Pass Your Microsoft SC-100 Exam Easy!

This recommendation fits a different scenario: A SOC investigates user phishing incidents without checking related endpoint and identity alerts. Email threats can lead to identity and endpoint compromise that a mailbox-only view misses. It does not solve the specified case, for which Implement guest lifecycle and sponsor-backed entitlement reviews across supported workloads. is appropriate.

This recommendation fits a different scenario: A network team proposes exempting all Teams traffic from every security control to resolve poor call quality. Performance optimization should not eliminate resource authorization or protection. It does not solve the specified case, for which Implement guest lifecycle and sponsor-backed entitlement reviews across supported workloads. is appropriate.

This recommendation fits a different scenario: A Microsoft 365 compliance dashboard shows no incidents, but several workloads are not licensed or connected for security signals. Missing detection evidence cannot prove the environment is safe because unmonitored services may conceal otherwise detectable threats. It does not solve the specified case, for which Implement guest lifecycle and sponsor-backed entitlement reviews across supported workloads. is appropriate.

This recommendation fits a different scenario: Legacy service accounts have unrestricted domain administrator memberships for scheduled file transfers. Limiting standing AD rights reduces the lateral-movement value of a compromised service account. It does not solve the specified case, for which Protect AD DS recovery material with separated administration and tested forest-recovery procedures. is appropriate.

This recommendation fits a different scenario: A company plans to disable old authentication protocols without knowing which business apps still depend on them. Removing legacy protocols requires controlled transition to avoid business-wide lockouts. It does not solve the specified case, for which Protect AD DS recovery material with separated administration and tested forest-recovery procedures. is appropriate.

This recommendation fits a different scenario: Domain admin accounts browse email and administer production domain controllers from the same workstation. Preventing routine browsing from privileged sessions reduces credential exposure. It does not solve the specified case, for which Protect AD DS recovery material with separated administration and tested forest-recovery procedures. is appropriate.

This recommendation fits a different scenario: A regional outage drill assumes network allowlists and service identities will remain valid after switching endpoints. Failing over compute without valid cross-service trust does not restore a functioning application. It does not solve the specified case, for which Compare replication consistency and achievable RPO against the workload's contractual data-loss tolerance. is appropriate.

This recommendation fits a different scenario: A public-cloud failover design relies on a single private DNS server in an on-premises data center. Cross-environment recovery fails when a shared name-resolution dependency remains a single point of failure. It does not solve the specified case, for which Compare replication consistency and achievable RPO against the workload's contractual data-loss tolerance. is appropriate.

This recommendation fits a different scenario: A multicloud application replicates data but has never tested whether its secondary cloud can obtain required encryption keys. Replicated ciphertext is unusable if the required decryption authority is unavailable after failover. It does not solve the specified case, for which Compare replication consistency and achievable RPO against the workload's contractual data-loss tolerance. is appropriate.

This recommendation fits a different scenario: A production database admin can create and remove diagnostic log destinations without any independent oversight. A compromised data operator should not silently disable independent evidence collection. It does not solve the specified case, for which Protect key lifecycle with least-privilege roles, soft delete and purge protection where applicable. is appropriate.

This recommendation fits a different scenario: A VM uses a hard-coded database password in its startup script and the image is shared across environments. Shared images must not distribute reusable production authentication secrets. It does not solve the specified case, for which Protect key lifecycle with least-privilege roles, soft delete and purge protection where applicable. is appropriate.

This recommendation fits a different scenario: An Azure web app has HTTPS on its public endpoint but its backend storage connection uses a public shared key. Front-end TLS does not establish least privilege for data-plane operations. It does not solve the specified case, for which Protect key lifecycle with least-privilege roles, soft delete and purge protection where applicable. is appropriate.

This recommendation fits a different scenario: An architect demands all APIs use the same authorization policy despite different data sensitivity and caller types. Uniform infrastructure cannot replace differentiated resource permissions. It does not solve the specified case, for which Use per-service identities and narrowly scoped credentials for independent components. is appropriate.

This recommendation fits a different scenario: A public API needs authentication but the team proposes a WAF as the only protection. WAF filtering does not establish which caller may access protected business data. It does not solve the specified case, for which Use per-service identities and narrowly scoped credentials for independent components. is appropriate.

This recommendation fits a different scenario: A sensitive internal application relies on user IP addresses as its sole authorization check. Network source is not a durable proof of the caller's privileges. It does not solve the specified case, for which Use per-service identities and narrowly scoped credentials for independent components. is appropriate.

This recommendation fits a different scenario: Cloud security teams want unified posture control reporting for resources in Google Cloud as well as Azure. GCP workloads are not automatically part of Azure's monitored inventory. It does not solve the specified case, for which Apply the least required provider permissions and manage the connector's credential lifecycle. is appropriate.

This recommendation fits a different scenario: Several cloud projects produce incompatible posture reports because every provider uses different asset identifiers. Consistent resource identity improves cross-cloud review and remediation ownership. It does not solve the specified case, for which Apply the least required provider permissions and manage the connector's credential lifecycle. is appropriate.

This recommendation fits a different scenario: An organization uses Azure and AWS but its Defender for Cloud dashboard only shows Azure resources. Multicloud posture monitoring requires explicit source-account integration. It does not solve the specified case, for which Apply the least required provider permissions and manage the connector's credential lifecycle. is appropriate.

This recommendation fits a different scenario: An AKS cluster exposes its control-plane API to the internet without approved access restrictions. API server reachability should follow the documented management trust boundary. It does not solve the specified case, for which Enforce supported Kubernetes network policies restricting pod ingress and egress. is appropriate.

This recommendation fits a different scenario: A Kubernetes platform rotates nodes but retains image pull secrets that no longer have an approved owner. Cluster security requires lifecycle management of credentials outside node replacement. It does not solve the specified case, for which Enforce supported Kubernetes network policies restricting pod ingress and egress. is appropriate.

This recommendation fits a different scenario: All Kubernetes service accounts can read every namespace secret through overbroad cluster roles. Namespaced least privilege limits impact of compromised pods by constraining access to secrets and orchestration APIs. It does not solve the specified case, for which Enforce supported Kubernetes network policies restricting pod ingress and egress. is appropriate.

This recommendation fits a different scenario: A multinational organization exports Purview logs to an unrestricted analytics workspace containing personal identifiers. Compliance logging can become a privacy exposure if exported without controls. It does not solve the specified case, for which Establish automated policy monitoring and risk-based reassessment after production changes. is appropriate.

This recommendation fits a different scenario: An auditor finds no trace of who accepted an exception to a mandatory encryption requirement. Exceptions without decision history cannot establish accountable risk treatment. It does not solve the specified case, for which Establish automated policy monitoring and risk-based reassessment after production changes. is appropriate.

This recommendation fits a different scenario: An external auditor requests proof that privileged data-export approvals were granted before each release. Audit evidence must connect authorization to the actual operation. It does not solve the specified case, for which Establish automated policy monitoring and risk-based reassessment after production changes. is appropriate.

This recommendation fits a different scenario: A build pipeline publishes unverified container images directly to production without independent approvals. Supply-chain assurance verifies the artifact being deployed rather than trusting an unreviewed build. It does not solve the specified case, for which Integrate code, dependency, IaC and container scanning into appropriate build gates. is appropriate.

This recommendation fits a different scenario: Developers store infrastructure credentials in deployment YAML inside a public code repository. Removing long-lived embedded secrets reduces credential exposure from source code. It does not solve the specified case, for which Integrate code, dependency, IaC and container scanning into appropriate build gates. is appropriate.

This recommendation fits a different scenario: An urgent release bypasses every automated test and leaves no evidence of who accepted the risk. Emergency speed can coexist with accountability and minimum required security checks. It does not solve the specified case, for which Integrate code, dependency, IaC and container scanning into appropriate build gates. is appropriate.

This recommendation fits a different scenario: An application creates a container with anonymous public blob read enabled for a confidential document repository. Public blob exposure bypasses the intended identity-based data boundary. It does not solve the specified case, for which Design blob versioning, soft delete and protected recovery controls as appropriate to the retention threat model. is appropriate.

This recommendation fits a different scenario: A batch job uses one account-level storage key for all containers even though it only writes to one folder. Broad persistent storage keys exceed the permissions needed by one workload. It does not solve the specified case, for which Design blob versioning, soft delete and protected recovery controls as appropriate to the retention threat model. is appropriate.

This recommendation fits a different scenario: A team enables an Azure Storage firewall but forgets to verify private endpoint DNS for on-premises consumers. Storage isolation must remain compatible with authorized application paths. It does not solve the specified case, for which Design blob versioning, soft delete and protected recovery controls as appropriate to the retention threat model. is appropriate.

This recommendation fits a different scenario: An incident commander suspends a compromised administrator but leaves an active privileged cloud session untouched. Session containment may require actions beyond account state changes. It does not solve the specified case, for which Correlate role audit events to approvals and investigate unexplained elevation. is appropriate.

This recommendation fits a different scenario: A security team wants to test emergency access without leaving a highly privileged account active in daily workflows. Recovery readiness depends on tested access and careful operational protection. It does not solve the specified case, for which Correlate role audit events to approvals and investigate unexplained elevation. is appropriate.

This recommendation fits a different scenario: A high-privilege application credential appears in a public repository and the response team plans only to delete the commit. Repository removal does not invalidate a secret that attackers may have copied. It does not solve the specified case, for which Correlate role audit events to approvals and investigate unexplained elevation. is appropriate.