Q01 - Question
An enterprise is building an incident response runbook to recover systems from immutable storage following a severe ransomware attack. According to technical restoration dependencies defined in Microsoft best practices, which category of business-critical systems must the team restore first?
Domain: Design solutions that align with security best practices and priorities (20–25%) Type: Single choice
- A. Financial systems, including payment processing and financial reporting databases
- B. Identity systems, including Active Directory, Microsoft Entra Connect, and domain controllers
- C. Minimum security systems required to monitor for attacks and prevent immediate reinfection
- D. Product and service enablement systems, including manufacturing controls and delivery infrastructure
B is correct.
Explanation: Microsoft guidance dictates that the prioritized backup list serves as the prioritized restore list based on technical restoration dependencies. Identity systems, including Active Directory, Microsoft Entra Connect, and domain controllers, must be restored first because all subsequent enterprise systems rely upon them for user authentication, authorization, and administrative access.
A is incorrect: Financial systems rank third in the restoration sequence and cannot function until identity services authenticate database connections and user accounts.
C is incorrect: Minimum security systems rank fifth in the technical restoration order, deployed after foundational infrastructure and operational platforms are recovered.
D is incorrect: Product or service enablement systems rank fourth in priority order and depend directly on previously restored directory and credential services.
Q02 - Question
A company adopts passwordless and multifactor authentication for all users. Leadership then proposes exempting the executive accounts, which attackers value most, because the executives find the sign-in steps inconvenient. As a cybersecurity architect, what should you advise?
Domain: Design solutions that align with security best practices and priorities (20–25%) Type: Single choice
- A. Approve the exemption, because best practices should always be adapted to each organization's preferences.
- B. Keep the controls for all accounts, because exempting the highest-impact accounts undermines the purpose of the practice.
- C. Replace the practice with a custom approach for executives, because proven practices cannot apply to senior roles.
- D. Defer the decision until a reference architecture is built, because exceptions need a diagram before review.
B is correct.
Explanation: The evidence recommends following proven best practices unless you have a specific reason to avoid them. While organizations can adapt best practices to unique circumstances, exempting the highest-impact accounts that attackers value most represents over-customization that undermines the entire security purpose. You should retain the controls for all user accounts.
A is incorrect: Adapting best practices is acceptable, but exempting high-impact accounts that attackers prioritize eliminates the security value of the authentication controls.
C is incorrect: Best practices are proven to work across roles, and creating custom executive rules introduces the exact over-customization architects should avoid.
D is incorrect: Architecture diagrams are not prerequisites for enforcing best practices, and delaying this decision unnecessarily leaves high-value accounts exposed to attacks.
Q03 - Question
An organization has an existing Azure environment and is applying landing zone security guidance. Teams worry that enforcing new security policies will disrupt running workloads. Which approach should the security architect use to understand the effect of the policies before enforcement?
Domain: Design solutions that align with security best practices and priorities (20–25%) Type: Single choice
- A. Deploy all new policies in deny mode at the top management group
- B. Roll out the policies in audit mode first, then enforce them
- C. Apply the policies only to new application landing zones
- D. Delay policy assignment until every workload is redeployed with infrastructure as code
B is correct.
Explanation: In existing brownfield environments, Microsoft guidance specifies rolling out security policies in audit mode first to evaluate operational impact before enforcing them. Audit policies detect noncompliant settings without blocking deployment activities or halting live workloads. This strategy provides baseline visibility and allows organizations to design phased remediations before moving to strict enforcement.
A is incorrect: Deploying deny policies blocks noncompliant deployments immediately, which risks breaking unconfigured production services instead of safely measuring baseline posture.
C is incorrect: Assigning policies solely to new landing zones ignores running workloads, failing to deliver the visibility required to evaluate brownfield risks.
D is incorrect: Deferring policy assignment until workloads are redeployed delays governance unnecessarily, whereas audit mode evaluates live configurations without modifying infrastructure code.
Q04 - Question
During business resiliency planning, a security architect collaborates with IT engineering to establish Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO) for critical business workloads. The engineering team recommends setting RTO and RPO targets according to current backup tool limits. Which design principle should the architect enforce?
Domain: Design solutions that align with security best practices and priorities (20–25%) Type: Single choice
- A. Define RTO and RPO for each critical asset based on business requirements rather than technical convenience.
- B. Standardize a uniform RTO and RPO across all enterprise assets based on the capabilities of the slowest restore mechanism.
- C. Establish RTO and RPO solely for identity systems, deriving all downstream application targets from identity restoration times.
- D. Adopt existing storage snapshot schedules as the baseline RPO and calculate workload RTO strictly from network transfer speed.
A is correct.
Explanation: Microsoft guidance specifies that security architects must define specific Recovery Time Objectives and Recovery Point Objectives for each critical asset based on business requirements, not technical convenience. RTO determines how rapidly systems must return to operational status, while RPO defines acceptable data loss in time units to ensure business continuity.
B is incorrect: Standardizing all targets on the slowest tool constitutes technical convenience and fails to evaluate distinct operational impacts across critical business assets.
C is incorrect: While identity systems represent the primary restoration dependency, resiliency planning requires unique recovery objectives established for every critical workload.
D is incorrect: Deriving recovery values from existing snapshot schedules and transfer speeds reflects technical convenience rather than stakeholder business requirements.
Q05 - Question
A security architect is establishing data protection and recovery controls for an enterprise cloud architecture. The organization requires a solution that defends enterprise backups against destructive ransomware attacks. Which design aligns with the documented best practices for backup and recovery in the Microsoft Cloud Security Benchmark?
Domain: Design solutions that align with security best practices and priorities (20–25%) Type: Single choice
- A. Enable soft delete, apply immutable storage, and perform regular recovery testing.
- B. Implement database row-level security and restrict access to automated backup scripts.
- C. Enforce Transport Layer Security encryption in transit and rely on default scheduled jobs.
- D. Deploy a web application firewall to inspect ingress management traffic to backup vaults.
A is correct.
Explanation: Under the Data Protection and Governance area, MCSB backup controls require enabling soft delete and storing backups in immutable storage to prevent ransomware tampering. Organizations must also perform routine recovery tests to validate restoration capabilities. These measures ensure data survives unauthorized modification and remains recoverable during an attack.
B is incorrect: Row-level security restricts database record access rather than securing backup integrity, and omitting routine recovery testing violates backup validation guidance.
C is incorrect: Transport encryption secures network data streams in transit but fails to provide immutability or validate recoverability against deliberate ransomware deletion.
D is incorrect: A web application firewall inspects HTTP traffic for web applications rather than protecting stored backup data from modification or ransomware.
Q06 - Question
An organization's security strategy requires data classification, labeling, and data loss prevention across structured and unstructured data stores. The strategy also mandates dedicated key management with hardware security module support for high-sensitivity keys. Which pair of Microsoft solutions satisfies these requirements?
Domain: Design solutions that align with security best practices and priorities (20–25%) Type: Single choice
- A. Microsoft Purview and Azure Key Vault
- B. Microsoft Sentinel and Azure Firewall
- C. Microsoft Defender for Cloud and Azure Policy
- D. Azure Private Link and Azure Key Vault
A is correct.
Explanation: Under the data protection capability area, Microsoft Purview provides data classification, labeling, and data loss prevention across structured and unstructured stores. Azure Key Vault satisfies the key management requirement by protecting encryption keys with hardware security module support. Together, these complementary services address the organization's entire data protection requirement.
B is incorrect: Microsoft Sentinel delivers SIEM and SOAR capabilities, while Azure Firewall filters network traffic; neither service performs data classification or manages encryption keys.
C is incorrect: Microsoft Defender for Cloud and Azure Policy provide posture management and policy enforcement rather than data classification, DLP, or cryptographic key storage.
D is incorrect: Azure Key Vault manages keys, but Azure Private Link merely provides private endpoint connectivity without offering data classification, labeling, or DLP features.
Q07 - Question
An organization possesses only an on-premises security strategy and is preparing its first major migration to Azure. The current strategy ignores cloud shared responsibility and identity perimeters. The security architect must determine the appropriate strategy approach. What should the architect do?
Domain: Design solutions that align with security best practices and priorities (20–25%) Type: Single choice
- A. Define a new security strategy based on CAF and WAF
- B. Execute a posture evaluation against the existing on-premises strategy
- C. Apply incremental adjustments to the on-premises strategy during migration
- D. Postpone strategy definition until completing a Well-Architected Review
A is correct.
Explanation: Defining a new security strategy is necessary when an organization possesses an on-premises-only strategy and undergoes a first cloud adoption. Existing on-premises strategies fail to address cloud-specific threats, the shared responsibility model, and identity-centric perimeters. The architect must create a new strategy using CAF for lifecycle governance and WAF for workload quality standards.
B is incorrect: Posture evaluation approaches measure existing cloud strategies against framework baselines, which is ineffective when no documented cloud strategy exists initially.
C is incorrect: Incremental adjustments cannot bridge a fundamental cloud transformation that completely invalidates legacy perimeter assumptions and requires shared responsibility alignment.
D is incorrect: The Well-Architected Review assesses deployed workload designs, requiring a broader cloud security strategy to be established before conducting reviews.
Q08 - Question
A cybersecurity architect is tasked with defining what the overall security architecture should look like across a hybrid technology estate comprising multicloud, operational technology, and legacy IT. The architect requires reference diagrams and best practice templates. Which framework directly addresses this architectural scope?
Domain: Design solutions that align with security best practices and priorities (20–25%) Type: Single choice
- A. Microsoft Cybersecurity Reference Architectures
- B. Azure Well-Architected Framework
- C. Microsoft cloud security benchmark
- D. Cloud Adoption Framework
A is correct.
Explanation: The Microsoft Cybersecurity Reference Architectures operate directly at the architecture level across the hybrid technology estate, including multicloud systems and operational technology. They supply comprehensive reference diagrams and best practices that serve as starting templates, helping cybersecurity architects determine what their overall end-to-end security architecture should look like.
B is incorrect: The Azure Well-Architected Framework operates at the workload level to improve individual workloads rather than defining an enterprise-wide hybrid architecture template.
C is incorrect: The Microsoft cloud security benchmark operates at the control level, specifying technical controls and compliance mappings rather than macro-level architecture diagrams.
D is incorrect: The Cloud Adoption Framework operates at the organizational level to guide cloud adoption methodologies instead of providing hybrid security reference architectures.
Q09 - Question
A security architect is designing authentication for automated CI/CD deployment pipelines targeting Azure subscriptions. The architecture must enforce least privilege, isolate environments, and eliminate stored deployment credentials. Which identity design should the architect recommend?
Domain: Design solutions that align with security best practices and priorities (20–25%) Type: Single choice
- A. Workload identity federation with dedicated identities per application and environment
- B. A shared deployment administrator user account protected by multifactor authentication
- C. A single managed service identity granted Owner permissions across all subscriptions
- D. Developer user accounts with just-in-time privileged access elevation for pipeline runs
A is correct.
Explanation: For automated CI/CD deployments, CAF DevSecOps adoption guidance specifies using workload identity federation instead of user accounts. Architects should configure separate workload identities for each application and environment, scoping cloud permissions strictly to required resource groups or subscriptions. This pattern eliminates stored pipeline secrets while maintaining least privilege and blast radius containment.
B is incorrect: Using shared user accounts violates the rule against using user accounts for automation and introduces shared credentials across different pipeline workflows.
C is incorrect: Granting a single identity subscription-wide Owner permissions violates least privilege and fails to isolate separate application environments or deployment lifecycles.
D is incorrect: Automated deployment pipelines should never rely on individual developer user accounts, regardless of whether just-in-time elevation or MFA is configured.
Q10 - Question
An architect is designing a cross-region disaster recovery network topology for mission-critical enterprise workloads. The design must ensure rapid, predictable failovers and enable concurrent connectivity between primary production and disaster recovery sites. Which network design practice should the architect require?
Domain: Design solutions that align with security best practices and priorities (20–25%) Type: Single choice
- A. Assign non-overlapping IP address ranges across production and disaster recovery networks.
- B. Assign overlapping IP address ranges across regions to maintain identical internal IP routes.
- C. Route all disaster recovery traffic through a single dedicated peering provider location.
- D. Rely exclusively on public endpoint failover without hybrid dedicated interconnects.
A is correct.
Explanation: Microsoft BCDR guidance recommends avoiding overlapping IP address ranges between production and disaster recovery networks. Networks containing overlapping IP addresses force complicated failover workflows that delay application recovery during an outage. Designing non-overlapping address spaces establishes a resilient hybrid network architecture that maintains concurrent, predictable connectivity between all environments.
B is incorrect: Overlapping address spaces create routing conflicts and require complex failover interventions that significantly delay application recovery and obstruct concurrent site connectivity.
C is incorrect: BCDR guidelines recommend building redundancy into dedicated interconnects across multiple peering locations to avoid single points of failure during regional outages.
D is incorrect: Disregarding dedicated interconnects neglects enterprise bandwidth planning requirements and fails to deliver private, low-latency network paths between distributed hybrid environments.