Pass Your Microsoft SC-100 Exam Easy!

This recommendation fits a different scenario: A security board authorizes a new application but no one owns future dependency updates. Application protection must continue after initial launch and approval. It does not solve the specified case, for which Prioritize application posture findings by reachable attack paths and regulated data impact. is appropriate.

This recommendation fits a different scenario: A corporation has hundreds of internal apps but no inventory of their hosting, owners or authentication methods. Portfolio risk cannot be assessed without knowing the applications and their attack surfaces. It does not solve the specified case, for which Prioritize application posture findings by reachable attack paths and regulated data impact. is appropriate.

This recommendation fits a different scenario: A software vendor claims SOC reports prove that every custom configuration of its application is secure. General vendor audits do not verify the purchaser's unique deployment controls. It does not solve the specified case, for which Prioritize application posture findings by reachable attack paths and regulated data impact. is appropriate.

This recommendation fits a different scenario: A PaaS application team disables authentication because the underlying service platform already uses encryption. Provider platform safeguards do not authenticate application users or authorize data access. It does not solve the specified case, for which Allocate customer responsibility for guest OS and application security under the IaaS service model. is appropriate.

This recommendation fits a different scenario: The same baseline is applied without adaptation to Kubernetes nodes, managed SQL and Microsoft 365. IaaS, PaaS and SaaS expose different customer-configurable control surfaces. It does not solve the specified case, for which Allocate customer responsibility for guest OS and application security under the IaaS service model. is appropriate.

This recommendation fits a different scenario: A workload team assumes a SaaS provider automatically controls which internal employees can export confidential files. SaaS providers operate the service but customer access settings remain a shared-responsibility concern. It does not solve the specified case, for which Allocate customer responsibility for guest OS and application security under the IaaS service model. is appropriate.

This recommendation fits a different scenario: A SaaS supplier will process regulated customer data but the security team has not assessed its subcontractors. Supply-chain privacy duties extend beyond the immediate service provider. It does not solve the specified case, for which Evaluate cross-border data movement restrictions and design approved transfer controls before exporting. is appropriate.

This recommendation fits a different scenario: A vendor requests unrestricted production database access to provide temporary support. Contracted support does not justify enduring broad access to regulated records. It does not solve the specified case, for which Evaluate cross-border data movement restrictions and design approved transfer controls before exporting. is appropriate.

This recommendation fits a different scenario: A project retires a cloud application but leaves external vendors with active keys to its archived data. Retired workloads can retain accessible sensitive data if external grants persist. It does not solve the specified case, for which Evaluate cross-border data movement restrictions and design approved transfer controls before exporting. is appropriate.

This recommendation fits a different scenario: A generative AI application can read unrelated customer records through its retrieval index. Retrieval-augmented generation must not bypass original source authorization. It does not solve the specified case, for which Include prompt-injection threat modeling and policy-enforced tool and data boundaries around the model. is appropriate.

This recommendation fits a different scenario: A chatbot sends sensitive prompts to a third-party service without documenting retention or residency terms. Secure AI adoption includes privacy and contractual data processing controls, not only model accuracy. It does not solve the specified case, for which Include prompt-injection threat modeling and policy-enforced tool and data boundaries around the model. is appropriate.

This recommendation fits a different scenario: An AI team enables broad model endpoint access because it assumes safety filters also restrict callers. Content filtering evaluates outputs but does not substitute for access control to model resources. It does not solve the specified case, for which Include prompt-injection threat modeling and policy-enforced tool and data boundaries around the model. is appropriate.

This recommendation fits a different scenario: A security program wants to track whether strategic exposure-reduction initiatives improve over several months. Trend assessment requires stable coverage and explicit outcomes, not only one dashboard snapshot. It does not solve the specified case, for which Distinguish modeled exposure relationships from confirmed compromise telemetry and incident evidence. is appropriate.

This recommendation fits a different scenario: Two teams independently patch the same low-impact issue while a high-risk identity-to-server path remains open. Cross-domain attack paths require joint mitigation rather than isolated asset queues. It does not solve the specified case, for which Distinguish modeled exposure relationships from confirmed compromise telemetry and incident evidence. is appropriate.

This recommendation fits a different scenario: A vulnerable workstation links to a privileged service account, but teams prioritize only by its standalone CVSS number. Reachability to privileged resources can matter more than a single isolated severity label. It does not solve the specified case, for which Distinguish modeled exposure relationships from confirmed compromise telemetry and incident evidence. is appropriate.

This recommendation fits a different scenario: A security engineer needs elevated directory permissions for one maintenance window but currently holds them permanently. Just-in-time privilege limits the duration of sensitive access while retaining a verifiable activation record. It does not solve the specified case, for which Configure approval and justification in the applicable PIM activation policy. is appropriate.

This recommendation fits a different scenario: A former contractor remains eligible for Global Administrator role activation months after their project ends. Eligible assignments are still an access risk even when not activated. It does not solve the specified case, for which Configure approval and justification in the applicable PIM activation policy. is appropriate.

This recommendation fits a different scenario: The SOC cannot identify who activated a privileged role just before suspicious tenant configuration changes. Traceable activation events connect privileged authority to specific actions and dates. It does not solve the specified case, for which Configure approval and justification in the applicable PIM activation policy. is appropriate.

This recommendation fits a different scenario: A model training job copies regulated customer records into a globally shared temporary storage account. AI development pipelines require the same confidentiality and residency safeguards as production systems. It does not solve the specified case, for which Design prompt-injection defenses with explicit tool permission and output-data boundaries. is appropriate.

This recommendation fits a different scenario: A generative AI team logs raw confidential prompts for debugging but cannot define who is permitted to access them. Generated and submitted content can contain regulated information needing protective handling. It does not solve the specified case, for which Design prompt-injection defenses with explicit tool permission and output-data boundaries. is appropriate.

This recommendation fits a different scenario: A retrieval AI assistant indexes confidential board documents for all employees without honoring SharePoint permissions. AI retrieval must not elevate the caller's rights to indexed content. It does not solve the specified case, for which Design prompt-injection defenses with explicit tool permission and output-data boundaries. is appropriate.

This recommendation fits a different scenario: A business removes a legacy service but external scanners still find the previous endpoint. Internet-facing exposure can persist after internal retirement records say a service is gone. It does not solve the specified case, for which Validate attribution and ownership before treating discovered infrastructure as an enterprise asset. is appropriate.

This recommendation fits a different scenario: The security team knows internal IP addresses but not the public domains and hosts registered by acquired subsidiaries. External discovery reveals assets beyond known internal CMDB entries. It does not solve the specified case, for which Validate attribution and ownership before treating discovered infrastructure as an enterprise asset. is appropriate.

This recommendation fits a different scenario: An externally accessible test API contains a stale authentication endpoint, but no business owner is listed. Unknown ownership delays remediation of publicly reachable sensitive interfaces. It does not solve the specified case, for which Validate attribution and ownership before treating discovered infrastructure as an enterprise asset. is appropriate.

This recommendation fits a different scenario: A Linux estate appears Arc-connected but security extensions are missing on half the servers. Registration alone does not prove that each required protection component is installed. It does not solve the specified case, for which Use a controlled onboarding identity and rotate bootstrap credentials with least-privilege permissions. is appropriate.

This recommendation fits a different scenario: An application team assumes Arc-enabled machines automatically become full Azure virtual machines for every control. Azure Arc extends selected management capabilities without replacing the original hosting environment. It does not solve the specified case, for which Use a controlled onboarding identity and rotate bootstrap credentials with least-privilege permissions. is appropriate.

This recommendation fits a different scenario: On-premises Linux servers are excluded from Azure inventory and policy compliance checks. Azure Arc can expose supported external machines to Azure governance and security integrations. It does not solve the specified case, for which Use a controlled onboarding identity and rotate bootstrap credentials with least-privilege permissions. is appropriate.

This recommendation fits a different scenario: A regional team wants to deploy controls without identifying the owner responsible for operating them. Control ownership makes an architectural recommendation maintainable and auditable after rollout. It does not solve the specified case, for which Design defense in depth with distinct controls across identities, devices, applications, network and data. is appropriate.

This recommendation fits a different scenario: A merger introduces a new cloud estate but the reference architecture has not mapped its administrative trust boundaries. Security architecture must represent newly introduced identity boundaries and lateral-movement paths. It does not solve the specified case, for which Design defense in depth with distinct controls across identities, devices, applications, network and data. is appropriate.

This recommendation fits a different scenario: An enterprise compares two security tool purchases without first defining which identity, network and data threats must be covered. Capability mapping exposes gaps and dependencies independently of product branding. It does not solve the specified case, for which Design defense in depth with distinct controls across identities, devices, applications, network and data. is appropriate.

This recommendation fits a different scenario: Developers deploy container images directly from an unverified personal registry into production. Secure container supply chains need confidence in artifact origin and content. It does not solve the specified case, for which Apply least-privilege container runtime settings and eliminate unnecessary host access. is appropriate.

This recommendation fits a different scenario: A team scans source code but never examines third-party packages shipped in the final container image. The deployed container can contain vulnerable components absent from source scans. It does not solve the specified case, for which Apply least-privilege container runtime settings and eliminate unnecessary host access. is appropriate.

This recommendation fits a different scenario: Runtime detections are missing for workloads in a managed Kubernetes cluster despite completed image scanning. Build-time scanning does not observe malicious behavior after deployment. It does not solve the specified case, for which Apply least-privilege container runtime settings and eliminate unnecessary host access. is appropriate.