Pass Your Microsoft AB-900 Exam Easy!

Threat analytics synthesizes campaigns and defensive recommendations. That addresses contextual intelligence about an active threat, whereas the current case requires post-remediation restoration confidence.

Correlated evidence reconstructs the activity across multiple workloads. It is used for incident scope from heterogeneous security signals; this scenario calls for post-remediation restoration confidence.

Isolation limits network communication while investigators work. That addresses immediate containment of a compromised endpoint, whereas the current case requires post-remediation restoration confidence.

Least-privilege RBAC separates investigation visibility from policy modification. It would support observer rights for security telemetry, not the stated temporary privileged access.

Narrowing application grants reduces data exposure if the workload is compromised. Its purpose is minimum data-access permissions for an app; the specified need is temporary privileged access.

Periodic access review removes obsolete privileges. It would support lifecycle cleanup of external privilege, not the stated temporary privileged access.

Segregated identities prevent one exposed credential from compromising all environments. This helps with bounded workload credential compromise instead of the required recoverable event evidence after compromise.

Segmentation and narrow permissions reduce blast radius after initial compromise. This helps with limited lateral movement from a compromised workstation instead of the required recoverable event evidence after compromise.

Session revocation interrupts previously granted cloud access. The action is relevant to immediate containment of stolen sessions rather than recoverable event evidence after compromise.

Sign-in records expose authentication outcomes and applicable conditions. It is used for interactive authentication troubleshooting; this scenario calls for cross-service activity audit evidence.

Endpoint telemetry records device behaviors beyond identity administration logs. That addresses device execution evidence, whereas the current case requires cross-service activity audit evidence.

Audit logs record directory configuration mutations. That addresses attribution of configuration edits, whereas the current case requires cross-service activity audit evidence.

Blocking new sign-ins and ending sessions interrupt account misuse. It would support urgent compromised-user access containment, not the stated device-side assurance after an identity incident.

Credential replacement invalidates the known compromised password. Its purpose is recovery from password exposure; the specified need is device-side assurance after an identity incident.

Risk dashboards correlate anomalies at sign-in and identity levels. It would support account-focused anomalous access analysis, not the stated device-side assurance after an identity incident.

Guest access allows limited collaboration while retaining external identity origin. The action is relevant to access for a named external partner rather than an internal organization identity.

The service principal represents an application instance in the directory. This helps with tenant-scoped enterprise application identity instead of the required an internal organization identity.

Group membership enables reusable access targeting. The action is relevant to cohort-based application authorization rather than an internal organization identity.

Grant controls define conditions that a sign-in must satisfy. It is used for required additional authentication for selected users; this scenario calls for scope of a particular protected app.

Network conditions and block decisions enforce location restrictions. That addresses explicit access denial from restricted locations, whereas the current case requires scope of a particular protected app.

Report-only evaluations record prospective outcomes without enforcement. It is used for safe policy impact analysis; this scenario calls for scope of a particular protected app.

Identity Secure Score emphasizes identity control maturity and opportunities. Its purpose is identity-wide recommended hardening actions; the specified need is failed sign-in evidence.

User-risk signals assess possible identity compromise. Its purpose is aggregated account compromise risk; the specified need is failed sign-in evidence.

Directory audit events attribute administrative changes. It would support author and time of policy change, not the stated failed sign-in evidence.

Password-based SSO can store and supply credentials for incompatible legacy apps. This helps with legacy password-oriented app access instead of the required standards-based SAML sign-in.

Seamless SSO uses existing authenticated context where protocols and policies allow. The action is relevant to reduced repeated prompts in managed sessions rather than standards-based SAML sign-in.

OIDC adds identity tokens over an OAuth-based authorization flow. The action is relevant to OIDC identity federation rather than standards-based SAML sign-in.

Approval gates enforce oversight on privileged activation. It is used for independently approved privilege activation; this scenario calls for just-in-time role elevation.

PIM reports expose eligible and active role assignment lifetimes. That addresses upcoming privileged entitlement expiry, whereas the current case requires just-in-time role elevation.

Privileged activity logs attribute activation decisions and timestamps. It is used for accountable temporary role usage; this scenario calls for just-in-time role elevation.

Enterprise apps represent tenant-local service principals and user assignments. Its purpose is tenant access to deployed SaaS app; the specified need is developer-side application identity definition.

Managed identities provision service identity tokens without customer-managed credentials. It would support passwordless Azure workload identity, not the stated developer-side application identity definition.

Tenant-level application grants require privileged review and scope controls. Its purpose is governance of application-level API access; the specified need is developer-side application identity definition.