Microsoft SC-100 Practice Questions with Explanations

Correct answer: C

Microsoft Priva's Privacy Risk Management feature is specifically designed to identify unused personal data, provide users with notifications and guidance when personal data is shared in Teams, and offer recommendations to mitigate privacy risks. This directly addresses all three requirements mentioned in the question.

Why the other options are wrong:

• A. Communication compliance focuses on detecting policy violations and inappropriate communications, not privacy data handling decisions.
• B. Microsoft Viva Insights provides workplace analytics and wellbeing insights, not privacy risk management capabilities.
• D. Advanced eDiscovery is for legal discovery and compliance investigations, not for identifying unused personal data or real-time guidance.

Correct answer: D

Azure Logic Apps provide a low-code, no-code solution for workflow automation that can integrate with Microsoft Defender for Cloud to evaluate and remediate alerts. Logic Apps minimize development effort compared to other options and support complex conditional logic for alert response automation.

Why the other options are wrong:

• A. Azure Monitor webhooks are for notifications only and do not provide workflow automation capabilities for evaluation and remediation.
• B. Azure Event Hubs is a data streaming platform for ingesting events, not for automation and remediation workflows.
• C. Azure Functions requires more development effort than Logic Apps and is code- based rather than low-code/no-code.

Correct answer: C

Microsoft Sentinel workbooks provide customizable dashboards and visualizations for analyzing security events. Workbooks allow security teams to create custom views, display KPIs, and present data in an organized manner tailored to their operational needs.

Why the other options are wrong:

• A. Notebooks are for interactive investigation and data analysis using KQL, not for building dashboards.
• B. Playbooks are for automation and response actions, not for analyzing security events through dashboards.
• D. Threat intelligence provides threat data and indicators, not custom dashboards for event analysis.

Correct answer: D

Honeytoken entity tags in Microsoft Defender for Identity create decoy accounts and credentials that appear legitimate but are monitored. When attackers attempt to exploit these honeytokens, alerts are automatically triggered, allowing security teams to detect and respond to compromised identity attacks.

Why the other options are wrong:

• A. Sensitivity labels are for data classification and protection, not for creating decoy accounts to catch attackers.
• B. Custom user tags are for organizing and categorizing users, not for creating monitored decoy accounts.
• C. Standalone sensors are deployment components for Defender for Identity, not for creating honeypots or monitoring fake accounts.

Correct answer: B

Playbooks are Microsoft Sentinel's SOAR automation feature that minimizes manual intervention by automating response actions. Playbooks can be triggered by alerts and integrated with Microsoft Teams channels to enable triage and response workflows directly within Teams.

Why the other options are wrong:

• A. KQL is a query language for data analysis, not a SOAR automation mechanism.
• C. Data connectors ingest data into Sentinel but do not provide automation or response capabilities.
• D. Workbooks are for visualization and analysis, not for automating security responses or Teams integration.

Correct answer: B

Azure Event Hubs is the recommended solution for exporting security events from Microsoft Sentinel to third-party SIEM solutions like Splunk. Event Hubs provides a scalable, reliable streaming platform that can receive and forward data from Sentinel to external systems using connectors and integrations.

Why the other options are wrong:

• A. Microsoft Sentinel data connectors are for ingesting data into Sentinel, not for exporting data to external systems.
• C. Workbooks are for visualization and analysis within Sentinel, not for exporting data to external SIEM solutions.
• D. Azure Data Factory is for data integration and ETL processes but is not the standard solution for Sentinel-to-Splunk integration.

Correct answer: A

Azure AD Privileged Identity Management (PIM) is an Azure AD Premium feature that enables just-in-time privileged access and role activation workflows. This is essential for managing admin access to Azure resources and adhering to Zero Trust principles. The Free edition does not include PIM capabilities, making this upgrade necessary for proper privileged identity management in Azure deployments.

Why the other options are wrong:

• B. Role-based authorization (RBAC) is available in Azure AD Free edition.
• C. Resource-based authorization is a general authorization concept available in the Free tier.
• D. Azure AD Multi-Factor Authentication is available in Azure AD Free edition.

Correct answer: B

The Enhanced Security Admin Environment (ESAE) framework, also known as the Red Forest architecture, is specifically designed for protecting privileged identities in hybrid environments. It provides a dedicated secure environment for administrative tasks and follows Zero Trust principles by implementing strong isolation and authentication boundaries. This framework is the industry-standard approach for designing privileged identity strategies in enterprise environments.

Why the other options are wrong:

• A. Microsoft SDL focuses on secure development practices, not privileged identity architecture.
• C. RaMP is a modernization roadmap for implementing Zero Trust broadly, not specifically for privileged identity design.
• D. OSA focuses on operational security practices, not on privileged identity architectural frameworks.

Correct answer: B

The question asks how to isolate compute components on an Azure virtual network in a serverless application architecture. Azure App Service Environment (ASE) is a dedicated, single-tenant hosting environment that runs inside a virtual network, allowing compute resources (such as API apps and function apps) to be fully isolated within a VNet with complete network control. This is the appropriate solution for isolating the Patient API, Audit API, and other compute components shown in the diagram within an Azure virtual network.

Why the other options are wrong:

• A. Azure AD enterprise applications are for identity and access management, not for isolating compute resources on a virtual network.
• C. Azure service endpoints enable secure connectivity to Azure services but do not isolate compute components themselves on a VNet.
• D. Azure AD application proxy is for providing secure remote access to on-premises applications, not for isolating Azure compute resources within a virtual network.

Correct answer: B

Managed identities in Azure are the recommended best practice for API Management service accounts according to Microsoft Cloud Security Benchmark. Managed identities eliminate the need to store credentials, provide automatic credential rotation, and are integrated directly into Azure services. This approach eliminates credential exposure risks and simplifies lifecycle management for service accounts.

Why the other options are wrong:

• A. Application registrations require credential management and are less secure than managed identities for service accounts.
• C. Service principals with usernames and passwords require storing and rotating credentials manually, creating security vulnerabilities.
• D. Device registrations are for device management, not for authenticating services.
• E. Service principals with certificate credentials, while better than passwords, are less ideal than managed identities which require no credential handling.

Correct answer: A

Local Administrator Password Solution (LAPS) is the recommended solution for managing local admin credentials on Windows computers. LAPS automatically generates unique, complex passwords for local administrator accounts and stores them securely in Active Directory, providing just-in-time access only when needed. This prevents standing administrative privileges, significantly reducing ransomware lateral movement by ensuring compromised admin accounts have limited persistent access.

Why the other options are wrong:

• B. Azure AD Identity Protection detects anomalous sign-ins but doesn't manage local administrator access or provide just-in-time privilege elevation.
• C. Azure AD PIM manages Azure and cloud resources, not local Windows administrator access for hybrid-joined devices.
• D. PAWs are hardened workstations for admin tasks but don't specifically solve the local admin credential management problem on user workstations.

Correct answer: E

Protected folders (controlled folder access) in Microsoft Defender is the direct Microsoft Security Best Practice recommendation for preventing ransomware from encrypting local user files. This feature blocks unauthorized applications from accessing protected folders, providing behavioral protection against file encryption attacks at the endpoint level without requiring administrative complexity.

Why the other options are wrong:

• A. Windows Defender Device Guard is designed to prevent malware execution through code integrity and application whitelisting, not specifically file encryption protection.
• B. Microsoft Defender for Endpoint provides detection and response capabilities but is not the primary solution for minimizing ransomware encryption of local files.
• C. Azure Files is a cloud storage service and does not protect local user files on the endpoint from ransomware.
• D. BitLocker Drive Encryption encrypts data at rest but does not prevent ransomware from encrypting files within the encrypted volume.

Correct answer: A

Managed identities in Azure are the DevSecOps best practice for CI/CD pipeline service connections according to Microsoft Cloud Adoption Framework. Managed identities eliminate credential management burden, provide automatic credential rotation, enable fine-grained role-based access control through Azure RBAC, and require no secret storage or maintenance, fully aligning with modern security best practices.

Why the other options are wrong:

• B. Using individual Azure AD user accounts violates least privilege and DevSecOps principles; user accounts should not be used for automation.
• C. Group managed service accounts are on-premises AD constructs and do not apply to Azure DevOps service connections in the cloud.
• D. Storing passwords in Key Vault introduces unnecessary secrets management and is inferior to managed identity which requires no credentials at all.

Correct answer: B

Applying updates to the node image used for provisioning is the Microsoft recommended approach that minimizes administrative effort. AKS node images are regularly updated by Microsoft with the latest kernel patches, and new nodes created from updated images automatically receive these updates. This approach avoids manual patching and aligns with container best practices of immutable infrastructure.

Why the other options are wrong:

• A. While node restarts may occur during updates, this describes a consequence rather than a solution strategy and doesn't address the process for ensuring latest updates.
• C. Upgrading the AKS cluster version updates Kubernetes but does not guarantee the latest kernel updates on Linux nodes; these are separate concerns.

Correct answer: A

Azure AD Application Proxy is the Zero Trust solution that directly addresses secure web app access following MCRA principles. It eliminates the need for VPN and RADIUS authentication by providing conditional access verification, device compliance checks, and direct application-level access control without exposing infrastructure to the internet. This minimizes attack surface by removing the VPN gateway as an attack vector.

Why the other options are wrong:

• B. While Azure AD authentication is beneficial, configuring it on the existing VPN still relies on VPN infrastructure and does not fully implement Zero Trust principles.
• C. Microsoft Defender for Cloud Apps provides visibility and control but is not the primary architectural solution for replacing VPN access.
• D. Microsoft Defender for Endpoint focuses on endpoint security and does not address the redesign of remote access infrastructure.

Correct answer: B

Self-healing in Microsoft 365 Defender automatically detects and remediates security threats without requiring analyst intervention, directly reducing operational load on Tier 1 SOC analysts. Automated remediation actions such as isolating devices, blocking users, or removing malware execute immediately upon threat detection, allowing analysts to focus on complex investigations rather than routine response tasks.

Why the other options are wrong:

• A. Compliance policies in Azure Policy enforce configuration standards but do not automate threat response or reduce SOC operational load.
• C. Automating data classification improves data governance but does not reduce the operational burden of responding to security incidents.
• D. Creating hunting queries requires analyst expertise and effort; these are proactive investigative tools that increase rather than decrease analyst workload.

Correct answer: C

This configuration follows least privilege by granting Group2 administrative access to manage the devices while allowing individual users with Security Administrator role access only to their own assigned device. This separation of duties ensures device management is handled by dedicated administrators while privileged users have minimal administrative scope, strictly limited to their personal device.

Why the other options are wrong:

• A. Adding only Group2 denies the Security Administrator users administrative access to their own privileged access devices, violating the requirement that users in Group1 have appropriate administrative capabilities.
• B. Windows LAPS legacy emulation mode is outdated; modern Microsoft LAPS provides superior credential management and should be used instead for privileged access devices.

Correct answer: C

Azure Private DNS zones should be deployed to each landing zone per Cloud Adoption Framework enterprise-scale best practices. Private DNS zones enable name resolution within and across landing zones while maintaining network isolation and security boundaries. Each landing zone requires its own DNS zone for independent application management while shared services maintain centralized zones for common resources.

Why the other options are wrong:

• A. Azure Firewall is a shared service resource deployed to the platform landing zone for centralized network filtering, not to individual application landing zones.
• B. Azure virtual network gateways are connectivity resources deployed to the platform landing zone for hybrid or inter-cloud connectivity, not to application landing zones.
• D. Azure Key Vault can be deployed to either shared or application landing zones depending on key management strategy, but is not the primary resource recommended for each application landing zone.

Correct answer: D

Microsoft Entra Permissions Management is specifically designed to discover, remediate, and monitor unused role assignments and permissions across cloud infrastructure. It provides visibility into which role assignments have not been used during specified time periods (like 90 days) and helps identify excessive permissions for consolidation, requiring minimal administrative effort compared to manual audits.

Why the other options are wrong:

• A. Microsoft Defender for Cloud focuses on security posture and threat detection, not on identifying unused RBAC role assignments.
• B. Microsoft Entra access reviews are manual review processes requiring administrative participation rather than automated discovery of unused roles.
• C. Microsoft Entra PIM manages privileged access activation and approval workflows, not discovery of unused role assignments.

Correct answer: A

Azure Resource Guard implements multi-user authorization for critical backup operations, ensuring that no single compromised account (including local administrators) can unilaterally stop or delete backups. This requires multiple authorized identities to approve critical operations, directly preventing a compromised local administrator from disabling backup protections and aligns with Microsoft Security Best Practices for ransomware defense.

Why the other options are wrong:

• B. PIM manages privileged role assignment activation but does not provide multi-user authorization controls for backup operations themselves.
• C. Registering MABS with a Recovery Services vault is a basic configuration step that doesn't prevent compromised accounts from stopping backups.
• D. A security PIN for critical operations provides basic protection but lacks the multi-user authorization enforcement required to prevent a single compromised account from disabling backups.

Correct answer: B

Microsoft Intune Endpoint Privilege Management (EPM) allows standard users to request and obtain elevated privileges for specific applications or operations on a just-in-time basis with approval workflows. This aligns perfectly with Zero Trust principles by granting minimal necessary privileges only when needed, without requiring permanent administrative rights or complex PIM configurations that are designed for Azure administrative roles rather than application-level access.

Why the other options are wrong:

• A. PIM manages Azure AD role assignments and administrative access, not application- level privileges on managed endpoints.
• C. Microsoft LAPS manages local administrator passwords but does not provide the granular, application-specific just-in-time elevation required for this scenario.
• D. Entitlement management handles resource access and group membership, not the elevation of privileges for application installation on endpoints.

Correct answer: D

The 'Disabled' effect in Azure Policy allows policies to be evaluated for compliance assessment without applying any enforcement. When disabled, policies will report on non- compliant resources without denying, modifying, or appending any resources, making it ideal for evaluating compliance in audit-only mode without making any resource changes.

Why the other options are wrong:

• A. Deny effect enforces policy by blocking non-compliant resource operations, which modifies behavior and violates the requirement to not change resources.
• B. Modify effect actively changes resource properties to achieve compliance, directly altering resources rather than merely evaluating them.
• C. Append effect adds properties to resources to achieve compliance, which constitutes a resource change rather than pure evaluation.

Correct answer: D

Endpoint Security (ES) is the compliance control that evaluates protection measures on individual endpoints, including virtual machines. Microsoft Defender for Servers is an endpoint protection solution that monitors and secures Windows virtual machines by detecting threats, managing vulnerabilities, and ensuring security agent deployment. This falls directly under the Endpoint Security control domain, which focuses on protecting endpoints from malware, exploits, and other threats.

Why the other options are wrong:

• A. Asset Management focuses on inventory and lifecycle management of resources, not on deployed security agents on those resources.
• B. Posture and Vulnerability Management addresses overall security configuration and vulnerability identification, not specifically on endpoint agent deployment.
• C. Data Protection concerns encryption, access controls, and data governance-not endpoint security agent installation.
• E. Incident Response deals with detection and remediation of security incidents, not with preventive endpoint protection measures.

Correct answer: A

To evaluate NIST 800-53 compliance, the first step is to assign a built-in Azure Policy initiative scoped to the subscription that maps to NIST 800-53 controls. Azure Policy provides the foundational compliance assessment framework that evaluates resources against regulatory standards. This establishes the baseline compliance posture before reviewing individual security baselines or configuring additional monitoring tools.

Why the other options are wrong:

• B. Microsoft Sentinel is a SIEM tool for log aggregation and threat detection, not the primary mechanism for compliance framework assessment.
• C. The Azure security baseline is a supplementary hardening guide, not the primary tool for formal NIST 800-53 compliance evaluation.
• D. Microsoft Defender for Cloud Apps manages cloud application access and is not focused on infrastructure compliance assessment for NIST 800-53.

Correct answer: A

Azure Virtual Desktop provides scalable virtual desktop infrastructure for temporary employees without requiring personal devices. Azure AD Conditional Access enforces security policies based on device compliance and user risk. Microsoft Defender for Cloud Apps provides additional visibility and control over cloud application access. This combination addresses the need for secure, scalable access to on-premises resources while maintaining the security policy that prevents personal device usage.

Why the other options are wrong:

• B. Split tunnel VPN configuration doesn't provide the scalability or device management controls needed for temporary employees and doesn't prevent personal device usage.
• C. Endpoint Manager alone doesn't provide virtual desktop infrastructure needed to avoid personal device usage; it primarily manages enrolled devices rather than providing remote access alternatives.
• D. Migrating all on-premises applications to cloud is not feasible within a brief period and doesn't address the immediate need for temporary employee access.

Correct answer: A

Azure Policy is the service that enforces compliance standards and can automatically remediate noncompliant resources through remediation tasks. Policy definitions can be assigned to enforce ISO 27001:2013 standards across the subscription, and remediation can be applied automatically to bring resources into compliance.

Why the other options are wrong:

• B. Azure Blueprints is for deploying templated environments and doesn't provide ongoing compliance enforcement or automatic remediation.
• C. The regulatory compliance dashboard displays compliance status but doesn't enforce standards or perform automatic remediation.
• D. Azure RBAC controls access permissions but does not enforce compliance standards or remediate noncompliant resources.

Correct answer: A

Azure Policy is the appropriate service to mitigate the identified risks. It can enforce network restrictions, firewall rules, private link connections, and public access denial on storage accounts organization-wide. Policy can automatically remediate noncompliant storage accounts or deny their creation, directly addressing all four recommendations.

Why the other options are wrong:

• B. Azure Network Watcher monitors network traffic but does not enforce policies or remediate storage account configurations.
• C. Azure Storage Analytics provides monitoring and logging data but does not enforce compliance policies or configurations.
• D. Microsoft Sentinel is a SIEM solution for threat detection and response, not for enforcing security configuration policies on storage accounts.

Correct answer: C

The security alert indicates that MicroBurst's exploitation toolkit was used to extract keys to storage accounts via the Get-AZStorageKeysREST module. This threat specifically exploits the ability to access and use storage account keys (shared key authentication). To prevent this threat from reoccurring, the most effective policy is to disable shared key access to storage accounts, which eliminates the attack vector that MicroBurst exploits. Option C directly addresses this by preventing shared key authentication, forcing clients to use more secure methods like Azure AD or SAS tokens that provide better audit trails and granular access control.

Why the other options are wrong:

• A. While public access restrictions are a good security practice, they don't directly prevent the extraction of storage account keys via REST API calls that MicroBurst exploits.
• B. Key Vault Managed HSM purge protection is for Azure Key Vault protection and is not related to the storage account key extraction threat described in the alert.
• D. Storage account key expiration policy doesn't address the core threat; MicroBurst can still extract and use active keys regardless of expiration settings.

Correct answer: B

The VMAccess extension enables remote password management on virtual machines but does not secure or harden management ports. Secure management ports controls focus on restricting access to ports like RDP (3389) and SSH (22) through network security groups, just-in-time access, or similar controls. Enabling VMAccess does not address port security or access controls required by this benchmark.

Correct answer: B

Adaptive network hardening provides recommendations to restrict network access but does not directly score points for the Secure management ports controls in Azure Security Benchmark V3. The benchmark specifically focuses on restricting access to management ports through controls like network security groups and just-in-time VM access. Adaptive network hardening is a recommendation engine rather than a direct enforcement mechanism for this specific control.

Correct answer: A

Just-in-time (JIT) VM access is a direct control that addresses the Azure Security Benchmark V3's 'Secure management ports' requirement. JIT restricts access to management ports like RDP (3389) and SSH (22) by default and only opens them when needed for legitimate administrative access, which directly improves the score for this security control.

Why the other options are wrong:

• B. This incorrectly states that JIT VM access does not meet the goal, when in fact it is specifically designed to secure management ports.

Correct answer: A

Private endpoints implement Zero Trust principles by eliminating public internet exposure for both the Azure App Service Web App and Azure Cosmos DB. Private endpoints create private connections within Azure virtual networks, ensuring traffic never traverses the public internet and enabling network-level isolation, access controls, and encrypted communication. This aligns with Zero Trust's core tenets of assuming breach, verifying every access request, and minimizing trust boundaries. The solution directly addresses the security requirement between the web app and database layers as shown in the architecture diagram.

Why the other options are wrong:

• B. Private endpoints are a foundational Zero Trust security control that directly addresses the stated requirement for securing connections between the web app and database, making this solution fully viable.

Correct answer: B

While Azure Key Vault is an important component for credential storage and management, using it alone does not fully meet the Zero Trust model requirements for securing the connection between the web app and database. Zero Trust requires multiple layers of security including identity verification, encryption in transit, network isolation, and continuous validation. The solution must also implement managed identities for authentication (eliminating stored credentials), network segmentation (private endpoints or service endpoints), encryption in transit (TLS/SSL), and access controls. Key Vault addresses only the credential storage aspect but does not provide the comprehensive Zero Trust implementation needed for the connection security between Azure App Service Web App and Azure Cosmos DB.

Why the other options are wrong:

• A. Key Vault alone is insufficient for Zero Trust; it must be combined with managed identities, encryption, network controls, and continuous validation.

Correct answer: B

While Azure Application Gateway with WAF is valuable for protecting the web app from external threats, it does NOT address the specific requirement of securing the connection between the web app and the database in a Zero Trust model. The question asks specifically about securing the web app-to-database connection. Zero Trust principles for this connection require authentication, encryption, and network isolation at the database layer-such as using managed identities, private endpoints, network policies, and encryption in transit/at rest. Application Gateway protects the client-to-web-app connection but does not implement Zero Trust controls for the app-to-database communication path.

Why the other options are wrong:

• A. Application Gateway with WAF secures client-to-app communication but fails to address Zero Trust requirements for the app-to-database connection layer.

Correct answer: A

Adaptive application controls in Defender for Cloud is the feature specifically designed to whitelist authorized applications on virtual machines and automatically block unauthorized applications from running or being installed. It learns from the normal application behavior and enforces policies accordingly, meeting the requirement for automatic blocking until administrator authorization.

Why the other options are wrong:

• B. App protection policies in Microsoft Endpoint Manager are designed for mobile device management and protecting data on managed devices, not for controlling which applications can run on Windows servers.
• C. App discovery anomaly detection policies in Microsoft Defender for Cloud Apps are designed to detect anomalous application usage in cloud environments, not to block unauthorized applications from running on VMs.
• D. Azure Security Benchmark compliance controls are general compliance frameworks, not specific tools for enforcing application execution policies.

Correct answer: B

The question asks about securing the connection between the web app and the database following the Zero Trust model. Azure Front Door with WAF addresses north-south traffic (client to web app), but does not secure the east-west connection between the Azure App Service Web App and Azure Cosmos DB. Zero Trust requires securing all connections, including database access. The solution should implement network isolation (VNet integration), managed identities for authentication, Azure Private Endpoints for database connectivity, and encryption in transit/at rest. Front Door and WAF alone do not meet the Zero Trust requirement for app-to-database security.

Why the other options are wrong:

• A. Azure Front Door with WAF protects the web app from external threats but does not secure or verify the internal connection between the web app and Cosmos DB, which is essential for Zero Trust.

Correct answer: B

Microsoft Endpoint Manager (Intune) is the unified endpoint management solution that can assess compliance across Windows, iOS, Android, and macOS devices, both on-premises and in cloud environments. It provides compliance policies, device compliance assessment, and reporting capabilities needed to verify devices meet organizational compliance rules across all platforms.

Why the other options are wrong:

• A. Microsoft Defender for Endpoint primarily focuses on threat detection and response for Windows and some macOS devices, not general compliance assessment across all platforms.
• C. Microsoft Information Protection is focused on data classification and protection, not device compliance assessment.
• D. Microsoft Sentinel is a SIEM solution for security monitoring and incident response, not a device compliance assessment tool.

Correct answer: B

Onboarding virtual machines to Microsoft Defender for Endpoint does not directly address the 'Secure management ports' control requirement in Azure Security Benchmark V3. Defender for Endpoint focuses on threat detection and endpoint protection, not on securing or restricting access to management ports like RDP and SSH, which is what the control actually measures.

Why the other options are wrong:

• A. This incorrectly suggests that Defender for Endpoint onboarding meets the goal; it does not directly secure management ports as required by the control.

Correct answer: D

To review compliance against NIST 800-53, the first step is to add the regulatory compliance standard to Defender for Cloud. This enables the NIST 800-53 compliance standard to be tracked and assessed against the subscription's current configuration, providing a baseline and recommendations for meeting that specific government regulation.

Why the other options are wrong:

• A. Reviewing secure score recommendations is helpful but doesn't specifically enable NIST 800-53 compliance assessment.
• B. Configuring the Microsoft Defender for Cloud data connector in Sentinel is for log analysis and incident response, not for regulatory compliance assessment.
• C. Reviewing the Azure security baseline audit report is useful but is not the first step needed to review NIST 800-53 compliance specifically.

Correct answer: D

Policy Analyzer is the tool from the Microsoft Security Compliance Toolkit specifically designed to compare security baselines against current device configurations. It analyzes how current Group Policy and security settings compare to the recommended baselines, allowing organizations to identify gaps and deviations.

Why the other options are wrong:

• A. Microsoft Intune is for device management and mobile device administration, not for comparing local policy baselines.
• B. Local Group Policy Object (LGPO) is a tool for applying policies, not for comparing baselines to current configurations.
• C. Windows Autopilot is used for device provisioning and enrollment, not for security baseline comparison.

Correct answer: D

Enabling the Defender plan for all resource types in Microsoft Defender for Cloud is the foundational first step to evaluate the security posture of workloads. This enables comprehensive threat protection, vulnerability assessment, and security posture monitoring across all Azure resources in the landing zone.

Why the other options are wrong:

• A. CI/CD vulnerability scanning is valuable but comes after establishing baseline security posture monitoring.
• B. Azure AD Premium Plan 2 licenses are for identity security but are not the first priority for workload security posture evaluation.
• C. Microsoft Sentinel data connectors are for log aggregation and SIEM functionality, not for initial security posture assessment.

Correct answer: A

From Azure Policy, assigning a built-in initiative with subscription scope is the correct first step to review NIST 800-53 compliance. An initiative groups multiple policy definitions together and can be scoped to the subscription to assess and enforce NIST 800-53 compliance requirements across all resources.

Why the other options are wrong:

• B. While assigning policy definitions is important, using an initiative is more appropriate as it provides a comprehensive set of policies aligned to regulatory standards like NIST 800-53.
• C. Reviewing the Azure security baseline audit report is useful but does not specifically establish NIST 800-53 compliance tracking.
• D. Microsoft Defender for Cloud Apps access policies are for cloud application security, not for NIST 800-53 compliance assessment.

Correct answer: D

To review a subscription for NIST 800-53 compliance, you must first assign a built-in Azure Policy initiative that covers NIST 800-53 controls. Azure Policy initiatives provide the foundational compliance framework needed before other compliance reviews can be conducted. This establishes the policy baseline required for government contracts.

Why the other options are wrong:

• A. The Azure security baseline audit report is a review tool, not the first step to establish NIST 800-53 compliance framework.
• B. Microsoft Defender for Cloud Apps access policies are for cloud application security, not relevant to NIST 800-53 compliance review.
• C. Enabling Defender plans addresses threat detection, not the initial compliance standard setup needed for NIST 800-53.

Correct answer: D

To review NIST 800-53 compliance in Defender for Cloud, you must first add the regulatory compliance standard to your workspace. This step makes NIST 800-53 available as a compliance framework within Defender for Cloud, enabling compliance assessment and reporting.

Why the other options are wrong:

• A. Microsoft Sentinel data connectors are for log ingestion and threat detection, not for compliance standard setup.
• B. Microsoft Defender for Cloud Apps access policies manage cloud application security, not regulatory compliance standards.
• C. Enabling Defender plans is a security feature for threat protection, not the initial step for adding regulatory compliance standards.

Correct answer: C

Adding a regulatory compliance standard in Defender for Cloud is the first step to review NIST 800-53 compliance. This action enables the compliance dashboard and assessment tools specific to NIST 800-53 requirements.

Why the other options are wrong:

• A. Enabling Defender plans provides threat detection capabilities, not compliance standard framework setup.
• B. The Azure security baseline audit report is a review mechanism, not the initial setup for regulatory compliance standards.
• D. Microsoft Defender for Cloud Apps access policies manage cloud application access control, not regulatory compliance standards.

Correct answer: B

When enhanced security is already enabled in Defender for Cloud, the next step for NIST 800-53 compliance review is to assign a built-in Azure Policy initiative at the subscription scope. This establishes the policy framework that enforces NIST 800-53 control requirements across all resources.

Why the other options are wrong:

• A. Defender plans are already enabled per the scenario; this is not the appropriate next step.
• C. Reviewing secure score recommendations addresses security posture but is not the first step for NIST 800-53 compliance review.
• D. Microsoft Defender for Cloud Apps policies manage cloud application security, not NIST 800-53 compliance requirements.

Correct answer: B

With enhanced security already enabled, assigning a built-in initiative (not individual policy definitions) at subscription scope is the appropriate approach for NIST 800-53 compliance. An initiative is a collection of related policies that work together to achieve compliance objectives, making it more suitable than individual policy definitions.

Why the other options are wrong:

• A. Enhanced security is already enabled per the scenario; this is not required.
• C. Microsoft Defender for Cloud Apps manages cloud application access policies, not NIST compliance framework.
• D. A policy definition is a single rule, whereas an initiative is a collection of policies needed for comprehensive compliance standards.

Correct answer: C

Azure Policy assignments are the correct tool for enforcing governance requirements about which Azure regions resources can be deployed to. You can assign built-in policies that restrict resource creation to specific regions like West Europe or North Europe.

Why the other options are wrong:

• A. Management groups organize subscriptions but do not directly enforce resource location restrictions.
• B. Custom Azure roles control access and permissions, not resource deployment locations.
• D. Regulatory compliance standards address compliance frameworks like NIST or ISO, not regional deployment restrictions.

Correct answer: C

Azure Policy is the correct solution to enforce ISO 27001:2013 standards and automatically detect noncompliant resources. Azure Policy provides built-in initiatives for ISO 27001:2013 that can automatically evaluate and report on compliance, with the ability to enforce compliance through policy effects.

Why the other options are wrong:

• A. Azure Blueprints deploy predefined Azure resources but do not continuously enforce and detect compliance violations.
• B. The regulatory compliance dashboard in Defender for Cloud provides reporting and assessment, not automatic enforcement of standards.
• D. Azure RBAC controls user access and permissions, not resource compliance with security standards.

Correct answer: D

Application control policies in Microsoft Defender for Endpoint provide the capability to enforce an allowlist of authorized applications on Windows Server machines and automatically block unauthorized application execution and installation. This meets the requirement for automatic blocking until administrator authorization.

Why the other options are wrong:

• A. App discovery anomaly detection in Defender for Cloud Apps detects suspicious cloud application activity but does not block unauthorized applications from running on virtual machines.
• B. Azure Security Benchmark compliance controls assess security posture but do not provide application-level control mechanisms.
• C. Azure AD app registrations manage application identity and access to Azure AD resources, not local application execution on Windows servers.