SC-100 Certification Practice Question #15

Question

You are planning the security levels for a security access strategy.

You need to identify which job roles to configure at which security levels. The solution must meet security best practices of the Microsoft Cybersecurity Reference Architectures (MCRA).

Which security level should you configure for each job role? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Accepted Answer

MCRA's privileged-access security levels define a three-tier model. MS Learn states verbatim that Specialized security covers "Developers of business critical systems," that Privileged security covers "IT Admins with access to most or all enterprise systems," and that Enterprise security is for "all enterprise users and productivity scenarios" — which maps a standard user to Enterprise, a developer to Specialized, and an IT administrator to Privileged. The highest-voted comment (👍 18) and a Nov-2025 exam confirmation back this exact mapping. Confidence is 88% (HOTSPOT confidently resolved) rather than higher because a later MCRA slide places developers/admins ambiguously across two levels, but the canonical MS Learn role examples are unambiguous for these three roles.

More SC-100 practice questions