Pass Your Microsoft SC-100 Exam Easy!

This recommendation fits a different scenario: A network team proposes exempting all Teams traffic from every security control to resolve poor call quality. Performance optimization should not eliminate resource authorization or protection. It does not solve the specified case, for which Correlate Office 365 detections with Defender XDR cross-workload incidents. is appropriate.

This recommendation fits a different scenario: A tenant allows external collaboration but no one reviews guests after their projects end. External collaboration risk persists when access remains after legitimate need ends. It does not solve the specified case, for which Correlate Office 365 detections with Defender XDR cross-workload incidents. is appropriate.

This recommendation fits a different scenario: A Microsoft 365 compliance dashboard shows no incidents, but several workloads are not licensed or connected for security signals. Missing detection evidence cannot prove the environment is safe because unmonitored services may conceal otherwise detectable threats. It does not solve the specified case, for which Correlate Office 365 detections with Defender XDR cross-workload incidents. is appropriate.

This recommendation fits a different scenario: Legacy service accounts have unrestricted domain administrator memberships for scheduled file transfers. Limiting standing AD rights reduces the lateral-movement value of a compromised service account. It does not solve the specified case, for which Isolate privileged AD administration onto hardened, dedicated access workstations. is appropriate.

This recommendation fits a different scenario: Attackers could modify domain controller backups because they reside on a file share writable by ordinary domain users. Domain recovery depends on trusted, access-controlled backup state. It does not solve the specified case, for which Isolate privileged AD administration onto hardened, dedicated access workstations. is appropriate.

This recommendation fits a different scenario: A company plans to disable old authentication protocols without knowing which business apps still depend on them. Removing legacy protocols requires controlled transition to avoid business-wide lockouts. It does not solve the specified case, for which Isolate privileged AD administration onto hardened, dedicated access workstations. is appropriate.

This recommendation fits a different scenario: A multicloud application replicates data but has never tested whether its secondary cloud can obtain required encryption keys. Replicated ciphertext is unusable if the required decryption authority is unavailable after failover. It does not solve the specified case, for which Replicate approved name-resolution services and test failover routing independently of the primary data center. is appropriate.

This recommendation fits a different scenario: The recovery architect chooses asynchronous replication without evaluating the impact of losing recent transactions. Replication mode must reflect acceptable data loss, not only infrastructure cost. It does not solve the specified case, for which Replicate approved name-resolution services and test failover routing independently of the primary data center. is appropriate.

This recommendation fits a different scenario: A regional outage drill assumes network allowlists and service identities will remain valid after switching endpoints. Failing over compute without valid cross-service trust does not restore a functioning application. It does not solve the specified case, for which Replicate approved name-resolution services and test failover routing independently of the primary data center. is appropriate.

This recommendation fits a different scenario: An Azure web app has HTTPS on its public endpoint but its backend storage connection uses a public shared key. Front-end TLS does not establish least privilege for data-plane operations. It does not solve the specified case, for which Replace embedded credentials with managed identity or controlled secret retrieval and rotation. is appropriate.

This recommendation fits a different scenario: A cloud project encrypts disks with customer-managed keys but its key vault allows unrestricted delete operations. Data availability depends on protecting the encryption key against unauthorized destruction. It does not solve the specified case, for which Replace embedded credentials with managed identity or controlled secret retrieval and rotation. is appropriate.

This recommendation fits a different scenario: A production database admin can create and remove diagnostic log destinations without any independent oversight. A compromised data operator should not silently disable independent evidence collection. It does not solve the specified case, for which Replace embedded credentials with managed identity or controlled secret retrieval and rotation. is appropriate.

This recommendation fits a different scenario: A cloud-native app has redundant load balancers but a single shared production secret across all microservices. Service-level trust isolation reduces the blast radius of compromised workload credentials. It does not solve the specified case, for which Combine application authentication and authorization with WAF and API gateway controls. is appropriate.

This recommendation fits a different scenario: An architect demands all APIs use the same authorization policy despite different data sensitivity and caller types. Uniform infrastructure cannot replace differentiated resource permissions. It does not solve the specified case, for which Combine application authentication and authorization with WAF and API gateway controls. is appropriate.

This recommendation fits a different scenario: A sensitive internal application relies on user IP addresses as its sole authorization check. Network source is not a durable proof of the caller's privileges. It does not solve the specified case, for which Combine application authentication and authorization with WAF and API gateway controls. is appropriate.

This recommendation fits a different scenario: Cloud security teams want unified posture control reporting for resources in Google Cloud as well as Azure. GCP workloads are not automatically part of Azure's monitored inventory. It does not solve the specified case, for which Onboard eligible AWS accounts to Defender for Cloud with approved connector permissions. is appropriate.

This recommendation fits a different scenario: An external account connector receives permanent administrator permissions although it only needs approved posture collection. Broad multicloud connector rights increase the blast radius of integration compromise. It does not solve the specified case, for which Onboard eligible AWS accounts to Defender for Cloud with approved connector permissions. is appropriate.

This recommendation fits a different scenario: Several cloud projects produce incompatible posture reports because every provider uses different asset identifiers. Consistent resource identity improves cross-cloud review and remediation ownership. It does not solve the specified case, for which Onboard eligible AWS accounts to Defender for Cloud with approved connector permissions. is appropriate.

This recommendation fits a different scenario: An AKS cluster exposes its control-plane API to the internet without approved access restrictions. API server reachability should follow the documented management trust boundary. It does not solve the specified case, for which Define scoped Kubernetes RBAC and dedicated service accounts for workloads. is appropriate.

This recommendation fits a different scenario: Applications in separate security zones exchange traffic freely because no network policies are applied. Namespace labels alone are not equivalent to network isolation without an enforcing policy and compatible networking provider. It does not solve the specified case, for which Define scoped Kubernetes RBAC and dedicated service accounts for workloads. is appropriate.

This recommendation fits a different scenario: A Kubernetes platform rotates nodes but retains image pull secrets that no longer have an approved owner. Cluster security requires lifecycle management of credentials outside node replacement. It does not solve the specified case, for which Define scoped Kubernetes RBAC and dedicated service accounts for workloads. is appropriate.

This recommendation fits a different scenario: A team claims a monthly compliance check is sufficient for continuously deployed cloud resources. Continuous deployment requires assurance that reflects current infrastructure states. It does not solve the specified case, for which Preserve immutable approval records linked to audit events and responsible identities. is appropriate.

This recommendation fits a different scenario: An auditor finds no trace of who accepted an exception to a mandatory encryption requirement. Exceptions without decision history cannot establish accountable risk treatment. It does not solve the specified case, for which Preserve immutable approval records linked to audit events and responsible identities. is appropriate.

This recommendation fits a different scenario: A multinational organization exports Purview logs to an unrestricted analytics workspace containing personal identifiers. Compliance logging can become a privacy exposure if exported without controls. It does not solve the specified case, for which Preserve immutable approval records linked to audit events and responsible identities. is appropriate.

This recommendation fits a different scenario: Developers store infrastructure credentials in deployment YAML inside a public code repository. Removing long-lived embedded secrets reduces credential exposure from source code. It does not solve the specified case, for which Require artifact integrity, automated checks and release approvals in the protected CI/CD flow. is appropriate.

This recommendation fits a different scenario: Security defects are discovered only during annual penetration tests, long after feature release. Earlier testing reduces the cost and likelihood of deploying exploitable changes. It does not solve the specified case, for which Require artifact integrity, automated checks and release approvals in the protected CI/CD flow. is appropriate.

This recommendation fits a different scenario: An urgent release bypasses every automated test and leaves no evidence of who accepted the risk. Emergency speed can coexist with accountability and minimum required security checks. It does not solve the specified case, for which Require artifact integrity, automated checks and release approvals in the protected CI/CD flow. is appropriate.

This recommendation fits a different scenario: A team enables an Azure Storage firewall but forgets to verify private endpoint DNS for on-premises consumers. Storage isolation must remain compatible with authorized application paths. It does not solve the specified case, for which Disable unnecessary anonymous access and require approved authenticated data-plane permissions. is appropriate.

This recommendation fits a different scenario: A batch job uses one account-level storage key for all containers even though it only writes to one folder. Broad persistent storage keys exceed the permissions needed by one workload. It does not solve the specified case, for which Disable unnecessary anonymous access and require approved authenticated data-plane permissions. is appropriate.

This recommendation fits a different scenario: A ransomware incident deletes storage blobs and their latest versions before the recovery team investigates. Recoverable history and protected deletion controls reduce irreversible storage loss. It does not solve the specified case, for which Disable unnecessary anonymous access and require approved authenticated data-plane permissions. is appropriate.

This recommendation fits a different scenario: A security review finds administrative role changes with no change ticket or recorded business purpose. Privileged authorization needs traceability between approvals and actual assignment. It does not solve the specified case, for which Revoke and rotate the exposed credential, then investigate its use and effective grants. is appropriate.

This recommendation fits a different scenario: A security team wants to test emergency access without leaving a highly privileged account active in daily workflows. Recovery readiness depends on tested access and careful operational protection. It does not solve the specified case, for which Revoke and rotate the exposed credential, then investigate its use and effective grants. is appropriate.

This recommendation fits a different scenario: An incident commander suspends a compromised administrator but leaves an active privileged cloud session untouched. Session containment may require actions beyond account state changes. It does not solve the specified case, for which Revoke and rotate the exposed credential, then investigate its use and effective grants. is appropriate.