioritise first according to Microsoft Security Best Practices, because most large-scale ransomware incidents pivot through one common control failure. Which priority should the design address first?

• ADeploying Microsoft Defender for Endpoint to every workstation and server so that malicious binaries are blocked at execution time.
• BSecuring privileged access by isolating administrative identities and enforcing just-in-time elevation through Microsoft Entra Privileged Identity Management.check_circle Correct
• CImplementing immutable backups so that encrypted production data can always be restored after a successful detonation.
• DEnabling Microsoft Sentinel analytics rules tuned to detect lateral movement and mass file-encryption behaviour across the estate.

Why A is wrong: Endpoint protection is essential and tempting as a first move, but it is a detection and prevention layer that attackers routinely evade, whereas removing standing privileged access denies the escalation the campaign relies on, so it is not the first priority.

Why B is correct: Microsoft guidance ranks protecting privileged access as the top ransomware priority because operators escalate to admin rights to spread payloads and destroy backups, so removing standing privilege closes the path the attack depends on.

Why C is wrong: Recoverable backups are a critical pillar and appealing because recovery is the visible outcome, but they assume the attack has already succeeded, so prioritising them before privileged access leaves the breach path open.

Why D is wrong: SIEM analytics improve detection speed and are attractive for visibility, but detection alerts after compromise has begun, so it does not prevent the privileged-access escalation that Microsoft ranks as the leading priority.