Scenario practice questions

Defense in depth

Why wrong: Defense in depth uses multiple layers of security controls (e.g., firewall, antivirus, encryption) to protect assets, not specifically limiting permissions per role.

Zero Trust

Why wrong: Zero Trust is a security model that assumes no implicit trust and continuously verifies every request, but it is broader than just limiting permissions.

Separation of duties

Why wrong: Separation of duties involves dividing critical tasks among multiple individuals to reduce risk of fraud or error, not about limiting individual permissions.

Integrity

Why wrong: Integrity focuses on preventing unauthorized modifications, not on restricting access to authorized parties.

Availability

Why wrong: Availability ensures that systems and data are accessible when needed, not specifically that access is limited to authorized users.

Non-repudiation

Why wrong: Non-repudiation provides assurance that a user cannot deny an action, often through digital signatures, but does not govern access control.

Require device to be marked as compliant

Why wrong: Incorrect. While this control can enforce device compliance (e.g., Intune), the scenario does not mention a need for device compliance; it only specifies unmanaged device status (which is a condition, not a grant). The requirement is for MFA from unmanaged devices, which is handled by the 'Require MFA' grant.

Require approved client app

Why wrong: Incorrect. This grant control restricts access to only specific client applications (e.g., Microsoft apps like Outlook). The scenario does not mention any need to limit the client application type.

Only Device state and Locations

Why wrong: This configuration does not include Sign-in risk, which is necessary to block access when sign-in risk is high.

Only Sign-in risk and Device state

Why wrong: This configuration omits Locations, which is required to restrict access to trusted IP ranges.

Only Locations and Sign-in risk

Why wrong: This configuration ignores the device compliance requirement, so unmanaged devices would not be blocked.

Microsoft Defender for Endpoint

Why wrong: Incorrect. Defender for Endpoint protects endpoints from malware and attacks but does not manage OAuth app permissions in cloud apps.

Microsoft Defender for Office 365

Why wrong: Incorrect. Defender for Office 365 protects against threats in email, Teams, and SharePoint, but does not cover third-party cloud apps like Salesforce.

Microsoft Sentinel

Why wrong: Incorrect. Sentinel is a SIEM that can ingest logs from various sources and create detection rules, but it does not have built-in OAuth app governance policies.

Identification

Why wrong: Identification is the process of claiming an identity (e.g., presenting the card ID), not the subsequent check of permissions.

Authentication

Why wrong: Authentication verifies that the identity claim is genuine, often through a password or biometric. Here, the system is not verifying the card's authenticity; it is checking the ID against a permission list.

Non-repudiation

Why wrong: Non-repudiation ensures that a party cannot deny an action, often using digital signatures. It is not demonstrated in this simple key card scenario.

Microsoft Entra ID Governance

Why wrong: Entra ID Governance focuses on identity lifecycle, access certifications, and entitlement management, not on risk detection and automated responses.

Microsoft Entra Privileged Identity Management (PIM)

Why wrong: PIM manages time-bound access to privileged roles and monitors role activations, but does not detect general identity risks like leaked credentials.

Microsoft Entra Domain Services

Why wrong: Entra Domain Services provides domain services (join, group policy) for Azure VMs without a domain controller, not identity risk detection.

Authentication

Why wrong: Authentication is the process of verifying the user's identity (e.g., password and MFA). The denial occurs after authentication, so this is not the correct concept.

Non-repudiation

Why wrong: Non-repudiation ensures that a party cannot deny having performed an action, often through auditing or digital signatures. This scenario does not involve denying actions.

Accounting

Why wrong: Accounting (or auditing) refers to tracking user activities for monitoring and billing. The access denial is not about logging or tracking actions.

Authentication

Why wrong: Authentication verifies identity but does not control access to specific resources based on permissions.

Accounting

Why wrong: Accounting involves tracking and logging user activities for auditing, not managing resource access permissions.

Non-repudiation

Why wrong: Non-repudiation ensures that a user cannot deny having performed an action (e.g., via digital signatures), which is not related to access control.

A

Why wrong: Defense in depth involves multiple layers of security controls (e.g., firewall, antivirus, access control) but does not inherently reject trust from internal networks.

B

Why wrong: Principle of least privilege focuses on granting only the minimum necessary permissions, not on verifying every request regardless of source.

D

Why wrong: Shared responsibility model describes the division of security responsibilities between a cloud provider and the customer, not a specific security architecture.

Configuring the operating system firewall on each VM

Why wrong: Configuring the OS-level firewall is a customer responsibility, as the customer manages the guest OS.

Installing and patching the application software

Why wrong: The customer is responsible for managing and patching application software deployed on IaaS VMs.

Managing user access to the application

Why wrong: Identity and access management for the application is the customer's responsibility.

Least privilege

Why wrong: Least privilege is about granting users only the minimum permissions needed, not about multiple layers of control.

Separation of duties

Why wrong: Separation of duties divides critical tasks among multiple people to prevent fraud or error, not a layered defense strategy.

Zero trust

Why wrong: Zero trust is a security model that assumes no implicit trust and continuously verifies every request, but it is not specifically about multiple layers of controls.

Microsoft is responsible because they provide the cloud service and must protect against all threats.

Why wrong: Microsoft secures the cloud infrastructure, but the customer is accountable for their own accounts and devices.

Both Microsoft and the customer share equal responsibility for all layers of the service.

Why wrong: Responsibility is split: Microsoft for infrastructure (physical, network, host), customer for their own data, identities, and devices.

Neither party is responsible because the employee bypassed security controls.

Why wrong: The employee may have made an error, but overall accountability for endpoint and identity security lies with the customer organization.

Confidentiality

Why wrong: Confidentiality ensures data is accessible only to authorized users; encryption provides this, but the verification of no alteration is about integrity.

Availability

Why wrong: Availability ensures data and systems are accessible when needed; the scenario does not relate to availability.

Non-repudiation

Why wrong: Non-repudiation prevents denial of actions (e.g., sending a message), but verifying content unchanged is about integrity, not non-repudiation.

Defense in depth

Why wrong: Defense in depth is a strategy that layers multiple security controls (e.g., firewalls, antivirus, access controls) to protect against threats. While important, it does not define the division of responsibilities between a cloud provider and customer.

Zero Trust

Why wrong: Zero Trust is a security model that assumes no implicit trust and verifies every access request regardless of origin. It does not specifically define provider/customer responsibilities.

Least privilege

Why wrong: Least privilege is an identity and access management principle where users are granted only the permissions necessary to perform their job functions. It is not about cloud provider responsibilities.

Least privilege

Why wrong: Incorrect. While JIT access aligns with least privilege, the specific mechanism of temporary permission grants on demand is JIT, not the general principle of minimal permanent permissions.

Defense in depth

Why wrong: Incorrect. Defense in depth involves multiple overlapping layers of security (e.g., firewall, AV, encryption). The scenario describes a single access control technique.

Zero Trust

Why wrong: Incorrect. Zero Trust is a comprehensive security model that includes continuous verification and micro-segmentation. JIT access is a component that supports Zero Trust, but the scenario best illustrates JIT itself.

Least privilege

Why wrong: Least privilege is a security principle that grants users the minimum level of access needed to perform their job. While RBAC often helps achieve least privilege, the scenario specifically describes assigning permissions by job role, which is RBAC.

Defense in depth

Why wrong: Defense in depth is a security strategy that uses multiple layers of controls. It does not refer to role-based permission assignment.

Zero Trust

Why wrong: Zero Trust is a security model that assumes no implicit trust and verifies every access request. It is broader than role-based assignment.

Segregation of duties

Why wrong: Segregation of duties requires more than one person to complete a sensitive task (e.g., one person requests a purchase, another approves). The scenario does not mention splitting tasks.

Defense in depth

Why wrong: Defense in depth uses multiple layers of security (firewalls, antivirus, etc.). The scenario focuses on limiting permissions, not layering protections.

Zero Trust

Why wrong: Zero Trust is a security model that never trusts any request by default, regardless of origin. While least privilege is a component of Zero Trust, the scenario does not include other Zero Trust elements like continuous verification.

Zero Trust

Why wrong: Zero Trust is a security model that focuses on verifying every request as though it originates from an untrusted network, but the scenario does not mention the core pillars of Zero Trust (verify explicitly, least privilege, assume breach). It simply lists multiple layers.

Least privilege

Why wrong: Least privilege is about providing users only the minimum access needed to perform their jobs, not about multiple defensive layers.

CIA triad

Why wrong: The CIA triad (Confidentiality, Integrity, Availability) is a set of security objectives, not a strategy for implementing multiple layers of control.

Identification and authorization

Why wrong: Identification is simply claiming an identity (e.g., by providing a username). The smart card and PIN are used to prove identity (authentication), not just claim it.

Authentication and accounting

Why wrong: Accounting tracks user activities for auditing or billing purposes. The scenario focuses on access control, not tracking.

Identification and authentication

Why wrong: While both identification and authentication occur, the scenario also includes authorization. The denial of access is an authorization decision, so the full set of concepts is authentication and authorization.