Exam SC-100 topic 5 question 6 discussion

I say D

B is the answer. https://learn.microsoft.com/en-us/security/privileged-access-workstations/privileged-access-devices#device-roles-and-profiles Privileged Access Workstation (PAW) – This is the highest security configuration designed for extremely sensitive roles that would have a significant or material impact on the organization if their account was compromised. The PAW configuration includes security controls and policies that restrict local administrative access and productivity tools to minimize the attack surface to only what is absolutely required for performing sensitive job tasks. This makes the PAW device difficult for attackers to compromise because it blocks the most common vector for phishing attacks: email and web browsing. To provide productivity to these users, separate accounts and workstations must be provided for productivity applications and web browsing. While inconvenient, this is a necessary control to protect users whose account could inflict damage to most or all resources in the organization.

In a ransomware response plan aligned with Microsoft Security Best Practices, one of the key recommendations is to ensure that your organization is not locked out of Azure AD or critical resources during an attack. • Emergency access accounts (sometimes called "break-glass accounts") are: • Highly privileged accounts created specifically for crisis scenarios. • Stored securely and used only when normal administrative accounts are unavailable or compromised. • Exempt from Conditional Access policies and MFA requirements to guarantee access even if identity systems are disrupted.

D. emergency access accounts Emergency access accounts (also called break-glass accounts) are highly privileged accounts. Excluded from Conditional Access policies and MFA enforcement to ensure access during outages or ransomware incidents. https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/security-emergency-access Privileged Access Workstations (PAWs) provide a secure environment for sensitive accounts by reducing the attack surface of the device. They are part of a holistic privileged access strategy but do not guarantee recovery if all accounts are locked out. Emergency access accounts are still required for business continuity. https://learn.microsoft.com/en-us/security/privileged-access-workstations/privileged-access-devices

Privileged operations only doable from PAWs -> Attacker cannot run privileged operations from compromised computers -> scope of damage limited

B. Privileged Access Workstations (PAWs) This recommendation will help mitigate the risks of ransomware attacks on privileged accounts without locking you out.

He said clearly " limit the scope of damage of ransomware attacks without being locked out", So the right one here should be D. Emergency Access Accounts". https://learn.microsoft.com/en-us/azure/active-directory-b2c/tenant-management-emergency-access-account

I can see why some may confuse the 'break-glass' account to this question, but clearly asks to NOT be locked! Which means you've already had access to the environment, whatever that maybe. You don't need emergency account at that point.

ChatGPT: To limit the scope of damage of ransomware attacks without being locked out, you should recommend Privileged Access Workstations (PAWs). Privileged Access Workstations (PAWs) are dedicated devices that are used to perform sensitive administrative tasks, such as configuring security settings and managing domain controllers. PAWs provide enhanced security by isolating administrative activities from regular user activities and by requiring multi-factor authentication and additional controls. By using a PAW, administrators can perform sensitive tasks without exposing their credentials to the regular network or potentially malicious content, such as ransomware. This helps to limit the scope of damage of ransomware attacks while also maintaining access to critical systems. Therefore, option B is the correct answer.

correct https://learn.microsoft.com/en-us/security/ransomware/protect-against-ransomware-phase2 https://learn.microsoft.com/en-us/security/privileged-access-workstations/privileged-access-devices