Microsoft SC-100 Exam (page: 8)
Microsoft Cybersecurity Architect
Updated on: 25-Dec-2025

Explanation:

Reference:

Box 1: Microsoft Defender for Cloud
Use the Microsoft Cloud Adoption Framework for Azure to evaluate compliance with cloud governance policies.

Microsoft Cloud Adoption Framework for AzureTo evaluate compliance with cloud governance policies in Azure when using the Microsoft Cloud Adoption Framework (CAF), you should use Azure Policy and Microsoft Defender for Cloud. Azure Policy enforces your defined rules on resources and provides a compliance dashboard, while Defender for Cloud offers a unified view of security and security recommendations to help meet compliance standards.

Enhance with Microsoft Defender for Cloud:
Use Defender for Cloud to gain a unified view of security posture across your workloads. It provides actionable recommendations to fix security issues, helping to improve your compliance with security standards and regulations.

Box 2: Microsoft Defender Vulnerability
Use the Azure Well-Architected Framework to secure individual workloads.

Microsoft Defender Vulnerability Management (a component of Microsoft Defender for Cloud) is used to secure workloads on Azure by identifying, prioritizing, and helping to remediate vulnerabilities, directly aligning with the Security pillar of the Azure Well-Architected Framework. The framework provides a holistic guidance structure, and Defender Vulnerability Management provides a practical tool for implementing security best practices to protect individual workloads and critical assets.


https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ready/azure-setup-guide/govern-org- compliance

Explanation:

Box 1: Defender for Cloud
For the AWS EC2 instances:

Scenario:
Requirements:
AWS Requirements
Fabrikam identifies the following security requirements for the data hosted in ContosoAWS1:

*-> Notify security administrators at Fabrikam if any AWS EC2 instances are noncompliant with secure score recommendations.
* Ensure that the security administrators can query AWS service logs directly from the Azure environment.

Note: Secure score in Defender for Cloud
The secure score in Microsoft Defender for Cloud can help you to improve your cloud security posture. The secure score aggregates security findings into a single score so that you can assess, at a glance, your current security situation. The higher the score, the lower the identified risk level is.

View the secure score
When you view the Defender for Cloud Overview dashboard, you can view the secure score for all of your environments. The dashboard shows the secure score as a percentage value and includes the underlying values.



Box 2: Microsoft Sentinel
For the AWS service logs:

Scenario:
Requirements:
AWS Requirements

Fabrikam identifies the following security requirements for the data hosted in ContosoAWS1:

* Notify security administrators at Fabrikam if any AWS EC2 instances are noncompliant with secure score recommendations.
*-> Ensure that the security administrators can query AWS service logs directly from the Azure environment.

Use the Amazon Web Services (AWS) connectors to pull AWS service logs into Microsoft Sentinel.

Note: These connectors work by granting Microsoft Sentinel access to your AWS resource logs. Setting up the connector establishes a trust relationship between Amazon Web Services and Microsoft Sentinel. This is accomplished on AWS by creating a role that gives permission to Microsoft Sentinel to access your AWS logs.

Note:

Existing Environment:
Partners

Fabrikam has contracted a company named Contoso, Ltd. to develop applications. Contoso has the following infrastructure:

A Microsoft Entra tenant named contoso.onmicrosoft.com

An Amazon Web Services (AWS) implementation named ContosoAWS1 that contains AWS EC2 instances used to host test workloads for the applications of Fabrikam

Reference:

https://learn.microsoft.com/en-us/azure/defender-for-cloud/secure-score-security-controls https://docs.microsoft.com/en-us/azure/defender-for-cloud/recommendations-reference-aws https://docs.microsoft.com/en-us/azure/sentinel/connect-aws

Explanation:

Box 1: Workflow automation
To enforce compliance to the regulatory standard, create:

Scenario: Requirements. Compliance Requirements
Fabrikam wants to automatically remediate the virtual machines in Sub1 to be compliant with the HIPAA HITRUST standard.

Note: Run a HIPAA HITRUST 9.2 Regulatory Compliance Report for Azure In Azure, the HIPAA HITRUST 9.2 framework offers a comprehensive set of predefined compliance and security checks for the Health Insurance Portability and Accountability Act. These checks encompass various domains and controls, including administrator and operator logs, audit logging, privilege management, and more.

With the pre-built workflow below, you can generate 20 reports simultaneously, and have the results conveniently delivered via email.

Box 2: Modify an Azure policy definition
To exclude TestRG from the compliance assessment:

Scenario: The virtual machines in TestRG must be excluded from the compliance assessment.

Use a Policy definition to include the TestRG virtual machines from the Blueprint.

Note: Azure Policy establishes conventions for resources. Policy definitions describe resource compliance conditions and the effect to take if a condition is met. A condition compares a resource property field or a value to a required value. Resource property fields are accessed by using aliases.
When a resource property field is an array, a special array alias can be used to select values from all array members and apply a condition to each one.

By defining conventions, you can control costs and more easily manage your resources. For example, you can specify that only certain types of virtual machines are allowed. Or, you can require that resources have a particular tag. Policy assignments are inherited by child resources. If a policy assignment is applied to a resource group, it's applicable to all the resources in that resource group.


Incorrect:
* Not Update a policy assignment
A policy assignment assigns a Blueprint to a subscription. The scope is at the subscription level.

Note: Policy Assignments provide a means for applying policy to a subscription to which a blueprint is assigned. That said, the policy must be within the scope of the blueprint containing the policy. Parameters defined with a policy are assigned during blueprint creation or during blueprint assignment.

Reference:

https://www.blinkops.com/blog/azure-workflow-automation https://k21academy.com/microsoft-azure/azure-rbac-vs-azure-policies-vs-azure-blueprints/

Explanation:

Box 1: Microsoft Defender for servers
Scenario: Notify security administrators at Fabrikam if any AWS EC2 instances are noncompliant with secure score recommendations.

Defender for Servers is one of the enhanced security features available in Microsoft Defender for Cloud. You can use it to add threat detection and advanced defenses to your Windows and Linux machines that exist in hybrid and multicloud environments.

Available Defender for Server plans
Defender for Servers offers you a choice between two paid plans. Both include automatic onboarding for resources in Azure, AWS, GCP.



Plan 1 includes the following benefits:

Automatic onboarding for resources in Azure, AWS, GCP
Microsoft threat and vulnerability management
Flexibility to use Microsoft Defender for Cloud or Microsoft 365 Defender portal A Microsoft Defender for Endpoint subscription that includes access to alerts, software inventory, Vulnerability Assessment and an automatic integration with Microsoft Defender for Cloud.

Plan 2 includes everything in Plan 1 plus some additional benefits.

Box 2: Microsoft Sentinel
Scenario: AWS Requirements
Fabrikam identifies the following security requirements for the data hosted in ContosoAWS1:
Ensure that the security administrators can query AWS service logs directly from the Azure environment.

Use the Amazon Web Services (AWS) connectors to pull AWS service logs into Microsoft Sentinel.

Note: These connectors work by granting Microsoft Sentinel access to your AWS resource logs. Setting up the connector establishes a trust relationship between Amazon Web Services and Microsoft Sentinel. This is accomplished on AWS by creating a role that gives permission to Microsoft Sentinel to access your AWS logs.

Reference:

https://docs.microsoft.com/en-us/azure/defender-for-cloud/defender-for-servers-introduction https://docs.microsoft.com/en-us/azure/defender-for-cloud/recommendations-reference-aws https://docs.microsoft.com/en-us/azure/sentinel/connect-aws

Explanation:

(A) Enable vulnerability scanning with the integrated Qualys scanner A core component of every cyber risk and security program is the identification and analysis of vulnerabilities.
Defender for Cloud regularly checks your connected machines to ensure they're running vulnerability assessment tools.
When a machine is found that doesn't have a vulnerability assessment solution deployed, Defender for Cloud generates the security recommendation: Machines should have a vulnerability assessment solution. Use this recommendation to deploy the vulnerability assessment solution to your Azure virtual machines and your Azure Arc-enabled hybrid machines.
Deploying Microsoft Defender for Endpoint is a two-step process.
(B) Onboard devices to the service
Configure capabilities of the service
Scenario: 20 virtual machines (B, not D) that are configured as application servers and are NOT onboarded to Microsoft Defender for Cloud.

Existing Environment:
Problem Statements
The secure score in Defender for Cloud shows that all the virtual machines generate the following recommendation: Machines should have a vulnerability assessment solution.
All the virtual machines must be compliant in Defender for Cloud.

Reference:

https://docs.microsoft.com/en-us/azure/defender-for-cloud/deploy-vulnerability-assessment-vm

Explanation:

Box 1: A blueprint
Scenario: Requirements. Compliance Requirements
Fabrikam wants to automatically remediate the virtual machines in Sub1 to be compliant with the HIPAA HITRUST standard.

Microsoft releases automation for HIPAA/HITRUST compliance
I am excited to share our new Azure Security and Compliance Blueprint for HIPAA/HITRUST Health Data & AI. Microsoft's Azure Blueprints are resources to help build and launch cloud-powered applications that comply with stringent regulations and standards. Included in the blueprints are reference architectures, compliance guidance and deployment scripts.

An Azure Blueprint is a package for creating specific sets of standards and requirements that govern the implementation of Azure services, security, and design. Such packages are reusable so that consistency and compliance among resources can be maintained.


Incorrect:
* not Workflow automation
Workflow automation is an approach to making the flow of tasks, documents and information across work- related activities perform independently in accordance with defined business rules.

Box 2: Modify an Azure policy definition
Scenario: The virtual machines in TestRG must be excluded from the compliance assessment.

Use a Policy definition to include the TestRG virtual machines from the Blueprint.

Note: Azure Policy establishes conventions for resources. Policy definitions describe resource compliance conditions and the effect to take if a condition is met. A condition compares a resource property field or a value to a required value. Resource property fields are accessed by using aliases.
When a resource property field is an array, a special array alias can be used to select values from all array members and apply a condition to each one.

By defining conventions, you can control costs and more easily manage your resources. For example, you can specify that only certain types of virtual machines are allowed. Or, you can require that resources have a particular tag. Policy assignments are inherited by child resources. If a policy assignment is applied to a resource group, it's applicable to all the resources in that resource group.


Incorrect:
* Not Update a policy assignment
A policy assignment assigns a Blueprint to a subscription. The scope is at the subscription level.

Note: Policy Assignments provide a means for applying policy to a subscription to which a blueprint is assigned. That said, the policy must be within the scope of the blueprint containing the policy. Parameters defined with a policy are assigned during blueprint creation or during blueprint assignment.

Reference:

https://azure.microsoft.com/en-us/blog/microsoft-releases-automation-for-hipaa-hitrust-compliance/ https://cloudacademy.com/blog/what-are-azure-blueprints/
https://k21academy.com/microsoft-azure/azure-rbac-vs-azure-policies-vs-azure-blueprints/

Explanation:

Box 1: Azure Policy initiatives to management groups
If your organization has many Azure subscriptions, you may need a way to efficiently manage access, policies, and compliance for those subscriptions. Management groups provide a governance scope above subscriptions. You organize subscriptions into management groups the governance conditions you apply cascade by inheritance to all associated subscriptions.

If you plan to apply a policy definition to multiple subscriptions, the location must be a management group that contains the subscriptions you assign the policy to. The same is true for an initiative definition.

With an initiative definition, you can group several policy definitions to achieve one overarching goal. An initiative evaluates resources within scope of the assignment for compliance to the included policies.


Incorrect:
Not: Azure Policy initiatives to subscriptions
Must use a management group as we have multiple subscriptions.

Scenario:
Requirements:
Business Requirements
Litware identifies the following business requirements:

· Minimize any additional on-premises infrastructure.
· Minimize the operational costs associated with administrative overhead.

Box 2: Azure Arc
With Azure Arc:

Meet governance and compliance standards for apps, infrastructure, and data with Azure Policy.

Take advantage of elastic scale, consistent on-premises and multicloud management, and cloud-style billing models.

Note: Azure Arc is a bridge that extends the Azure platform to help you build applications and services with the flexibility to run across datacenters, at the edge, and in multicloud environments. Develop cloud-native applications with a consistent development, operations, and security model. Azure Arc runs on both new and existing hardware, virtualization and Kubernetes platforms, IoT devices, and integrated systems.

Reference:

https://docs.microsoft.com/en-us/azure/governance/management-groups/overview https://azure.microsoft.com/en-us/services/azure-arc/#product-overview