Microsoft Cybersecurity Architect Expert (SC-100)

A is correct.

Explanation: In cross-tenant access settings, trust settings determine whether Conditional Access policies trust MFA claims from external organizations. When enabled, users who already satisfied MFA in their home tenant do not face redundant authentication prompts. This configuration maintains your security policy while eliminating duplicate verification prompts for partner users.

B is incorrect: Automatic redemption suppresses the initial consent prompt when accepting invitations, but it does not evaluate or trust external tenant MFA claims.

C is incorrect: B2B direct connect applies to Teams shared channels without adding guests, failing to resolve MFA prompts for existing B2B collaboration guests.

D is incorrect: External tenants isolate consumer accounts for custom apps, rather than facilitating B2B collaboration with business partners accessing organizational workforce resources.

B is correct.

Explanation: The bank requires an integrated Zero Trust solution to classify unmanaged data and prevent unauthorized leaks to external partners. Purview Information Protection discovers and classifies sensitive documents, while data loss prevention enforces automated policies to block exfiltration. Together, these technologies establish policy-driven data governance across hybrid collaboration environments.

A is incorrect: Microsoft Entra Privileged Identity Management manages administrative roles, and Microsoft Sentinel correlates security events, leaving unclassified data unprotected against leaks.

C is incorrect: Microsoft Defender for Identity and Microsoft Sentinel provide unified visibility and incident response, but they lack content classification and data protection capabilities.

D is incorrect: While data loss prevention restricts leaks, Microsoft Entra Privileged Identity Management manages standing privileges rather than classifying unmanaged documents.

C is correct.

Explanation: Microsoft Purview Compliance Manager provides specialized assessment templates designed to assess compliance posture against AI regulations, including the EU Artificial Intelligence Act, ISO/IEC 42001, and NIST AI RMF. It enables the architect to evaluate control implementation and track organizational readiness across these emerging regulatory frameworks within a unified interface.

A is incorrect: Defender for Cloud Apps discovers, assesses, and governs third-party cloud and AI applications by compliance risk, but cannot assess frameworks like ISO 42001.

B is incorrect: Azure AI Content Safety enforces runtime content moderation guardrails to filter harmful outputs, but does not evaluate formal regulatory compliance against standards.

D is incorrect: Microsoft Purview Information Protection classifies and encrypts sensitive training and prompt data, without delivering regulatory compliance assessment templates for AI standards.

D is correct.

Explanation: Azure Lighthouse enables delegated resource management so managing tenant administrators can access customer Azure subscriptions and resource groups without switching directories. Customers maintain precise control by delegating specific scopes and roles, retaining activity logs in their own customer tenants, auditing service provider actions, and maintaining the ability to revoke access at any time.

A is incorrect: Identity federation with AWS IAM Identity Center addresses multicloud identity access patterns rather than delegating customer Azure subscriptions and resource groups.

B is incorrect: Microsoft Purview Privileged Access Management provides task-level just-in-time access for Microsoft 365 administrative operations, not delegated Azure subscription management.

C is incorrect: Defender for Cloud Apps monitors administrative activities across SaaS applications, but cannot delegate scoped access to customer Azure resources.

B is correct.

Explanation: High-volume, low-security-value logs should be ingested exclusively into the data lake tier for cost-effective retention up to 12 years. This design satisfies compliance obligations while keeping compute separated from storage, allowing analysts to run asynchronous KQL jobs on demand whenever an investigation requires access to historical records.

A is incorrect: Ingesting high-volume logs into the analytics tier incurs expensive interactive querying charges, making it cost-inefficient for verbose, rarely inspected telemetry.

C is incorrect: The analytics tier 30-day default retention fails long-term compliance mandates and incurs interactive storage costs for logs that are rarely analyzed.

D is incorrect: Streaming to an external SIEM through an event hub bypasses Sentinel data lake storage and does not support native KQL jobs.

A is correct.

Explanation: Protected actions in Microsoft Entra ID assign Conditional Access policies to sensitive administrative permissions that are enforced when a user attempts the action, rather than during sign-in. This mechanism triggers step-up verification only when operations such as modifying Conditional Access policies occur, keeping routine administrative sign-ins completely uninterrupted.

B is incorrect: Sign-in frequency controls force reauthentication periodically during initial sign-in, rather than applying step-up authentication when administrators attempt specific, sensitive operations.

C is incorrect: Continuous access evaluation revokes active sessions when critical events occur mid-session, rather than evaluating specific permissions when configurations change.

D is incorrect: Persistent browser session controls determine whether browser sessions remain active after closure, which does not enforce contextual authorization during administrative actions.

C is correct.

Explanation: Microsoft Defender for Cloud continuous export allows streaming compliance data directly to a Log Analytics workspace for long-term historical analysis and formal auditor reporting. Simultaneously, continuous export can route compliance event streams into Azure Event Hubs, enabling security operations to integrate live posture changes into their external SIEM solution.

A is incorrect: PDF compliance reports generate point-in-time assessment summaries for auditors, but cannot stream telemetry or provide long-term dynamic historical tracking to SIEMs.

B is incorrect: Regulatory compliance dashboard views display current posture against selected standards, but do not stream continuous events to SIEMs or retain queryable history.

D is incorrect: Workflow automation triggers Logic Apps to create tickets or runbooks, rather than streaming bulk compliance event pipelines to external SIEM systems.

B is correct.

Explanation: Azure Backup with immutable vaults and anomaly detection directly strengthens ransomware resilience by safeguarding critical recovery data against unauthorized tampering and deletion. This directly replaces vulnerable tape-based storage with modern safeguards, ensuring dependable data restoration following an active ransomware incident across Contoso's hybrid enterprise infrastructure.

A is incorrect: Microsoft Sentinel and Security Copilot provide centralized threat detection, but they do not protect backup storage from tampering during ransomware attacks.

C is incorrect: Azure Arc and Azure Policy enforce hybrid compliance baselines, but they do not provide immutable vaults or anomaly detection for backups.

D is incorrect: Application Proxy and Conditional Access enforce identity-based access controls for applications, but they do not safeguard enterprise backup data against ransomware.

B is correct.

Explanation: For non-Azure machines, the Azure Arc agent must be installed first to enable Azure Monitor agent deployment across hybrid environments. Once machines are Arc-enabled, you can configure Azure Policy with remediation tasks or Defender for Cloud auto-provisioning to enforce consistent Azure Monitor agent installation and telemetry collection at scale.

A is incorrect: Data collection rules define telemetry collection rules, but non-Azure machines require the Azure Arc agent before the Azure Monitor agent can deploy.

C is incorrect: Azure Private Link keeps monitoring traffic off the public internet, but it provides network transport security rather than enabling host agent deployment.

D is incorrect: Activity log alerts monitor Azure subscription operations and service health events, meaning they cannot deploy software agents or monitor guest operating systems.

C is correct.

Explanation: Microsoft Entra Lifecycle Workflows and Entitlement Management directly automate identity governance and streamline access reviews across hybrid organizations. This integrated pairing eliminates operational gaps caused by fragmented identity management, ensuring that internal and external user access privileges are systematically provisioned, monitored, and regularly reviewed under unified governance policies.

A is incorrect: Azure Arc and Azure Policy enforce configuration baselines on hybrid workloads, not identity lifecycles or periodic user access reviews.

B is incorrect: Microsoft Entra Private Access and Application Proxy replace VPNs to secure application connections, rather than managing user lifecycles or access reviews.

D is incorrect: Azure Backup and Defender XDR address data resilience and threat detection, and neither solution automates user identity governance or access reviews.