Microsoft Cybersecurity Architect Expert (SC-100)

C is correct.

Explanation: Microsoft Intune and Microsoft Defender for Endpoint provide unified endpoint management and compliance enforcement across hybrid environments. Implementing these integrated solutions addresses malware entry risks by eliminating regional patching delays, ensuring timely vulnerability remediation, and validating that client devices meet corporate security baselines before accessing resources.

A is incorrect: Defender for IoT monitors operational technology and Azure Arc extends governance to hybrid infrastructure, neither of which provides client endpoint management.

B is incorrect: Microsoft Sentinel and Defender XDR correlate cross-domain security telemetry, but they do not manage local endpoint device patching or compliance policies.

D is incorrect: IoT Hub and Private Endpoints secure operational telemetry routing, failing to provide centralized device configuration, patching, or host malware protection.

A is correct.

Explanation: Intune app protection policies create a security boundary around corporate data without requiring device enrollment, making them ideal for BYOD scenarios. They enforce data transfer restrictions by blocking copy-paste into unmanaged applications and support selective wipes that remove only organizational data while preserving user personal content.

B is incorrect: Automated device enrollment requires full device management and performs full wipes of all device contents, violating privacy boundaries for personal devices.

C is incorrect: Device restrictions profiles require MDM device enrollment to enforce device-level settings, failing to provide app-level containerization for unenrolled personal mobile devices.

D is incorrect: The Defender for Endpoint baseline targets enrolled Windows client workstations rather than mobile app data protection boundaries on personal BYOD devices.

A is correct.

Explanation: For on-premises servers joined to an Active Directory domain, Group Policy deployment using a service principal is the recommended at-scale onboarding method. Generating a dedicated service principal with the Azure Connected Machine Onboarding role avoids interactive sign-in on individual servers while automating deployment across the entire domain infrastructure.

B is incorrect: Manual installation with interactive authentication requires individual administrator credentials on every server, failing the explicit constraint that prohibits interactive sign-in.

C is incorrect: The Log Analytics gateway is unsupported as a proxy for Connected Machine agents, making this architectural approach invalid for onboarding.

D is incorrect: The OS Configuration agent with autoprovisioning is designed for Google Cloud Platform VMs rather than on-premises Active Directory domain environments.

D is correct.

Explanation: Azure Arc and Microsoft Defender for Cloud extend centralized governance, compliance standards, and advanced threat protection across distributed hybrid infrastructure. Deploying these services resolves regional visibility gaps and misconfigurations by enabling consistent policy enforcement, automated posture management, and unified workload defense across decentralized cloud and on-premises environments.

A is incorrect: Defender for IoT monitors industrial OT networks and Microsoft Sentinel provides SIEM analytics, neither of which establishes baseline cloud governance.

B is incorrect: IoT Hub and IoT Edge manage edge telemetry routing and compute integration, offering no governance framework for misconfigured enterprise cloud resources.

C is incorrect: Microsoft Intune and Defender for Endpoint enforce client device security baselines, failing to provide cloud infrastructure configuration governance or protection.

D is correct.

Explanation: IoT Hub, IoT Edge, and Private Endpoints deliver secure telemetry routing and private cloud integration for remote industrial edge environments. Combining localized edge processing with private endpoints prevents telemetry exposure across unencrypted public internet paths, ensuring sensitive operational data remains protected while maintaining continuous cloud ingestion.

A is incorrect: Microsoft Sentinel and Defender XDR centralize cross-domain threat correlation and incident response, but they do not secure physical telemetry transport pathways.

B is incorrect: Azure Arc and Defender for Cloud extend hybrid infrastructure posture management and governance, but neither provides dedicated edge telemetry routing.

C is incorrect: Microsoft Intune and Defender for Endpoint enforce client device compliance, leaving underlying industrial network telemetry exposed across public internet paths.

A is correct.

Explanation: Defender for IoT air-gapped deployments operate completely on-premises to satisfy strict regulatory isolation mandates where no data can leave the facility. Network sensors passively monitor industrial network traffic through SPAN ports without endpoint agents, providing full local management and forwarding security alerts to on-premises SIEM systems.

B is incorrect: Cloud-connected sensors require outbound network connectivity to Azure endpoints, violating the strict isolation and regulatory requirements prohibiting external data transmission.

C is incorrect: Legacy industrial controllers cannot support software agents, and Defender for IoT uses passive, agentless network monitoring to protect operational technology.

D is incorrect: Hybrid sensors communicating with cloud-hosted Microsoft Sentinel violate the zero outbound connectivity constraint and cannot function in completely air-gapped environments.

B is correct.

Explanation: Per-app access creates separate Global Secure Access enterprise applications for distinct resources, each mapped to specific application segments and connector groups. This architecture enables assigning different user groups and applying discrete Conditional Access policies per workload, enforcing multifactor authentication for RDP while allowing single sign-on for the internal web application.

A is incorrect: Quick Access utilizes a single enterprise application and assignment container, preventing the application of different Conditional Access policies across workloads.

C is incorrect: Configuring DNS suffixes enables internal name resolution through private DNS, but it does not provide separate applications for differentiated access policies.

D is incorrect: A single enterprise application enforces uniform policy assignments across all defined segments, while two connectors provide high availability rather than policy separation.

A is correct.

Explanation: In Microsoft Security Exposure Management, choke points where multiple attack paths converge represent the highest-impact remediation opportunities. Priority 1 remediation targets choke points on paths leading to critical assets because resolving a single choke point eliminates multiple attack vectors simultaneously, maximizing remediation efficiency under limited capacity.

B is incorrect: Initiative score improvements are categorized as Priority 3, and targeting lower-weighted initiatives fails to mitigate the immediate paths threatening critical assets.

C is incorrect: Remediating paths independently by discovery sequence causes redundant effort and ignores the architectural efficiency of breaking convergent choke points first.

D is incorrect: Remediation efforts focus on low-progress metrics showing severe exposure, whereas high progress scores represent already mitigated controls that require minimal intervention.

B is correct.

Explanation: Cloud Secure Score uses a risk-based calculation that aggregates open recommendations while weighting them by risk level, asset risk factors like internet exposure and data sensitivity, and asset criticality. It evaluates Azure, AWS, and GCP resources through Defender for Cloud, fulfilling executive requirements for comprehensive multicloud risk reporting.

A is incorrect: Classic Secure Score relies on a control-based calculation measuring the ratio of healthy resources per control, omitting asset criticality and exposure factors.

C is incorrect: Microsoft Secure Score focuses on identities, devices, applications, and corporate data, which falls outside the scope of multicloud infrastructure posture management.

D is incorrect: Exposure Secure Score measures device and endpoint posture from Microsoft Defender for Endpoint, rather than evaluating broader multicloud infrastructure posture.

A is correct.

Explanation: Microsoft Defender for IoT provides agentless, protocol-aware monitoring specifically designed for industrial operational technology environments. This solution allows security teams to identify vulnerabilities and detect lateral movement across flat networks without deploying local software agents or risking operational disruptions on legacy systems where uptime is paramount.

B is incorrect: Microsoft Intune focuses on enterprise endpoint management and compliance policies rather than passive network-level monitoring of specialized industrial protocols.

C is incorrect: Azure Arc projects server governance across hybrid infrastructure, but it requires host agents and cannot inspect raw OT industrial network traffic.

D is incorrect: Defender for Endpoint requires device agents and protects standard IT operating systems instead of passively analyzing legacy OT industrial network communications.