Microsoft Cybersecurity Architect (SC-100) — Questions 1–75

This is the correct approach because it combines Intune enrollment (giving the device an identity in Entra ID), compliance policies (defining security baselines such as BitLocker, Windows Defender, or iOS / Android compliance settings), and Conditional Access policies in Entra ID that gate access based on the device's compliance state. When a device is both enrolled and marked compliant, Entra ID trusts that signal and grants or blocks access to cloud resources accordingly. The Conditional Access policy 'Require compliant device' relies on this evaluation and is the only way to enforce compliance-driven access across both managed and unmanaged apps.

Microsoft Azure Policy allows both individual policy definitions and initiative definitions to be assigned at the exact same scopes: management groups, subscriptions, and resource groups. This is by design, because an initiative is simply a bundle of policy definitions that are evaluated together when assigned. Because management groups form a hierarchy, assigning an initiative at a higher scope causes it to be inherited by all descendant scopes, which is useful for enforcing standards across an entire organization.

Microsoft Purview Information Protection with encryption and usage rights is the current, unified file-protection service in Microsoft 365. It lets you apply labels that encrypt files (Word, Excel, PowerPoint, PDF) and attach usage rights—such as View, Edit, Copy, Print, and Forward—that are enforced by Azure Rights Management. These rights are embedded in the file metadata and travel with the file wherever it goes, so even if a user downloads a document to a USB stick or emails it to a third party, access is still governed by the policy. This persistent protection, combined with user-friendly labeling and DLP integration, makes it the correct answer for protecting data at rest and in motion within and outside the tenant.

This is the correct defense-in-depth approach. Enforcing TLS 1.2 as the minimum on App Service guarantees strong transport encryption for all client communications. Deploying Azure Application Gateway with WAF enabled in front of App Service provides an OWASP Top 10 web application firewall that inspects and blocks malicious L7 traffic, preventing SQL injection, XSS, and other common attacks. Enabling Azure AD authentication for Redis Cache replaces key-based access with managed identity, supporting passwordless, conditional access policies. Microsoft Defender for SQL for Azure SQL Database adds threat detection, vulnerability assessment, and anomaly alerts, covering the database tier comprehensively.

Microsoft Purview Data Map is the correct choice because it performs automated metadata scanning and classification of assets across data sources, including Azure Blob Storage. It uses built-in system classification rules and custom classification rules to inspect actual data content (e.g., regex, keywords) and applies classifications like "Person's Name" or "Credit Card Number" to the schema and data. These classifications are then used in the Data Catalog, enabling sensitivity reporting and integration with information protection for labeling. It does not enforce access control or policy, but it is specifically designed for data discovery and classification at scale.

A public IP address is required for the Azure VPN gateway to be reachable from the on-premises VPN device. This IP is assigned to the gateway's IPsec tunnel endpoint and must be a standard SKU public IP, which can be dynamic or static. Without this publicly routable address, the on-premises device cannot initiate or complete the IPsec connection, making it a mandatory component for a site-to-site VPN.

Session policies, part of Conditional Access App Control, route user traffic through Defender for Cloud Apps as a reverse proxy, allowing synchronous inspection of each request and response. The proxy can evaluate conditions like device compliance, user risk, or file sensitivity and then block, allow, or restrict actions — including preventing uploads to unsanctioned apps before the request is passed through. This real-time inline enforcement is exactly what the scenario requires, making session policy the correct choice.

Azure ExpressRoute with redundant circuits creates a private, dedicated connection from on-premises to Azure over Microsoft's global backbone, bypassing the public internet entirely. Redundant circuits, usually configured with BGP for active-active or active-passive, provide automatic failover if a circuit fails, satisfying the requirement for resilient hybrid connectivity. This direct backbone path is exactly what the scenario demands.

A DLP policy is the correct control because it combines detection of a sensitive info type (credit card number uses patterns plus Luhn checksum validation) with a condition that the content is shared externally, and then enforces a blocking action. When you create a DLP policy in the Microsoft Purview compliance portal, you select the credit card number detector, scope it to Exchange/SharePoint/OneDrive, and set the rule to block access or block sending before the content leaves your tenant. This is the only option that directly prevents unauthorized external sharing while also providing user overrides and incident alerts.

Session controls in Microsoft Defender for Cloud Apps enforce real-time monitoring and control of user sessions via a reverse proxy. They allow organizations to apply granular access policies on cloud apps, such as preventing downloads, blocking access to sensitive files, or requiring step-up authentication. Session controls operate at the data plane level, evaluating user activity as it happens, and are often triggered by Conditional Access policies from Microsoft Entra ID.

Enabling UEBA in Microsoft Sentinel gives threat hunters behavioral baselines for users, hosts, and applications. By leveraging machine learning to detect anomalies such as unusual sign-in patterns or lateral movement, UEBA surfaces high-fidelity leads. This enriches entities in hunting queries with risk scores and behavioral insights, making detection of insider threats or compromised accounts far more effective.

Sensitivity labels are the only Microsoft Purview option that can simultaneously apply encryption with Azure Rights Management and configure content marking, including visual watermarks, headers, and footers. When a label with these settings is applied to a document or email, the watermark is automatically rendered behind the content or in the header, and encryption protects the file at rest and in transit. This provides a unified, policy-driven way to add watermarks without separate tooling or manual intervention.

Fusion is a built-in analytics rule in Microsoft Sentinel that leverages machine learning to correlate security alerts from multiple products—such as Microsoft Defender for Endpoint, Defender for Identity, and Defender for Office 365—into a single incident. It is specifically designed to detect advanced multi-stage attacks, including APTs, by analyzing cross-source alert relationships and timestamps. This makes Fusion the correct answer because it uniquely uses ML for multi-source correlation and APT detection.

The Microsoft Defender for Identity data connector in Microsoft Sentinel is the native integration path: once enabled, it uses the Microsoft 365 Defender API to pull MDI alerts and incidents into Sentinel, making them available for analytics rules, hunting, and incident correlation. This connector is the official—and only supported—way to ingest MDI data into Sentinel, and it requires no additional sensors, log forwarders, or syslog infrastructure. Enabling it consumes the correct, purpose-built pipeline.

The Modify effect in Azure Policy requires a managed identity to be attached to the policy assignment and that identity must be granted RBAC permissions, such as SQL Security Manager, on the target SQL servers or databases to change Transparent Data Encryption settings. Without a properly configured identity, the policy assignment fails during evaluation/remediation and cannot apply the desired TDE state. This is a mandatory prerequisite, making the option the correct answer.

Validate JWT policy ensures that only requests carrying a valid JSON Web Token signed by a trusted identity provider reach the API, thereby authenticating each partner's identity. The rate-limit-by-key policy then uses the subscription key as the scope to apply per-partner request quotas, preventing any single partner from consuming all available capacity. This combination provides both secure identity verification and granular throttling, which is exactly what an API exposure to partners requires.

Microsoft Defender for Endpoint is a foundational component of Microsoft Defender XDR (formerly Microsoft 365 Defender). It delivers endpoint detection and response (EDR), vulnerability management, and attack surface reduction capabilities, sharing signals with the unified XDR pipeline to enable cross-domain threat correlation and automated response.

App protection policies (APPs) are the correct choice because they are specifically designed to prevent corporate data leakage in mobile apps. These MAM (mobile application management) policies apply directly to applications like Outlook or Teams and can restrict data transfer actions such as copy/paste, screen capture, or saving corporate data to unmanaged apps/cloud services. They work independently of device enrollment, so they remain effective even if the device is a personal phone, directly addressing the concern of safeguarding data in unmanaged apps.

A Conditional Access policy requiring a compliant device acts as a real-time access gate at authentication, checking the device's compliance state reported by Intune against defined compliance policies. It evaluates signals such as enrollment status, device health attestation, and configured security settings, and blocks or allows access to Microsoft 365 or other cloud apps. This is the appropriate control because it enforces device-level access decisions before any session begins.

Data Estate Insights provides monitoring and reporting.

User-defined routes are custom route table entries that allow you to override Azure's automatic system routes for selected subnets. By associating a route table with a subnet and setting the next hop to an NVA's private IP address, you force all matching traffic to be forwarded to that appliance for processing such as inspection or firewall enforcement. This is exactly the routing mechanism needed to steer web application traffic through a network virtual appliance, and it is the only option listed that actively changes packet forwarding behavior.

This is correct because the condition uses 'exists': 'false' on the 'Microsoft.Compute/virtualMachines/enableAutomaticUpdates' field. When a deployment request for a Windows VM omits the enableAutomaticUpdates property, the condition is met and the deny effect blocks the create or update operation. This forces callers to explicitly include the property on the VM resource to pass the policy.

This is the accurate interpretation. The policy definition's condition evaluates the 'Microsoft.Compute/virtualMachines' resource to see if a managed OS disk exists, and if so, it further checks whether the 'storageAccountType' of that managed disk is 'Standard_LRS' or 'Premium_LRS'. When the managed disk exists and its type is not in that allowed list, the policy's 'deny' effect blocks the deployment or update operation. This directly matches the statement, making it the correct answer.

Custom Logs via the Log Analytics agent is the correct solution because the agent provides a native 'Custom Logs' feature that lets you specify a local directory and file mask (e.g., C:\Logs\*.log or /var/log/app/*.txt) to continuously monitor. When a new entry is appended to a matching file, the agent reads it, parses each line using a sample-based custom log definition, and sends the data to a custom table (e.g., MyLog_CL) in the Log Analytics workspace, which Microsoft Sentinel can then query and alert on. This is the built-in method specifically designed to collect existing application-generated log files from Windows or Linux VMs without requiring code changes.

This is the correct cost-performance trade-off: route high-volume, low-value data such as verbose firewall logs, debug traces, and raw DNS events to Basic Logs to slash ingestion costs, while steering critical security alerts and curated detection data into Analytics Logs for full KQL querying, alerting, and hunting workflows. Basic Logs' lower cost and acceptable simple-search capability align perfectly with data that is retained mainly for compliance or ad-hoc troubleshooting, while Analytics Logs' rich analytical features and long retention match the needs of high-priority security detections. Microsoft Sentinel supports this pattern natively by configuring table-level plans, enabling a single workspace to hold both tiers and ensuring that analysts can query the data that matters most with low latency. This balanced design meets both cost optimization and security operational requirements, making it the only viable answer.

Azure Backup with an immutable vault uses Write-Once, Read-Many (WORM) storage, which prevents backups from being deleted, modified, or encrypted by ransomware even if admin credentials are stolen. This ensures you always have a clean, valid recovery point to restore VMs to a pre-infection state. Immutable backups are a critical last line of defense because they isolate recovery data from the attack surface and align with Azure's recommended ransomware protection strategy.

Creating a watchlist of trusted IP addresses and modifying the rule to exclude those IPs directly addresses the source of the false positives without disabling detection. In Sentinel, you can build a watchlist (e.g., via CSV or PowerShell) and then reference it in the analytics rule's KQL query using the `_GetWatchlist` function—for instance, adding a `where IPAddress !in (_GetWatchlist('TrustedIPs'))` clause. This keeps the rule active for all other IPs, ensuring genuine threat-intelligence matches still generate alerts while known benign entities are filtered out, and it allows easy updates to the trusted list without re-editing the rule each time.

The Windows Security Events via Azure Monitor Agent (AMA) connector is purpose-built to stream Windows Event logs from servers and workstations directly into Microsoft Sentinel. Using a Data Collection Rule (DCR), it can collect the Security channel and other event channels, preserving the raw event details for detections and investigations. This is the correct connector when your organization must ingest Windows security events into Sentinel.

Transparent Data Encryption encrypts Azure SQL data at rest at the page level, while enforcing TLS connections protects data in transit. Together they satisfy the requirement to always encrypt data both at rest and in transit.

Conditional Access evaluates device compliance signals from Microsoft Intune and grants or blocks access to cloud apps such as Outlook Mobile accordingly. This satisfies the requirement that only compliant devices reach corporate email, which Intune compliance policies alone cannot enforce.

Microsoft Defender for Cloud is the correct solution because it is a cloud workload protection platform (CWPP) and CSPM tool that natively provides antimalware for Azure VMs. It includes the Microsoft Antimalware extension for real-time scanning and removal of malicious software, and it can integrate with Microsoft Defender for Endpoint for next-generation endpoint detection and response (EDR). It also delivers actionable security recommendations, adaptive application controls, and just-in-time VM access to reduce attack surface and prevent malware. This integrated, proactive protection is exactly what is required to secure Azure VMs against malware.

Custom Indicators (IOCs) is the Microsoft Defender for Endpoint feature that allows tenants to import their own threat intelligence, including file hashes, IP addresses, URLs, domains, and certificates, from external sources. This ingestion can be performed through the Microsoft 365 Defender portal or programmatically via APIs, and the imported indicators are then evaluated during detection and enforcement. Enabling a connector to import IOCs from an external source specifically leverages this feature, as it is the sole mechanism among these options that accepts and manages external indicator data.

This tiered strategy optimizes both security visibility and cost by routing high-value, actionable security logs—such as authentication failures, privilege use, and security events—to Analytics logs where they support advanced KQL queries and alert rules. Simultaneously, verbose logs with low security value, like informational audit entries or diagnostic logs, are sent to Basic logs for occasional queries and compliance. This balances operational effectiveness with budget constraints, ensuring the SOC retains critical detection and investigation capabilities without paying premium analytics costs for every byte of log data.

A retention label is the Purview mechanism that directly enforces retention and deletion behavior on documents, emails, and other content. By creating a retention label with a 7-year retention period and publishing it (or auto-applying it), the organization ensures the record remains immutable and un-deletable during that period, and the label can also trigger a disposition review at expiration. This aligns with regulatory requirements for retaining records. Thus, it is the correct action to preserve the records for the mandated timeframe.

Conditional Access policies are the access-control layer that evaluates the device's compliance state at sign-in. When combined with an Intune compliance policy, the 'Require device to be marked as compliant' grant control forces Azure AD to check the device's compliance status and block access if the device is non-compliant. This is the correct approach because it directly enforces the access requirement for corporate resources, unlike enrollment or configuration policies that only manage settings or enrollment.

Configuring a session policy in Microsoft Defender for Cloud Apps (MDA) is a preventive, real-time DLP control that uses a reverse-proxy architecture to sit between the user and Azure SQL Database. When a user accesses the database through a supported web portal or app, the session policy can apply conditional access and enforce behavioral controls such as blocking clipboard operations (copy, cut, paste) and prohibiting screenshot capture, thereby preventing data exfiltration at the client session level. This goes beyond traditional database permissions and masking because MDA inspects and restricts the user's interactive environment in real time. To be effective, you target the specific app (e.g., Azure Portal or SQL Query Editor) and define policy conditions and actions for sensitive data.

Azure Backup with a VM backup policy precisely matches the requirement: the policy allows a daily, weekly, and monthly retention schedule, with each retention tier preserving recovery points for up to 180 days, 10 years, and 10 years respectively. You can also adjust retention to meet compliance needs, and Azure Backup stores recovery points in the Recovery Services vault. This gives you application-consistent, crash-consistent, or file-consistent snapshots and supports instant restore from snapshots. It is the correct strategy for multi-tier retention of Azure VMs.

An analytics rule with an automated response is the correct option because Microsoft Sentinel's analytics rules not only detect threats and generate incidents but also allow you to attach an automated response, commonly an Azure Logic Apps-based playbook, directly in the rule's 'Incident automation' step. When a high-severity incident is created, that automatic response triggers the playbook, which can send an email via Office 365 Outlook or other connectors. This couples the detection engine with an actionable response workflow, meeting the stated requirement exactly. Unlike workbooks, watchlists, or hunting queries, this is the only option that provides a direct, automatic, and incident-driven notification mechanism.

A sensitivity label with auto-labeling uses Microsoft Purview's sensitive info types, such as credit card numbers, to automatically classify documents when those patterns are detected. The label can be configured with permissions-based encryption (via Azure Rights Management), which protects the content even when shared externally by enforcing view/edit restrictions. This directly satisfies both the classification and external-sharing protection requirements in the scenario.

Connecting AWS and GCP accounts to Defender for Cloud surfaces those resources in Azure Resource Graph, where Azure Policy can apply the Microsoft Cloud Security Benchmark (MCSB), a unified initiative built on CIS/NIST plus Microsoft controls. This gives continuous compliance assessment and enforcement, like DeployIfNotExists remediation, across all clouds. As a result, every subscription or cloud account is measured against the same baseline, regardless of native cloud tooling—this is the only option that both centralizes and enforces a single baseline.

PIM supports approval workflow and logs are retained for auditing.

A Microsoft Purview account is the correct choice because it provides an automated, unified data governance solution that scans and catalogs metadata from all data sources, including on-premises, Azure, AWS, Google Cloud, and SaaS applications. This enables centralized data discovery, classification, lineage, and policy enforcement. Unlike legacy or single-purpose tools, it creates a comprehensive data map for the entire organization.

Microsoft Purview Data Map scanning rules automatically connect to various data sources, both on-premises and multi-cloud, and run scans to profile and classify assets. These rules apply built-in or custom classification patterns—like regex for PII, financial, or health information—and assign sensitivity labels to structured and unstructured data. This is exactly the mechanism that enables data governance by building a searchable, classified inventory of enterprise data, making it the correct choice for a company using Purview.

Cross-tenant access settings in Microsoft Entra ID are the foundational control for managing B2B collaboration with partner organizations. They let you define granular inbound and outbound policies that govern trust claims (e.g., MFA, device compliance, hybrid Azure AD join) and apply Conditional Access scoping per tenant, user, group, or application. This replaces the older, less secure per-tenant manual configurations and provides a cohesive access-control plane for external identities.

Sensitivity labels apply persistent encryption and visual markings directly to content, satisfying the requirement to protect sensitive data at the item level across Microsoft 365 workloads. Unlike perimeter controls, labels travel with the file, enforcing protection even after it leaves the tenant, which is precisely what the scenario demands.

Endpoint data loss prevention (Endpoint DLP) is the correct choice because it installs an agent on Windows and macOS endpoints that inspects data in real time as users interact with files. It can enforce policies to block the copying of sensitive items, such as those matching sensitive info types or trainable classifiers, to removable USB devices, and optionally show a policy tip to the user. This direct, pre-action enforcement provides the precise control needed to prevent data leakage via USB.

A system-assigned managed identity gives the App Service a Microsoft Entra ID (Azure AD) identity that is automatically created with the app and requires no secrets to be stored in code or configuration. You enable Microsoft Entra authentication on the SQL logical server, then run `CREATE USER [<app-name>] FROM EXTERNAL PROVIDER` to map the identity to a database user and grant least-privilege roles like `db_datareader` and `db_datawriter`. The connection uses token-based authentication (for example, `Authentication=ActiveDirectoryManagedIdentity` in the connection string), eliminating credential storage and rotation.

Microsoft Purview Audit is the correct solution because it provides a unified audit log that records user and admin activities across Microsoft 365 services, including file access, permission changes, and sign-ins. Organizations can search and export these audit records from the Purview compliance portal or via Office 365 Management Activity API, enabling security teams to investigate incidents and meet compliance requirements. This capability directly addresses the need to audit user activities.

An Azure Policy definition with audit or deny effects is the correct enforcement mechanism because it evaluates resource properties (such as encryption settings) against rules during provisioning and continuously thereafter. A deny effect blocks deployment of any resource that violates the encryption policy, while an audit effect marks the resource as non-compliant for reporting and follow-up. This approach ensures encryption requirements are consistently applied across new and existing resources, directly closing the configuration gap.

The Authorization Code Flow with PKCE is the recommended OAuth 2.0 grant for web applications that access APIs on behalf of a user. It starts with a user interactive authentication, then the app exchanges an authorization code for tokens, and PKCE (Proof Key for Code Exchange) adds a cryptographic verifier to prevent code interception attacks. Also, it supports refresh tokens, allowing long-lived access without re-authentication.

Lifecycle workflows in Microsoft Entra ID Governance automate joiner, mover, and leaver tasks based on events or schedules. A leaver workflow can disable the account, remove group and application assignments, and send notifications to the manager, which matches the requirement to revoke access immediately and notify the manager without help desk involvement.

Microsoft Entra ID Protection actively monitors user and sign-in risk using machine learning, heuristic analysis, and Microsoft's threat intelligence feeds. Enabling risk-based policies (which are a type of Conditional Access policy using risk as a condition) allows automatic remediation, such as requiring MFA, blocking the sign-in, or forcing a secure password change. This directly addresses the need to detect risky identities and respond without manual intervention, making it the correct choice for identity-based threat detection and auto-remediation.

Using Azure AD Workload Identity for each pod assigns a unique Azure AD identity to each Kubernetes service account via federated identity credentials and the cluster's OIDC issuer. The pod's service account token is exchanged for an Azure AD token that grants access to Azure SQL Database without storing any secrets in the cluster. This enables per-microservice least-privilege access, supports conditional access and audit logs, and is the modern, secure replacement for service principals and node-level managed identities.

Entra ID Protection (P2) uses machine learning to continuously evaluate sign-in and user risk, assigning risk levels and enabling Conditional Access to require MFA or block high-risk attempts. Sentinel then ingests these risk detections, along with other identity logs, into a central SIEM that provides long-term retention, advanced hunting through KQL, and analyst workflow for investigation. Together they deliver both the real-time detection and the centralized visibility needed by a global financial services security team.

Microsoft Defender for DevOps is a dedicated service that integrates directly with Azure DevOps (and GitHub) to provide continuous security scanning of code, secrets, infrastructure-as-code templates, and open-source dependencies. It leverages built-in scanners like Credential Scanner and integrates with Defender for Cloud to aggregate findings across the software development life cycle. This makes it the correct choice for an Azure DevOps-centric organization seeking DevOpsSec capabilities.

TLS 1.0 is deprecated and no longer considered secure; Azure Storage requires customers to enforce at least TLS 1.2 for all data plane access. By setting the 'minimumTlsVersion' property to 'TLS1_2', the account will reject any client connections attempting to use TLS 1.0 or 1.1. This is a distinct control from HTTPS enforcement, but it is the configuration that directly addresses the requirement to prevent outdated protocol usage.

Microsoft Sentinel has a built-in data connector for Azure Active Directory (now Microsoft Entra ID) that streams sign-in logs and audit logs into the SigninLogs and AuditLogs tables. This connector is a first-party, low-latency ingestion path for identity telemetry, enabling detection of risky sign-ins, MFA failures, and privilege escalation. Because identity is a primary attack surface, this connector is a standard and correct choice for Sentinel data sources.

A Microsoft Intune device compliance policy defines the exact security and configuration standards that a device must meet to be considered compliant, such as requiring encryption, a minimum OS version, no jailbreak/root, or a healthy threat agent score. The policy assigns a compliance state (compliant/non-compliant) for each enrolled device, and that state is then published to Entra ID. This policy is the foundation of device-based access control because it establishes the authoritative criteria that determine whether a device should be trusted.

Playbooks are Azure Logic Apps workflows that can be automatically invoked by automation rules to perform enrichment operations on an incident, such as querying Threat Intelligence platforms like MISP or Microsoft Graph Security API. By pulling threat intel about involved entities (IPs, hashes, domains) and writing those findings back to the incident, playbooks give analysts and automated rules the context needed to rapidly triage and prioritize low-severity incidents without manual querying.

The security domain contains the encrypted material needed to reconstruct the HSM's master key, which in turn wraps all keys and protects the HSM's configuration. Downloading it creates a backup that, along with the quorum of security domain keys, can restore the HSM to a usable state after a disaster. This is why the security domain is essential for disaster recovery of the managed HSM.

Diagnostic settings on the Azure Activity Log are the correct mechanism because the Activity Log itself records every control-plane operation—such as resource creation, deletion, and configuration changes—for your Azure resources. By configuring a diagnostic setting on this log, you can stream those management events directly into a Log Analytics workspace, enabling centralized querying, alerting, and long-term retention for security auditing. This is the built-in, supported way to capture and route resource-level change activity to your security monitoring pipeline.

In a zero-trust model, network traffic is secured by enforcing conditional access policies that require real-time authentication and authorisation for every packet flow, rather than relying on implicit trust from network location. This satisfies the stem’s constraint of eliminating inherent trust by mandating explicit verification per request, typically implemented through Microsoft Entra ID’s continuous access evaluation and micro-segmentation rules.

A scheduled analytics rule is the core detection primitive in Microsoft Sentinel. It defines a KQL query, a query frequency (how often to run), a lookback period (how much historical data to examine), and an alert threshold or result condition. When the query returns results on the schedule, the rule creates a security alert, optionally with entity mapping for investigation and automated responses. This is precisely the mechanism Sentinel uses for always-on, time-based threat detection across your workspace.

The Microsoft Purview Information Protection scanner is a forensic data-discovery engine that runs on Windows Server and scans on-premises repositories, including file shares, SharePoint Server, and SQL Server, for sensitive content. Using built-in or custom sensitive information types, it detects PII such as passport numbers, addresses, and bank details, and can automatically apply sensitivity labels via the same label administration used across Microsoft 365. It supports both discover-and-report and enforce modes, and its results feed into analytics and DLP policy evaluation. This makes it a correct choice because it directly scans content and applies protection at the data source.

Risk-based prioritization that scores asset criticality, threat severity, and business impact is the industry-standard approach because it translates raw signals into actionable decisions aligned with organizational value. By quantifying each alert's potential damage against the importance of the affected system, security operations teams can focus containment and investigation resources on events most likely to cause significant harm. This method also supports continuous improvement by allowing thresholds to be tuned based on telemetry and incident outcomes.

Data Loss Prevention (DLP) policies in Microsoft Purview are the correct inline control to block sharing of sensitive information. They use built-in sensitive info types (e.g., credit card numbers, personally identifiable information) and trainable classifiers to evaluate content in real time, then enforce actions such as 'Block' with the option to allow overrides for Exchange, SharePoint, OneDrive, and endpoints. By applying conditions like 'sharing with people outside the organization,' DLP can prevent the sharing action before any data leaves the tenant, making it the only option here that directly provides ex-ante prevention rather than detection or classification.

Security Defaults in Microsoft Entra ID automatically enforce MFA for all users and block legacy authentication, providing a strong baseline without extra licensing or complex policy setup. Defender for Office 365 protects against phishing, malware, and malicious links in email, which is critical for small businesses that rely heavily on email communication. Defender for Business is included in Microsoft 365 Business plans and provides managed endpoint protection tailored to smaller organizations. Regularly reviewing the Secure Score helps prioritize low-effort, high-impact security improvements that align with the business's actual risk profile.

Microsoft Defender XDR unifies signals across the Microsoft 365 ecosystem—Defender for Endpoint, Office 365, Identity, and Cloud Apps—into a single incident queue with automated investigation and response. It correlates kill-chain events across domains, enabling security teams to monitor and respond to threats holistically. This cross-domain correlation and built-in response automation are exactly what is required for organization-wide threat monitoring and response.

A compliance policy in Intune evaluates a device's health attributes—including whether its OS version meets the minimum required for that platform—and simply marks the device compliant or non-compliant. That compliance status is then consumed by a Conditional Access policy as a grant control, which, at the time of every authentication request, rejects access for non-compliant devices (or requires additional steps like re-enrollment or OS update). This combination is the actual enforcement chain: the compliance policy identifies the OS-version gap, and Conditional Access blocks the user's access accordingly.

Sensitive information types detect content patterns such as credit card or national insurance numbers, so Microsoft Purview Information Protection can auto-apply labels without user input. This satisfies the requirement for automatic, content-based labelling rather than manual or default labelling.

A Conditional Access policy is the correct approach because it uses application-based conditions to require MFA selectively for sensitive apps while allowing other apps to use less restrictive authentication. In a hybrid environment, this integrates with on-premises applications via Azure AD Application Proxy or federated trusts, and supports session controls like sign-in frequency. This granularity aligns with the Zero Trust principle of least privilege, unlike tenant-wide or user-wide MFA enforcement.

Intune Device Compliance policies for iOS/iPadOS evaluate a device against rules such as minimum OS version, jailbreak/root detection, and required encryption to determine a compliant or non-compliant state. This assessment runs on an ongoing basis (check-in) and integrates directly with Conditional Access for blocking access to cloud resources until compliant. That's why a compliance policy is the correct choice for assessing conditions like minimum OS version and jailbreak status.

Requiring multi-factor authentication for all users directly enforces the zero-trust principle of verify explicitly, ensuring every sign-in is validated rather than trusted by network location. It satisfies the stem's identity-strategy constraint by adding a possession factor to credentials, blocking compromised-password attacks that single-factor authentication would otherwise permit.

The 'AgentlessVmScanning' extension cannot be declared as a child property of the Microsoft.Security/pricings resource. In Azure Resource Manager (ARM) and Bicep, agentless scanning for virtual machines is enabled by defining a separate resource of type Microsoft.Security/vmScanners, which holds the scanner configuration such as 'scanningMode' and exclusion tags. Attempting to place it within the pricing resource's properties.extensions array will cause a validation error because that extension is not a valid member of the pricing schema. Therefore, the deployment fails unless the extension is moved to its own top-level resource definition.

The Azure Activity Log records every control-plane write operation (create, update, delete) on Azure resources, including the caller identity, timestamp, operation name, and resource ID—precisely the data required for change auditing. Azure Monitor provides a unified platform to query and analyze these logs via Log Analytics, configure alerts on specific changes, and export them to storage or event hubs for retention. This combination yields a comprehensive, queryable audit trail of all resource modifications, making it the correct foundational service for auditing every change to Azure resources.