Microsoft Cybersecurity Architect Expert (SC-100)

A is correct.

Explanation: Microsoft Defender for Storage provides near real-time malware scanning that inspects blobs upon upload using hash reputation and antivirus analysis. It integrates with Azure Event Grid to broadcast scan results, enabling automated workflows in Azure Functions or Logic Apps to immediately quarantine infected files, satisfying all detection and automated response requirements.

B is incorrect: Activity monitoring detects suspicious access patterns rather than malicious content, and manual review fails the requirement for automated file isolation.

C is incorrect: Vulnerability assessment is a database feature designed to identify SQL configuration weaknesses, not a mechanism for scanning or isolating storage blobs.

D is incorrect: Defender for Azure Cosmos DB protects NoSQL database transactions, which cannot scan uploaded blobs or remediate threats within Azure Storage.

B is correct.

Explanation: Attack path analysis evaluates environmental context, such as internet exposure and sensitive data access, rather than isolated finding severities. In this scenario, an exposed application with access to sensitive data presents greater exploitable risk than an isolated internal tool. Defender CSPM provides attack path analysis to model these risk paths.

A is incorrect: Relying solely on individual finding severity overlooks network exposure and asset sensitivity, mistakenly prioritizing an isolated tool over an exposed workload.

C is incorrect: Summing finding counts measures recommendation volume rather than exploitability or business impact, failing to reveal which specific risk path threatens assets.

D is incorrect: Sorting by alphabetical name or creation order provides no risk assessment and ignores critical exposure factors, while Foundational CSPM lacks attack path analysis.

C is correct.

Explanation: Conditional Access App Control uses a reverse proxy architecture integrated with Microsoft Entra Conditional Access to monitor and control user sessions in real time. Configuring access and session policies allows contractors to collaborate in sanctioned SaaS applications while strictly preventing downloads of sensitive corporate documents on unmanaged, personal endpoints.

A is incorrect: Shadow IT discovery identifies apps across network traffic and evaluates risk scores, but it cannot inspect or restrict live active sessions.

B is incorrect: Safe Attachments sandboxes email attachments to detect malware, rather than mediating user download activities within third-party SaaS cloud applications.

D is incorrect: SaaS Security Posture Management discovers configuration weaknesses in connected cloud applications, but it does not enforce real-time session download restrictions.

B is correct.

Explanation: The scenario requires eliminating public database endpoints and establishing network-layer isolation for database connections across the environment. Azure Private Link establishes private endpoints that remove public exposure, directly strengthening data protection and providing secure network connectivity between the microservice workloads and backend database instances without routing over public networks.

A is incorrect: Azure Arc extends governance and policy consistency across external Kubernetes clusters, but it does not establish private network connectivity for database access.

C is incorrect: Microsoft Sentinel aggregates multicloud telemetry across pipelines and runtimes for threat analytics, failing to provide network-layer isolation or private data endpoints.

D is incorrect: GitHub Advanced Security identifies supply chain vulnerabilities by scanning source repositories, but it cannot restrict database network access to private routes.

B is correct.

Explanation: When your organization uses non-Microsoft security tools to address a recommended action, you should mark that action as Resolved through third party. This status immediately updates your Secure Score to accurately reflect your overall posture across productivity workloads, even though Microsoft has no visibility into the completeness of those external implementations.

A is incorrect: Setting Risk accepted documents a deliberate decision to defer controls due to business requirements, rather than recording active third-party enforcement.

C is incorrect: The Planned status only projects future score gains after completing scheduled actions, instead of registering existing third-party tool protections.

D is incorrect: Resolved through alternate mitigation applies to internal technical mitigations, whereas external security products require selecting Resolved through third party.

A is correct.

Explanation: Control DS-4 requires integrating static application security testing into DevOps pipelines. The Microsoft Security DevOps Extension orchestrates multiple static analysis tools, such as Bandit, BinSkim, Checkov, ESLint, Template Analyzer, Terrascan, and Trivy, within a single pipeline task. This simplifies pipeline maintenance while providing broad coverage across code and templates.

B is incorrect: Dependabot focuses on automated dependency scanning and pull request updates rather than orchestrating diverse static analysis tools across infrastructure-as-code files.

C is incorrect: Defender for App Service provides runtime threat detection for hosted web applications instead of orchestrating pre-deployment pipeline scanning tasks in Azure DevOps.

D is incorrect: Azure Artifacts dependency pinning prevents package substitution attacks within feeds but cannot run static code or container template vulnerability scanners.

A is correct.

Explanation: For sensitivity labels with encryption, Microsoft 365 Copilot requires both VIEW and EXTRACT usage rights to return or summarize content. If users have VIEW permissions but lack the EXTRACT right, they can still open and view the file, but Copilot cannot process, summarize, or return its protected contents.

B is incorrect: Granting both VIEW and EXTRACT rights explicitly allows Copilot to summarize the file, directly contradicting the stated security requirement.

C is incorrect: Double Key Encryption excludes content completely from Copilot, but it also blocks native Microsoft 365 indexing, eDiscovery, and search services unnecessarily.

D is incorrect: Blocking sensitive types in prompts inspects user prompt text, rather than controlling how Copilot interacts with existing labeled files and documents.

A is correct.

Explanation: The organization faces governance gaps and configuration drift because policies are applied independently across Azure and AWS clusters. Azure Arc addresses this multicloud operational challenge by extending centralized governance and consistent policy enforcement to Amazon EKS clusters, ensuring uniform admission controls and configuration baseline compliance across all container environments.

B is incorrect: Microsoft Sentinel unifies threat detection by correlating multicloud telemetry, but it does not deploy or enforce admission policies on Kubernetes clusters.

C is incorrect: Always Encrypted protects sensitive database column data by retaining encryption keys client-side, offering no policy management or configuration governance for container cluster infrastructure.

D is incorrect: GitHub Advanced Security performs pre-deployment vulnerability and dependency scanning, but it cannot enforce runtime admission policies or configuration governance across external cloud clusters.

B is correct.

Explanation: Disabling public network access and requiring private endpoints isolates Azure Cosmos DB completely from the public internet. Managed identities eliminate the need to embed credentials in application code, while establishing distinct Microsoft Entra identities for control plane and data plane operations directly mitigates the risk of privilege escalation across administrative and data workloads.

A is incorrect: IP firewall rules leave endpoints reachable across the internet, while shared keys embed credentials and fail to separate operational planes.

C is incorrect: Retaining public network access violates network isolation requirements, while storing connection strings maintains static embedded credentials within application configuration files.

D is incorrect: Shared access signatures fail to eliminate credential handling, while using a single administrative identity violates the required operational plane separation.

C is correct.

Explanation: Workload identity federation establishes trust between Microsoft Entra ID and GitHub, allowing deployments without storing or transmitting credentials. Restricting the federated credential subject claim specifically to the repository and main branch enforces least privilege. This design prevents unauthorized workflows from exchanging external tokens for Azure access tokens.

A is incorrect: Storing client secrets violates the constraint against credentials, and expiration policies are recommended only when managed identities or federation are impossible.

B is incorrect: System-assigned managed identities attach only to Azure resources and cannot be assigned to external runners hosted outside of an Azure environment.

D is incorrect: Permitting any workflow across the entire organization configures broad wildcard federation, which violates the requirement to restrict tokens to one branch.