SC-100 Certification Practice Question #17

Question

For a Microsoft cloud environment, you are designing a security architecture based on the Microsoft Cybersecurity Reference Architectures (MCRA).

You need to protect against the following external threats of an attack chain:

•	An attacker attempts to exfiltrate data to external websites.
•	An attacker attempts lateral movement across domain-joined computers.

What should you include in the recommendation for each threat? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Accepted Answer

Per MCRA and MS Learn, Microsoft Defender for Cloud Apps (a CASB) is the recommended control for data exfiltration — it can block downloads, control access to cloud resources, and prevent employees from exfiltrating sensitive files to external/unsanctioned destinations. Microsoft Defender for Identity monitors on-premises Active Directory traffic and explicitly detects lateral-movement techniques (pass-the-ticket, pass-the-hash, remote code execution) across domain-joined computers. The 84-👍 top comment, the 7-👍 OCHT comment, and multiple Learn references all agree. The MDO-for-box-1 dissent is discounted because Defender for Office 365 targets email/SharePoint phishing and malware, not web-based data exfiltration.

More SC-100 practice questions