Pass Your Microsoft AB-900 Exam Easy!

Microsoft Secure Score summarizes assessed security posture and improvement opportunities. That addresses broad Microsoft 365 security posture prioritization, whereas the current case requires Entra-focused identity hardening.

Compliance Manager organizes assessment controls and evidence beyond security score. That addresses regulatory compliance improvement planning, whereas the current case requires Entra-focused identity hardening.

Adoption metrics capture use patterns, not security configuration gaps. It is used for product usage measurement rather than security score; this scenario calls for Entra-focused identity hardening.

Security reporting summarizes incident and alert activity over time. Its purpose is aggregate threat detection trends; the specified need is proactive event-based threat hunting.

Defender XDR groups related cross-product alerts into incidents. It would support unified threat investigation, not the stated proactive event-based threat hunting.

Alerts contain the detection's individual evidence and context. It would support alert-level security evidence, not the stated proactive event-based threat hunting.

Anti-phishing policy can evaluate spoofing and impersonation signals. This helps with executive impersonation defense instead of the required malware inspection of email attachments.

Email investigation tools show message detections, delivery and remediation events. The action is relevant to investigating malicious mail delivery rather than malware inspection of email attachments.

Safe Links evaluates URLs at time of user interaction where supported. This helps with URL-click protection for email and Office content instead of the required malware inspection of email attachments.

Defender for Identity observes supported identity infrastructure and activities. That addresses on-premises identity attack detection, whereas the current case requires email and collaboration threat protection.

Cloud app security observes and governs cloud application activity. It is used for SaaS usage threat control; this scenario calls for email and collaboration threat protection.

Endpoint detection collects process and device signals for threat response. That addresses endpoint process-level threat investigation, whereas the current case requires email and collaboration threat protection.

Threat analytics synthesizes campaigns and defensive recommendations. It would support contextual intelligence about an active threat, not the stated incident scope from heterogeneous security signals.

Isolation limits network communication while investigators work. It would support immediate containment of a compromised endpoint, not the stated incident scope from heterogeneous security signals.

Recovery verification checks that a threat is resolved and normal use is safe. Its purpose is post-remediation restoration confidence; the specified need is incident scope from heterogeneous security signals.

Time-bound elevation constrains standing administrative power. The action is relevant to temporary privileged access rather than minimum data-access permissions for an app.

Least-privilege RBAC separates investigation visibility from policy modification. This helps with observer rights for security telemetry instead of the required minimum data-access permissions for an app.

Periodic access review removes obsolete privileges. This helps with lifecycle cleanup of external privilege instead of the required minimum data-access permissions for an app.

Segregated identities prevent one exposed credential from compromising all environments. That addresses bounded workload credential compromise, whereas the current case requires immediate containment of stolen sessions.

Durable security logs preserve records for incident reconstruction. It is used for recoverable event evidence after compromise; this scenario calls for immediate containment of stolen sessions.

Segmentation and narrow permissions reduce blast radius after initial compromise. That addresses limited lateral movement from a compromised workstation, whereas the current case requires immediate containment of stolen sessions.

Endpoint telemetry records device behaviors beyond identity administration logs. It would support device execution evidence, not the stated interactive authentication troubleshooting.

Unified audit records capture supported user and admin actions across services. Its purpose is cross-service activity audit evidence; the specified need is interactive authentication troubleshooting.

Audit logs record directory configuration mutations. It would support attribution of configuration edits, not the stated interactive authentication troubleshooting.

Blocking new sign-ins and ending sessions interrupt account misuse. This helps with urgent compromised-user access containment instead of the required recovery from password exposure.

Risk dashboards correlate anomalies at sign-in and identity levels. This helps with account-focused anomalous access analysis instead of the required recovery from password exposure.

Identity recovery alone does not prove endpoint compromise is resolved. The action is relevant to device-side assurance after an identity incident rather than recovery from password exposure.

Zero Trust verification evaluates identity and session context irrespective of network location. It is used for explicit verification instead of perimeter trust; this scenario calls for containment of an already-compromised session.

Limiting permissions reduces potential misuse or compromise of the assigned account. That addresses minimal rights for a defined support task, whereas the current case requires containment of an already-compromised session.

One trusted network path does not justify bypassing subsequent authorization. That addresses repeated resource-specific trust decisions, whereas the current case requires containment of an already-compromised session.

Authentication success does not override resource-level authorization. It would support resolving missing file entitlements, not the stated accountability for privileged modifications.

Authentication establishes the claimant's identity. Its purpose is validation of the sign-in principal; the specified need is accountability for privileged modifications.

Authorization decides what an authenticated principal can perform. It would support permission enforcement after sign-in, not the stated accountability for privileged modifications.