Community Q&A
SC-100 — frequently asked questions
Community-vetted answers to 9 common questions about this exam, each traced back to a specific practice question.
Questions from real practice questions
Each Q&A comes from a specific question — follow the link for the full analysisMCRA Zero Trust Methodology Drag and Drop
Why is Business Continuity linked to Assume Breach?
Because assuming a breach means planning for inevitable attacks; business continuity ensures operations survive such events.
Is Segmenting Access part of Least Privilege?
Yes, in the MCRA framework, segmenting access limits lateral movement, which is a key aspect of enforcing least privilege.
Mitigating Privileged Account Attacks with Fake Cached Credentials
Why not use Microsoft Defender for Endpoint for fake credentials?
Defender for Endpoint creates decoy files/folders. For cached credentials, which are identity attributes synced via AD, Microsoft Defender for Identity is the specialized tool.
What is a Honeytoken tag in MDI?
It is a configuration in Microsoft Defender for Identity that allows administrators to deploy decoy accounts or credentials to detect unauthorized access attempts.
MCRA Job Role Security Level Configuration
Where can I find the MCRA role mapping?
The mapping is detailed in the Microsoft Cybersecurity Reference Architectures (MCRA) PowerPoint deck, typically on slides ranging from 59 to 100 depending on the version.
Why are developers not privileged accounts?
Developers do not require broad administrative control over production environments; assigning them to specialized accounts enforces the principle of least privilege and reduces insider threat risk.
Enable NIST 800-53 Compliance Assessment in Defender for Cloud
Why does NIST 800-53 not appear in the Defender for Cloud compliance dashboard by default?
Defender for Cloud enables only the Microsoft Cloud Security Benchmark standard on new subscriptions. NIST 800-53 Rev. 5 is an optional security standard that must be enabled per subscription, management group, or blueprint before assessments and dashboard results appear.
Is NIST 800-53 compliance in Defender for Cloud implemented with Azure Policy?
Yes. Enabling the NIST 800-53 standard assigns a built-in Azure Policy initiative behind the scenes. However, the correct first action in this scenario is enabling the standard from Defender for Cloud, which guarantees correct scoping and dashboard reporting.
Can secure score be used to check NIST 800-53 compliance?
No. Secure score recommendations are tied to the Microsoft Cloud Security Benchmark controls. Regulatory compliance against NIST 800-53 is measured only in the regulatory compliance dashboard after the standard is enabled.