SC-100 Certification Practice Question #21

Question

You have legacy operational technology (OT) devices and IoT devices.

You need to recommend best practices for applying Zero Trust principles to the OT and IoT devices based on the Microsoft Cybersecurity Reference Architectures (MCRA). The solution must minimize the risk of disrupting business operations.

Which two security methodologies should you include in the recommendation? Each correct answer presents part of the solution.

NOTE: Each correct selection is worth one point.

Accepted Answer

The requirement to "minimize the risk of disrupting business operations" is the deciding constraint. Microsoft's OT/IoT Zero Trust discipline states the short-term priority is passive network monitoring and warns that active scanning can crash legacy OT systems, while MCRA's OT security hygiene lists threat monitoring (with passive TAP/SPAN collection) and explicitly notes that software patching "aren't practical or fully effective in an OT environment." That eliminates A (active scanning) and C (patching) as disruptive, leaving B (threat monitoring) and D (passive traffic monitoring) as the two non-disruptive methodologies. The 43-vote Most Voted BD and the 24-👍 Highly Voted comment align with MS Learn. The page's Suggested Answer lists only D, but the question demands two selections, so BD is the complete answer; the BC minority is discounted because patching is inherently disruptive and only "selectively applied" in OT. High agreement across docs and community yields 90%.

More SC-100 practice questions