Pass Your Microsoft AB-900 Exam Easy!

The Office workload product focuses on mail and collaboration threats. This helps with email and collaboration threat protection instead of the required endpoint process-level threat investigation.

Defender for Identity observes supported identity infrastructure and activities. The action is relevant to on-premises identity attack detection rather than endpoint process-level threat investigation.

Cloud app security observes and governs cloud application activity. This helps with SaaS usage threat control instead of the required endpoint process-level threat investigation.

Correlated evidence reconstructs the activity across multiple workloads. That addresses incident scope from heterogeneous security signals, whereas the current case requires contextual intelligence about an active threat.

Isolation limits network communication while investigators work. It is used for immediate containment of a compromised endpoint; this scenario calls for contextual intelligence about an active threat.

Recovery verification checks that a threat is resolved and normal use is safe. That addresses post-remediation restoration confidence, whereas the current case requires contextual intelligence about an active threat.

Time-bound elevation constrains standing administrative power. It would support temporary privileged access, not the stated observer rights for security telemetry.

Narrowing application grants reduces data exposure if the workload is compromised. It would support minimum data-access permissions for an app, not the stated observer rights for security telemetry.

Periodic access review removes obsolete privileges. Its purpose is lifecycle cleanup of external privilege; the specified need is observer rights for security telemetry.

Segregated identities prevent one exposed credential from compromising all environments. The action is relevant to bounded workload credential compromise rather than limited lateral movement from a compromised workstation.

Durable security logs preserve records for incident reconstruction. This helps with recoverable event evidence after compromise instead of the required limited lateral movement from a compromised workstation.

Session revocation interrupts previously granted cloud access. This helps with immediate containment of stolen sessions instead of the required limited lateral movement from a compromised workstation.

Sign-in records expose authentication outcomes and applicable conditions. That addresses interactive authentication troubleshooting, whereas the current case requires attribution of configuration edits.

Endpoint telemetry records device behaviors beyond identity administration logs. It is used for device execution evidence; this scenario calls for attribution of configuration edits.

Unified audit records capture supported user and admin actions across services. That addresses cross-service activity audit evidence, whereas the current case requires attribution of configuration edits.

Credential replacement invalidates the known compromised password. It would support recovery from password exposure, not the stated urgent compromised-user access containment.

Risk dashboards correlate anomalies at sign-in and identity levels. Its purpose is account-focused anomalous access analysis; the specified need is urgent compromised-user access containment.

Identity recovery alone does not prove endpoint compromise is resolved. It would support device-side assurance after an identity incident, not the stated urgent compromised-user access containment.

Zero Trust verification evaluates identity and session context irrespective of network location. This helps with explicit verification instead of perimeter trust instead of the required minimal rights for a defined support task.

Assuming breach prioritizes lateral-movement detection and impact reduction. This helps with containment of an already-compromised session instead of the required minimal rights for a defined support task.

One trusted network path does not justify bypassing subsequent authorization. The action is relevant to repeated resource-specific trust decisions rather than minimal rights for a defined support task.

Authentication success does not override resource-level authorization. It is used for resolving missing file entitlements; this scenario calls for permission enforcement after sign-in.

Authentication establishes the claimant's identity. That addresses validation of the sign-in principal, whereas the current case requires permission enforcement after sign-in.

Audit records attribute administrative mutations to the responsible identity. That addresses accountability for privileged modifications, whereas the current case requires permission enforcement after sign-in.

Temporary Access Pass supports time-limited bootstrap of stronger authentication. It would support time-limited onboarding authentication, not the stated rotating authenticator verification code.

MFA combines independent verification factors to reduce password-only risk. Its purpose is a policy requiring more than a password; the specified need is rotating authenticator verification code.

FIDO credentials resist credential replay on fraudulent origins. It would support phishing-resistant authenticator, not the stated rotating authenticator verification code.

Explicit access block can enforce prohibited locations despite other grants. This helps with location-based access denial instead of the required differentiation of identity and event risk.

Report-only records what a policy would do before enforcement. The action is relevant to simulated risk-policy deployment rather than differentiation of identity and event risk.

Risk conditions can trigger stronger access controls for suspicious sessions. This helps with risk-adjusted interactive sign-in instead of the required differentiation of identity and event risk.

Microsoft Secure Score summarizes assessed security posture and improvement opportunities. That addresses broad Microsoft 365 security posture prioritization, whereas the current case requires Entra-focused identity hardening.

Compliance Manager organizes assessment controls and evidence beyond security score. That addresses regulatory compliance improvement planning, whereas the current case requires Entra-focused identity hardening.

Adoption metrics capture use patterns, not security configuration gaps. It is used for product usage measurement rather than security score; this scenario calls for Entra-focused identity hardening.