Task 1.2: Design solutions that align with the Microsoft Cybersecurity Reference Architectures (MCRA) and Microsoft Cloud Security Benchmark (MCSB)

• AThe Microsoft cloud security benchmark and its Azure Policy built-in definitions for each control

  Incorrect

  The benchmark is a catalog of security controls and implementation guidance, not a set of end-to-end capability diagrams across OT, IoT and AI.

• BMicrosoft Secure Score for the tenant

  Incorrect

  Secure Score measures posture against recommended actions; it isn't an architecture reference.

• CThe Cloud Adoption Framework's Secure methodology

  Incorrect

  CAF Secure guides security through the cloud adoption lifecycle; it doesn't provide the cross-platform capability map described here.

• DThe Microsoft Cybersecurity Reference Architectures (MCRA)

  Correct

  MCRA is a set of technical reference architectures for end-to-end Zero Trust security across the hybrid of everything estate, with capability diagrams and mappings to standards and roles.

The Microsoft Cybersecurity Reference Architectures describe end-to-end security for an estate that spans legacy IT, multicloud, IoT, OT and AI. They include diagrams of Microsoft capabilities and multicloud and cross-platform capabilities, and map Microsoft capabilities to Zero Trust standards and organizational roles.

• AAI-1: Ensure use of approved models

  Correct

  AI-1 targets supply chain attacks and poisoned or backdoored models before production use, through a model registry, security validation and an approval workflow, and names missing model traceability as a risk.

• BAI-2: Implement multi-layered content filtering

  Incorrect

  Content filtering acts on the traffic of a model that is already deployed; it doesn't decide which model is allowed to be deployed.

• CAI-6: Establish monitoring and detection

  Incorrect

  Monitoring and detection finds suspicious activity once the system is live, which is the reactive control the CISO doesn't want.

• DAI-7: Perform continuous AI red teaming

  Incorrect

  Red teaming probes AI systems with adversarial techniques to find vulnerabilities; it doesn't record each model's origin or gate its deployment.

The AI Security domain of the Microsoft cloud security benchmark v2 groups its controls into platform security, application security, and monitoring and response. AI-1, Ensure use of approved models, says to deploy only models formally approved through a trusted verification process, and lists supply chain attacks, compromised or malicious models and a lack of model traceability as the risks it mitigates. The other three controls act on a model that is already chosen or running rather than gating which model is deployed.

• ADS-1: Conduct threat modeling

  Incorrect

  Threat modeling finds design-level threats early; it doesn't vet each dependency a build consumes.

• BDS-5: Integrate Dynamic Application Security Testing

  Incorrect

  DAST tests a running application from outside and wouldn't reliably reveal a malicious package.

• CNS-6: Deploy a web application firewall in front of the portal

  Incorrect

  A WAF filters web requests at the edge; the problem came in through the build, not the network.

• DDS-2: Secure the software supply chain

  Correct

  DS-2 covers dependency scanning and management for the components a build pulls in, which is where the compromise entered.

The DevOps Security domain of the Microsoft cloud security benchmark v2 includes DS-1 threat modeling, DS-2 securing the software supply chain (starting with dependency scanning and management), DS-3 DevOps infrastructure, DS-4 SAST, DS-5 DAST, DS-6 the workload lifecycle and DS-7 logging and monitoring.

• ASecure remote and hybrid work

  Incorrect

  That scenario centers on letting people work from anywhere securely, not on containing a breach inside the network.

• BIdentify and protect sensitive business data

  Incorrect

  That scenario centers on discovering, classifying and protecting data rather than limiting lateral spread.

• CMeet regulatory and compliance requirements

  Incorrect

  That scenario frames Zero Trust around regulatory obligations, which isn't the stated concern here.

• DPrevent or reduce business damage from a breach

  Correct

  This scenario is about minimizing blast radius, segmenting access and verifying end-to-end encryption, which matches the leaders' worry.

Microsoft's Zero Trust adoption framework gives business leaders objectives and progress tracking through business scenarios. "Prevent or reduce business damage from a breach" addresses flat networks and unencrypted internal traffic by minimizing blast radius, segmenting access and verifying end-to-end encryption.

• ANetwork Security

  Incorrect

  Network Security was already a domain in v1.

• BPrivileged Access

  Incorrect

  Privileged Access was already a domain in v1.

• CArtificial Intelligence Security

  Correct

  v2 introduces an Artificial Intelligence Security domain with seven recommendations.

• DPosture and Vulnerability Management

  Incorrect

  Posture and Vulnerability Management was already a domain in v1.

The Microsoft cloud security benchmark v2 (preview) supersedes v1 and adds an Artificial Intelligence Security domain covering AI platform security, AI application security and AI security monitoring.

• ATrust the internal network, verify external users, log everything

  Incorrect

  Zero Trust doesn't trust a network location.

• BVerify explicitly, use least privilege access, assume breach

  Correct

  These are the three Zero Trust principles.

• CEncrypt everything, block all internet traffic, audit yearly

  Incorrect

  These aren't the Zero Trust principles.

• DDefend the perimeter, segment by department, trust managed devices

  Incorrect

  Perimeter-based trust is what Zero Trust replaces.

Zero Trust rests on three principles: verify explicitly, use least privilege access and assume breach.

• AThe Security Adoption Framework (SAF)

  Correct

  MCRA is a component of Microsoft's Security Adoption Framework.

• BThe Azure Well-Architected Framework

  Incorrect

  MCRA isn't part of the Well-Architected Framework.

• CThe Microsoft Purview compliance portal

  Incorrect

  That's a product portal, not a framework.

• DThe Microsoft Secure Score

  Incorrect

  Secure Score is a measurement, not a framework.

MCRA is a component of Microsoft's Security Adoption Framework (SAF), which describes a complete security modernization approach covering strategy, governance, technical architecture and operations.

• AMicrosoft Entra ID Governance

  Correct

  The update notes list Microsoft Entra ID Governance as added to the Adaptive Access diagram.

• BMicrosoft Security Exposure Management

  Incorrect

  Exposure Management was added to the main capabilities diagram.

• CWindows LAPS

  Incorrect

  Windows LAPS was added to the main capabilities diagram.

• DMicrosoft Entra Verified ID

  Incorrect

  Verified ID was added to the main capabilities diagram.

The April 2025 MCRA updated the main capabilities diagram to add Microsoft Security Exposure Management, Windows LAPS, passkeys and Microsoft Entra Verified ID, and to show Microsoft Security Copilot as a broad capability. Separately, it added Microsoft Entra ID Governance to the Adaptive Access diagram.