Pass Your Microsoft SC-100 Exam Easy!

This recommendation fits a different scenario: An incident commander suspends a compromised administrator but leaves an active privileged cloud session untouched. Session containment may require actions beyond account state changes. It does not solve the specified case, for which Correlate role audit events to approvals and investigate unexplained elevation. is appropriate.

This recommendation fits a different scenario: A security team wants to test emergency access without leaving a highly privileged account active in daily workflows. Recovery readiness depends on tested access and careful operational protection. It does not solve the specified case, for which Correlate role audit events to approvals and investigate unexplained elevation. is appropriate.

This recommendation fits a different scenario: A high-privilege application credential appears in a public repository and the response team plans only to delete the commit. Repository removal does not invalidate a secret that attackers may have copied. It does not solve the specified case, for which Correlate role audit events to approvals and investigate unexplained elevation. is appropriate.

This recommendation fits a different scenario: A privileged insider can export an entire regulated dataset despite only needing aggregate reports. Restricting broad read access and detecting risky movement reduce insider-data exposure. It does not solve the specified case, for which Implement time-bound entitlements with periodic access reviews and automatic deprovisioning. is appropriate.

This recommendation fits a different scenario: An external attacker obtains one employee password and can access several administrative interfaces without a new check. Strong authentication and risk evaluation limit credential replay across privileged surfaces. It does not solve the specified case, for which Implement time-bound entitlements with periodic access reviews and automatic deprovisioning. is appropriate.

This recommendation fits a different scenario: A supply-chain incident compromises a trusted vendor integration that has tenant-wide API permissions. Vendor compromise impact depends on the permissions and persistence granted to the integration. It does not solve the specified case, for which Implement time-bound entitlements with periodic access reviews and automatic deprovisioning. is appropriate.

This recommendation fits a different scenario: A scheduled job authenticates with a certificate embedded inside a container image copied to every environment. Image distribution must not spread persistent private keys across deployments. It does not solve the specified case, for which Design supported workload identity federation and Key Vault data permissions for that pod. is appropriate.

This recommendation fits a different scenario: A service-to-service request succeeds with an OAuth token that belongs to the wrong audience. A valid token for one API does not authorize access to a different service. It does not solve the specified case, for which Design supported workload identity federation and Key Vault data permissions for that pod. is appropriate.

This recommendation fits a different scenario: An Azure Function needs to read a single storage container but currently stores the account access key. Scoped managed identity eliminates reusable account keys and narrows permitted operations. It does not solve the specified case, for which Design supported workload identity federation and Key Vault data permissions for that pod. is appropriate.

This recommendation fits a different scenario: A SOC can identify malicious email but lacks a governed process to remove matching messages from other mailboxes. Campaign-level investigation should lead to controlled response across actual affected recipients. It does not solve the specified case, for which Evaluate Safe Attachments detonation and disposition policy for protected recipient groups. is appropriate.

This recommendation fits a different scenario: A financial services tenant receives executive impersonation messages and only basic bulk-spam filtering is configured. Impersonation controls address targeted sender deception beyond generic spam volume. It does not solve the specified case, for which Evaluate Safe Attachments detonation and disposition policy for protected recipient groups. is appropriate.

This recommendation fits a different scenario: Employees often click links that become malicious after a message was delivered. URL risk can change between delivery and user interaction, so click-time inspection provides a separate protection opportunity. It does not solve the specified case, for which Evaluate Safe Attachments detonation and disposition policy for protected recipient groups. is appropriate.

This recommendation fits a different scenario: A client malware alert is closed when the process exits but persistence tasks remain installed. A stopped process does not prove a threat is fully eradicated if persistence mechanisms and related identities remain compromised. It does not solve the specified case, for which Alert on missing sensor check-in and integrity anomalies as security signals. is appropriate.

This recommendation fits a different scenario: A SOC tries to isolate a compromised endpoint but the device has been offline since yesterday. A remote isolation request may remain pending without endpoint connectivity. It does not solve the specified case, for which Alert on missing sensor check-in and integrity anomalies as security signals. is appropriate.

This recommendation fits a different scenario: A reimaged laptop appears under three device records and skews threat inventory counts. Accurate inventory is required for meaningful exposure and coverage metrics. It does not solve the specified case, for which Alert on missing sensor check-in and integrity anomalies as security signals. is appropriate.

This recommendation fits a different scenario: A security architect assumes that verification of an external credential automatically grants access to every company application. Proving an attribute does not override resource-specific permissions. It does not solve the specified case, for which Evaluate supported verifiable credential issuance and presentation with minimum disclosed claims. is appropriate.

This recommendation fits a different scenario: A partner organization needs access to one project application but should retain its own identity administration. B2B collaboration preserves independent home identities while limiting access to approved resources. It does not solve the specified case, for which Evaluate supported verifiable credential issuance and presentation with minimum disclosed claims. is appropriate.

This recommendation fits a different scenario: A vendor engagement ends, but B2B guest users remain members of multiple security groups. Removing one shared link may leave app and group permissions intact, so the full guest entitlement inventory must be reviewed. It does not solve the specified case, for which Evaluate supported verifiable credential issuance and presentation with minimum disclosed claims. is appropriate.

This recommendation fits a different scenario: A regulated database is directly exposed to internet clients despite only internal applications needing connections. Limiting public reachability reduces exposure of sensitive data-plane interfaces. It does not solve the specified case, for which Include private DNS resolution and forwarding in the hybrid network design. is appropriate.

This recommendation fits a different scenario: Multiple application tiers use a single broad network security group allowing all east-west traffic. Explicit flow restrictions reduce lateral movement between tiers. It does not solve the specified case, for which Include private DNS resolution and forwarding in the hybrid network design. is appropriate.

This recommendation fits a different scenario: An enterprise deploys two regional hubs but forgets to validate asymmetric return traffic through inspection appliances. Inconsistent forward and return paths can break stateful filtering or bypass expected controls. It does not solve the specified case, for which Include private DNS resolution and forwarding in the hybrid network design. is appropriate.

This recommendation fits a different scenario: An Azure subscription has hundreds of unused Owner roles assigned to service principals. Excess cloud permissions create takeover paths for dormant identities. It does not solve the specified case, for which Reduce its effective permissions to diagnostics-read operations at the smallest practical resource scope. is appropriate.

This recommendation fits a different scenario: A project uses identical privilege reports for Azure and AWS while ignoring provider-specific permission semantics. Multicloud access review needs comparable exposure without assuming the role models are identical. It does not solve the specified case, for which Reduce its effective permissions to diagnostics-read operations at the smallest practical resource scope. is appropriate.

This recommendation fits a different scenario: The security team sees role assignments but cannot tell whether users actually exercise their entitlements. Permission presence and actual use both inform the risk of persistent access. It does not solve the specified case, for which Reduce its effective permissions to diagnostics-read operations at the smallest practical resource scope. is appropriate.

This recommendation fits a different scenario: A business continuity plan has no schedule to re-test after the organization moves its primary data platform to another cloud. Recovery documentation becomes unreliable when topology and dependencies evolve without corresponding drills. It does not solve the specified case, for which Include business-process owners and freshness acceptance criteria in disaster-recovery testing. is appropriate.

This recommendation fits a different scenario: A tabletop exercise tests backup retrieval but never identifies who can authorize a regulated-data restoration. Governance controls establish who can use recovery material and preserve accountability during emergencies. It does not solve the specified case, for which Include business-process owners and freshness acceptance criteria in disaster-recovery testing. is appropriate.

This recommendation fits a different scenario: Two response teams execute contradictory network isolation and service restoration commands during the same ransomware drill. Coordinated authority prevents responders from undoing each other's actions under crisis conditions. It does not solve the specified case, for which Include business-process owners and freshness acceptance criteria in disaster-recovery testing. is appropriate.

This recommendation fits a different scenario: A retail sensor network shares routing with payment processing servers despite no operational dependency. Network isolation reduces lateral movement from less-managed devices to sensitive services. It does not solve the specified case, for which Specify secure update capability and controlled end-of-life replacement for embedded devices. is appropriate.

This recommendation fits a different scenario: Facilities deploy thousands of smart building sensors with default passwords and no central device registry. Device identity controls prevent shared default credentials from scaling into systemic exposure. It does not solve the specified case, for which Specify secure update capability and controlled end-of-life replacement for embedded devices. is appropriate.

This recommendation fits a different scenario: A device gateway accepts unencrypted readings from field sensors across untrusted networks. Protected communication mitigates impersonation and disclosure along sensor paths. It does not solve the specified case, for which Specify secure update capability and controlled end-of-life replacement for embedded devices. is appropriate.

This recommendation fits a different scenario: A gateway logs full bearer tokens and sensitive request payloads to an unrestricted workspace. Observability should not leak the secrets and data it is intended to protect. It does not solve the specified case, for which Design governed API versioning and staged deprecation for breaking changes. is appropriate.

This recommendation fits a different scenario: A partner API receives legitimate requests but cannot distinguish which partner is allowed to call a sensitive operation. Gateway policies can enforce caller-specific API access rather than only route traffic. It does not solve the specified case, for which Design governed API versioning and staged deprecation for breaking changes. is appropriate.

This recommendation fits a different scenario: An API gateway accepts unlimited requests from every subscription and the backend repeatedly exhausts capacity. Traffic governance protects availability and enforces fair resource consumption. It does not solve the specified case, for which Design governed API versioning and staged deprecation for breaking changes. is appropriate.