Pass Your Microsoft SC-100 Exam Easy!

This recommendation fits a different scenario: A security review finds administrative role changes with no change ticket or recorded business purpose. Privileged authorization needs traceability between approvals and actual assignment. It does not solve the specified case, for which Revoke active sessions and review delegated app tokens in addition to disabling the account. is appropriate.

This recommendation fits a different scenario: A security team wants to test emergency access without leaving a highly privileged account active in daily workflows. Recovery readiness depends on tested access and careful operational protection. It does not solve the specified case, for which Revoke active sessions and review delegated app tokens in addition to disabling the account. is appropriate.

This recommendation fits a different scenario: A high-privilege application credential appears in a public repository and the response team plans only to delete the commit. Repository removal does not invalidate a secret that attackers may have copied. It does not solve the specified case, for which Revoke active sessions and review delegated app tokens in addition to disabling the account. is appropriate.

This recommendation fits a different scenario: A privileged insider can export an entire regulated dataset despite only needing aggregate reports. Restricting broad read access and detecting risky movement reduce insider-data exposure. It does not solve the specified case, for which Design phishing-resistant MFA and context-aware Conditional Access for sensitive operations. is appropriate.

This recommendation fits a different scenario: A contractor's access remains active after their approved business engagement ends. External identity access must track business sponsorship and contract lifecycle. It does not solve the specified case, for which Design phishing-resistant MFA and context-aware Conditional Access for sensitive operations. is appropriate.

This recommendation fits a different scenario: A supply-chain incident compromises a trusted vendor integration that has tenant-wide API permissions. Vendor compromise impact depends on the permissions and persistence granted to the integration. It does not solve the specified case, for which Design phishing-resistant MFA and context-aware Conditional Access for sensitive operations. is appropriate.

This recommendation fits a different scenario: An Azure Function needs to read a single storage container but currently stores the account access key. Scoped managed identity eliminates reusable account keys and narrows permitted operations. It does not solve the specified case, for which Move workload authentication to supported federated credentials or managed identity with controlled rotation. is appropriate.

This recommendation fits a different scenario: A Kubernetes pod receives cluster admin privileges to access one Azure Key Vault secret. Access to a cloud secret does not require Kubernetes control-plane administration. It does not solve the specified case, for which Move workload authentication to supported federated credentials or managed identity with controlled rotation. is appropriate.

This recommendation fits a different scenario: A service-to-service request succeeds with an OAuth token that belongs to the wrong audience. A valid token for one API does not authorize access to a different service. It does not solve the specified case, for which Move workload authentication to supported federated credentials or managed identity with controlled rotation. is appropriate.

This recommendation fits a different scenario: A financial services tenant receives executive impersonation messages and only basic bulk-spam filtering is configured. Impersonation controls address targeted sender deception beyond generic spam volume. It does not solve the specified case, for which Include Defender for Office 365 Safe Links time-of-click protection for eligible workloads. is appropriate.

This recommendation fits a different scenario: The organization requires suspicious attachments analyzed before employees open them. Dynamic attachment analysis can detect threats that simple filename or signature checks miss. It does not solve the specified case, for which Include Defender for Office 365 Safe Links time-of-click protection for eligible workloads. is appropriate.

This recommendation fits a different scenario: A SOC can identify malicious email but lacks a governed process to remove matching messages from other mailboxes. Campaign-level investigation should lead to controlled response across actual affected recipients. It does not solve the specified case, for which Include Defender for Office 365 Safe Links time-of-click protection for eligible workloads. is appropriate.

This recommendation fits a different scenario: A SOC tries to isolate a compromised endpoint but the device has been offline since yesterday. A remote isolation request may remain pending without endpoint connectivity. It does not solve the specified case, for which Reconcile device identities and retire stale endpoint records using supported lifecycle procedures. is appropriate.

This recommendation fits a different scenario: An attacker disables endpoint telemetry, and the operations team interprets no alerts as no compromise. Telemetry loss can hide attacks and should itself be investigated. It does not solve the specified case, for which Reconcile device identities and retire stale endpoint records using supported lifecycle procedures. is appropriate.

This recommendation fits a different scenario: A client malware alert is closed when the process exits but persistence tasks remain installed. A stopped process does not prove a threat is fully eradicated if persistence mechanisms and related identities remain compromised. It does not solve the specified case, for which Reconcile device identities and retire stale endpoint records using supported lifecycle procedures. is appropriate.

This recommendation fits a different scenario: A team wants to rely on a verifiable credential to attest a training qualification without copying the holder's complete identity file. Decentralized credentials can convey attestations without unnecessary personal-data transfer. It does not solve the specified case, for which Automate guest access expiration and sponsor-backed access reviews across effective memberships. is appropriate.

This recommendation fits a different scenario: A security architect assumes that verification of an external credential automatically grants access to every company application. Proving an attribute does not override resource-specific permissions. It does not solve the specified case, for which Automate guest access expiration and sponsor-backed access reviews across effective memberships. is appropriate.

This recommendation fits a different scenario: A partner organization needs access to one project application but should retain its own identity administration. B2B collaboration preserves independent home identities while limiting access to approved resources. It does not solve the specified case, for which Automate guest access expiration and sponsor-backed access reviews across effective memberships. is appropriate.

This recommendation fits a different scenario: An enterprise deploys two regional hubs but forgets to validate asymmetric return traffic through inspection appliances. Inconsistent forward and return paths can break stateful filtering or bypass expected controls. It does not solve the specified case, for which Segment workloads with least-privilege network security group and firewall rules. is appropriate.

This recommendation fits a different scenario: A regulated database is directly exposed to internet clients despite only internal applications needing connections. Limiting public reachability reduces exposure of sensitive data-plane interfaces. It does not solve the specified case, for which Segment workloads with least-privilege network security group and firewall rules. is appropriate.

This recommendation fits a different scenario: A hybrid application requires private connectivity but its on-premises network cannot resolve the private endpoint's DNS name. Private connectivity depends on routing and correct name resolution together. It does not solve the specified case, for which Segment workloads with least-privilege network security group and firewall rules. is appropriate.

This recommendation fits a different scenario: An Azure subscription has hundreds of unused Owner roles assigned to service principals. Excess cloud permissions create takeover paths for dormant identities. It does not solve the specified case, for which Normalize entitlement risk across providers while retaining provider-specific authorization evaluation. is appropriate.

This recommendation fits a different scenario: A managed identity can change production network routing despite only needing to read telemetry. Workload identity privileges should be aligned to functions rather than environment ownership. It does not solve the specified case, for which Normalize entitlement risk across providers while retaining provider-specific authorization evaluation. is appropriate.

This recommendation fits a different scenario: The security team sees role assignments but cannot tell whether users actually exercise their entitlements. Permission presence and actual use both inform the risk of persistent access. It does not solve the specified case, for which Normalize entitlement risk across providers while retaining provider-specific authorization evaluation. is appropriate.

This recommendation fits a different scenario: A tabletop exercise tests backup retrieval but never identifies who can authorize a regulated-data restoration. Governance controls establish who can use recovery material and preserve accountability during emergencies. It does not solve the specified case, for which Establish a single incident command workflow with explicit containment and recovery handoffs. is appropriate.

This recommendation fits a different scenario: Recovery tests meet infrastructure RTOs but fail business-user sign-off because downstream reports lack recent data. Resilience success requires restored business outcomes, not solely server availability. It does not solve the specified case, for which Establish a single incident command workflow with explicit containment and recovery handoffs. is appropriate.

This recommendation fits a different scenario: A business continuity plan has no schedule to re-test after the organization moves its primary data platform to another cloud. Recovery documentation becomes unreliable when topology and dependencies evolve without corresponding drills. It does not solve the specified case, for which Establish a single incident command workflow with explicit containment and recovery handoffs. is appropriate.

This recommendation fits a different scenario: Facilities deploy thousands of smart building sensors with default passwords and no central device registry. Device identity controls prevent shared default credentials from scaling into systemic exposure. It does not solve the specified case, for which Design authenticated encrypted transport and gateway authorization for IoT telemetry. is appropriate.

This recommendation fits a different scenario: An IoT fleet cannot be patched remotely and no one has documented expected service life or retirement. Unpatchable devices accumulate risk that must be managed through lifecycle planning. It does not solve the specified case, for which Design authenticated encrypted transport and gateway authorization for IoT telemetry. is appropriate.

This recommendation fits a different scenario: A retail sensor network shares routing with payment processing servers despite no operational dependency. Network isolation reduces lateral movement from less-managed devices to sensitive services. It does not solve the specified case, for which Design authenticated encrypted transport and gateway authorization for IoT telemetry. is appropriate.

This recommendation fits a different scenario: An architect publishes an API without a revision or version policy, breaking all consumers when its contract changes. Explicit version lifecycle protects dependent applications during interface evolution. It does not solve the specified case, for which Configure appropriate API Management rate and quota limits aligned to business contracts. is appropriate.

This recommendation fits a different scenario: A gateway logs full bearer tokens and sensitive request payloads to an unrestricted workspace. Observability should not leak the secrets and data it is intended to protect. It does not solve the specified case, for which Configure appropriate API Management rate and quota limits aligned to business contracts. is appropriate.

This recommendation fits a different scenario: A partner API receives legitimate requests but cannot distinguish which partner is allowed to call a sensitive operation. Gateway policies can enforce caller-specific API access rather than only route traffic. It does not solve the specified case, for which Configure appropriate API Management rate and quota limits aligned to business contracts. is appropriate.