Pass Your Microsoft AB-900 Exam Easy!

Sign-in records expose authentication outcomes and applicable conditions. This helps with interactive authentication troubleshooting instead of the required device execution evidence.

Unified audit records capture supported user and admin actions across services. This helps with cross-service activity audit evidence instead of the required device execution evidence.

Audit logs record directory configuration mutations. The action is relevant to attribution of configuration edits rather than device execution evidence.

Blocking new sign-ins and ending sessions interrupt account misuse. It is used for urgent compromised-user access containment; this scenario calls for account-focused anomalous access analysis.

Credential replacement invalidates the known compromised password. That addresses recovery from password exposure, whereas the current case requires account-focused anomalous access analysis.

Identity recovery alone does not prove endpoint compromise is resolved. That addresses device-side assurance after an identity incident, whereas the current case requires account-focused anomalous access analysis.

Zero Trust verification evaluates identity and session context irrespective of network location. It would support explicit verification instead of perimeter trust, not the stated repeated resource-specific trust decisions.

Limiting permissions reduces potential misuse or compromise of the assigned account. Its purpose is minimal rights for a defined support task; the specified need is repeated resource-specific trust decisions.

Assuming breach prioritizes lateral-movement detection and impact reduction. It would support containment of an already-compromised session, not the stated repeated resource-specific trust decisions.

Authentication establishes the claimant's identity. This helps with validation of the sign-in principal instead of the required resolving missing file entitlements.

Authorization decides what an authenticated principal can perform. The action is relevant to permission enforcement after sign-in rather than resolving missing file entitlements.

Audit records attribute administrative mutations to the responsible identity. This helps with accountability for privileged modifications instead of the required resolving missing file entitlements.

Temporary Access Pass supports time-limited bootstrap of stronger authentication. That addresses time-limited onboarding authentication, whereas the current case requires a policy requiring more than a password.

FIDO credentials resist credential replay on fraudulent origins. That addresses phishing-resistant authenticator, whereas the current case requires a policy requiring more than a password.

TOTP creates rotating codes based on a shared secret and clock. It is used for rotating authenticator verification code; this scenario calls for a policy requiring more than a password.

User risk concerns compromised account likelihood while sign-in risk concerns an event. Its purpose is differentiation of identity and event risk; the specified need is simulated risk-policy deployment.

Explicit access block can enforce prohibited locations despite other grants. It would support location-based access denial, not the stated simulated risk-policy deployment.

Risk conditions can trigger stronger access controls for suspicious sessions. It would support risk-adjusted interactive sign-in, not the stated simulated risk-policy deployment.

Microsoft Secure Score summarizes assessed security posture and improvement opportunities. This helps with broad Microsoft 365 security posture prioritization instead of the required product usage measurement rather than security score.

Identity Secure Score evaluates identity protection configuration signals. The action is relevant to Entra-focused identity hardening rather than product usage measurement rather than security score.

Compliance Manager organizes assessment controls and evidence beyond security score. This helps with regulatory compliance improvement planning instead of the required product usage measurement rather than security score.

Defender XDR groups related cross-product alerts into incidents. That addresses unified threat investigation, whereas the current case requires aggregate threat detection trends.

Advanced hunting supports query-based threat exploration over available event data. It is used for proactive event-based threat hunting; this scenario calls for aggregate threat detection trends.

Alerts contain the detection's individual evidence and context. That addresses alert-level security evidence, whereas the current case requires aggregate threat detection trends.

Anti-phishing policy can evaluate spoofing and impersonation signals. It would support executive impersonation defense, not the stated investigating malicious mail delivery.

Safe Links evaluates URLs at time of user interaction where supported. It would support URL-click protection for email and Office content, not the stated investigating malicious mail delivery.

Safe Attachments analyzes suspicious files using supported detonation workflows. Its purpose is malware inspection of email attachments; the specified need is investigating malicious mail delivery.

The Office workload product focuses on mail and collaboration threats. The action is relevant to email and collaboration threat protection rather than SaaS usage threat control.

Defender for Identity observes supported identity infrastructure and activities. This helps with on-premises identity attack detection instead of the required SaaS usage threat control.

Endpoint detection collects process and device signals for threat response. This helps with endpoint process-level threat investigation instead of the required SaaS usage threat control.

Threat analytics synthesizes campaigns and defensive recommendations. That addresses contextual intelligence about an active threat, whereas the current case requires post-remediation restoration confidence.

Correlated evidence reconstructs the activity across multiple workloads. It is used for incident scope from heterogeneous security signals; this scenario calls for post-remediation restoration confidence.

Isolation limits network communication while investigators work. That addresses immediate containment of a compromised endpoint, whereas the current case requires post-remediation restoration confidence.