Pass Your Microsoft AB-900 Exam Easy!

Authentication success does not override resource-level authorization. It would support resolving missing file entitlements, not the stated accountability for privileged modifications.

Authentication establishes the claimant's identity. Its purpose is validation of the sign-in principal; the specified need is accountability for privileged modifications.

Authorization decides what an authenticated principal can perform. It would support permission enforcement after sign-in, not the stated accountability for privileged modifications.

MFA combines independent verification factors to reduce password-only risk. This helps with a policy requiring more than a password instead of the required time-limited onboarding authentication.

FIDO credentials resist credential replay on fraudulent origins. The action is relevant to phishing-resistant authenticator rather than time-limited onboarding authentication.

TOTP creates rotating codes based on a shared secret and clock. This helps with rotating authenticator verification code instead of the required time-limited onboarding authentication.

User risk concerns compromised account likelihood while sign-in risk concerns an event. That addresses differentiation of identity and event risk, whereas the current case requires location-based access denial.

Report-only records what a policy would do before enforcement. That addresses simulated risk-policy deployment, whereas the current case requires location-based access denial.

Risk conditions can trigger stronger access controls for suspicious sessions. It is used for risk-adjusted interactive sign-in; this scenario calls for location-based access denial.

Microsoft Secure Score summarizes assessed security posture and improvement opportunities. Its purpose is broad Microsoft 365 security posture prioritization; the specified need is regulatory compliance improvement planning.

Identity Secure Score evaluates identity protection configuration signals. It would support Entra-focused identity hardening, not the stated regulatory compliance improvement planning.

Adoption metrics capture use patterns, not security configuration gaps. It would support product usage measurement rather than security score, not the stated regulatory compliance improvement planning.

Security reporting summarizes incident and alert activity over time. This helps with aggregate threat detection trends instead of the required alert-level security evidence.

Defender XDR groups related cross-product alerts into incidents. The action is relevant to unified threat investigation rather than alert-level security evidence.

Advanced hunting supports query-based threat exploration over available event data. This helps with proactive event-based threat hunting instead of the required alert-level security evidence.

Email investigation tools show message detections, delivery and remediation events. That addresses investigating malicious mail delivery, whereas the current case requires executive impersonation defense.

Safe Links evaluates URLs at time of user interaction where supported. It is used for URL-click protection for email and Office content; this scenario calls for executive impersonation defense.

Safe Attachments analyzes suspicious files using supported detonation workflows. That addresses malware inspection of email attachments, whereas the current case requires executive impersonation defense.

The Office workload product focuses on mail and collaboration threats. It would support email and collaboration threat protection, not the stated on-premises identity attack detection.

Cloud app security observes and governs cloud application activity. It would support SaaS usage threat control, not the stated on-premises identity attack detection.

Endpoint detection collects process and device signals for threat response. Its purpose is endpoint process-level threat investigation; the specified need is on-premises identity attack detection.

Threat analytics synthesizes campaigns and defensive recommendations. The action is relevant to contextual intelligence about an active threat rather than immediate containment of a compromised endpoint.

Correlated evidence reconstructs the activity across multiple workloads. This helps with incident scope from heterogeneous security signals instead of the required immediate containment of a compromised endpoint.

Recovery verification checks that a threat is resolved and normal use is safe. This helps with post-remediation restoration confidence instead of the required immediate containment of a compromised endpoint.

Time-bound elevation constrains standing administrative power. That addresses temporary privileged access, whereas the current case requires lifecycle cleanup of external privilege.

Least-privilege RBAC separates investigation visibility from policy modification. It is used for observer rights for security telemetry; this scenario calls for lifecycle cleanup of external privilege.

Narrowing application grants reduces data exposure if the workload is compromised. That addresses minimum data-access permissions for an app, whereas the current case requires lifecycle cleanup of external privilege.

Durable security logs preserve records for incident reconstruction. It would support recoverable event evidence after compromise, not the stated bounded workload credential compromise.

Segmentation and narrow permissions reduce blast radius after initial compromise. Its purpose is limited lateral movement from a compromised workstation; the specified need is bounded workload credential compromise.

Session revocation interrupts previously granted cloud access. It would support immediate containment of stolen sessions, not the stated bounded workload credential compromise.

Sign-in records expose authentication outcomes and applicable conditions. This helps with interactive authentication troubleshooting instead of the required device execution evidence.

Unified audit records capture supported user and admin actions across services. This helps with cross-service activity audit evidence instead of the required device execution evidence.

Audit logs record directory configuration mutations. The action is relevant to attribution of configuration edits rather than device execution evidence.