Pass Your Microsoft SC-100 Exam Easy!

This recommendation fits a different scenario: A gateway logs full bearer tokens and sensitive request payloads to an unrestricted workspace. Observability should not leak the secrets and data it is intended to protect. It does not solve the specified case, for which Design governed API versioning and staged deprecation for breaking changes. is appropriate.

This recommendation fits a different scenario: A partner API receives legitimate requests but cannot distinguish which partner is allowed to call a sensitive operation. Gateway policies can enforce caller-specific API access rather than only route traffic. It does not solve the specified case, for which Design governed API versioning and staged deprecation for breaking changes. is appropriate.

This recommendation fits a different scenario: An API gateway accepts unlimited requests from every subscription and the backend repeatedly exhausts capacity. Traffic governance protects availability and enforces fair resource consumption. It does not solve the specified case, for which Design governed API versioning and staged deprecation for breaking changes. is appropriate.

This recommendation fits a different scenario: A legacy on-premises application cannot use modern federation, but a cloud access design assumes SSO alone resolves the constraint. Legacy protocols need their own migration and protection approach rather than assumed compatibility. It does not solve the specified case, for which Grant the monitoring principal a suitable scoped read role rather than subscription-wide ownership. is appropriate.

This recommendation fits a different scenario: A SaaS vendor offers SAML sign-in but employees keep separate unmanaged passwords for the service. Central identity reduces unmanaged credential stores and supports consistent access lifecycle. It does not solve the specified case, for which Grant the monitoring principal a suitable scoped read role rather than subscription-wide ownership. is appropriate.

This recommendation fits a different scenario: An Azure-hosted application uses a shared storage account key although it runs on managed compute. Managed identities avoid long-lived application secrets and permit scoped authorization. It does not solve the specified case, for which Grant the monitoring principal a suitable scoped read role rather than subscription-wide ownership. is appropriate.

This recommendation fits a different scenario: A security team proposes blocking every legacy application immediately despite no inventory of affected business functions. Zero Trust transformation needs controlled transition rather than unplanned production lockouts. It does not solve the specified case, for which Extend Zero Trust governance to workload identities and evaluate their exact resource scopes. is appropriate.

This recommendation fits a different scenario: The organization equates network location inside its headquarters with unrestricted trust. Zero Trust does not assume a trusted user solely from an internal IP address. It does not solve the specified case, for which Extend Zero Trust governance to workload identities and evaluate their exact resource scopes. is appropriate.

This recommendation fits a different scenario: A Zero Trust roadmap lists technologies but never defines the current maturity of the identity and device estate. Adoption is a staged capability program rather than a single product installation. It does not solve the specified case, for which Extend Zero Trust governance to workload identities and evaluate their exact resource scopes. is appropriate.

This recommendation fits a different scenario: An enterprise collects custom firewall and application logs from several clouds that lack native XDR incident correlation. A SIEM provides flexible collection and analytics across disparate telemetry sources. It does not solve the specified case, for which Plan the supported Defender portal and Sentinel integration model with clear incident ownership. is appropriate.

This recommendation fits a different scenario: A threat detection program buys SIEM capacity without deciding which signals are needed or their retention costs. Detection-driven collection balances forensic coverage with sustainable telemetry costs. It does not solve the specified case, for which Plan the supported Defender portal and Sentinel integration model with clear incident ownership. is appropriate.

This recommendation fits a different scenario: A global SOC monitors endpoint, identity and email attacks but cannot correlate them into a single investigation. XDR groups related endpoint, identity and email evidence into coherent attack investigations. It does not solve the specified case, for which Plan the supported Defender portal and Sentinel integration model with clear incident ownership. is appropriate.

This recommendation fits a different scenario: A company registers agent identities but has no lifecycle owner or process for revoking their access after retirement. Nonhuman principals can retain persistent access after the associated workflow stops. It does not solve the specified case, for which Require policy checks and explicit approval for sensitive agent tool actions. is appropriate.

This recommendation fits a different scenario: A cross-tenant agent integration is proposed without verifying the current Microsoft Entra Agent ID feature and licensing support. Preview and GA boundaries can affect which agent access controls are available in a given tenant. It does not solve the specified case, for which Require policy checks and explicit approval for sensitive agent tool actions. is appropriate.

This recommendation fits a different scenario: An autonomous assistant needs to call an internal ticket API without inheriting its developer's personal Global Administrator token. Agent authorization should be separable from the human user's broad administrative roles. It does not solve the specified case, for which Require policy checks and explicit approval for sensitive agent tool actions. is appropriate.

This recommendation fits a different scenario: A security program patches database servers but ignores the excessive data-reader permissions granted to application service accounts. Compromised application identities can expose data even on fully patched servers. It does not solve the specified case, for which Establish data incident triage that confirms identities, accessed records and containment scope. is appropriate.

This recommendation fits a different scenario: A hospital stores deidentified metrics and raw patient records in one account with identical sharing permissions. High-sensitivity records need protection proportionate to disclosure consequences. It does not solve the specified case, for which Establish data incident triage that confirms identities, accessed records and containment scope. is appropriate.

This recommendation fits a different scenario: An analyst exports large quantities of customer data to personal cloud storage without triggering monitoring. Risky data movement requires context-aware controls beyond source encryption. It does not solve the specified case, for which Establish data incident triage that confirms identities, accessed records and containment scope. is appropriate.

This recommendation fits a different scenario: A high-traffic public web service is exposed to volumetric network floods beyond ordinary application request limits. Volumetric availability attacks require controls distinct from application-layer validation. It does not solve the specified case, for which Configure appropriate WAF rate-limiting or bot protection rules with measured exception handling. is appropriate.

This recommendation fits a different scenario: A web application firewall blocks one SQL injection pattern but its origin server remains reachable through a separate public IP. WAF policy cannot defend traffic routed around the protected edge. It does not solve the specified case, for which Configure appropriate WAF rate-limiting or bot protection rules with measured exception handling. is appropriate.

This recommendation fits a different scenario: A company deploys an edge WAF but never audits rule logs after legitimate customer requests begin failing. Protective rules need operational assurance to avoid undetected service disruption. It does not solve the specified case, for which Configure appropriate WAF rate-limiting or bot protection rules with measured exception handling. is appropriate.

This recommendation fits a different scenario: A database is encrypted and backed up, but audit trails for sensitive query activity are not retained. Confidentiality and recovery controls do not replace detection and attribution of data access. It does not solve the specified case, for which Define workspace, SQL and storage data-plane entitlements separately for Synapse workloads. is appropriate.

This recommendation fits a different scenario: An Azure SQL workload permits password access from the entire internet even though only managed Azure services need it. Reducing public access and shared credentials protects database entry points. It does not solve the specified case, for which Define workspace, SQL and storage data-plane entitlements separately for Synapse workloads. is appropriate.

This recommendation fits a different scenario: A Cosmos DB workload embeds a full-account key in client applications distributed to external users. Exposed account secrets permit operations beyond the intended end-user rights. It does not solve the specified case, for which Define workspace, SQL and storage data-plane entitlements separately for Synapse workloads. is appropriate.

This recommendation fits a different scenario: A workload team claims that a Defender for Cloud recommendation automatically proves every control in a security benchmark is satisfied. Product recommendations are signals, not definitive proof of complete control compliance. It does not solve the specified case, for which Specify benchmark-aligned encryption and key management standards with consistent exception criteria. is appropriate.

This recommendation fits a different scenario: An organization adopts a security benchmark but never revisits it after changing cloud service models. Required controls may shift between customer and provider as service models evolve. It does not solve the specified case, for which Specify benchmark-aligned encryption and key management standards with consistent exception criteria. is appropriate.

This recommendation fits a different scenario: Auditors receive a dashboard of deployed services but no mapping between controls and organizational security standards. Benchmark alignment relates deployed safeguards to measurable security obligations. It does not solve the specified case, for which Specify benchmark-aligned encryption and key management standards with consistent exception criteria. is appropriate.

This recommendation fits a different scenario: A landing zone is provisioned without any central diagnostic or security event destination. Security telemetry needs to be established as part of the platform baseline, not added after an incident. It does not solve the specified case, for which Define reusable least-privilege RBAC assignments at management-group, subscription and resource scopes. is appropriate.

This recommendation fits a different scenario: Developers are creating independent production subscriptions without consistent management-group policy inheritance. Inherited controls allow consistent organization-wide baselines while retaining workload delegation. It does not solve the specified case, for which Define reusable least-privilege RBAC assignments at management-group, subscription and resource scopes. is appropriate.

This recommendation fits a different scenario: An application team wants to deploy production Azure resources into any region without review. Location restrictions translate residency policy into preventive resource configuration. It does not solve the specified case, for which Define reusable least-privilege RBAC assignments at management-group, subscription and resource scopes. is appropriate.

This recommendation fits a different scenario: A detection rule catches a false-positive administrative script, and the owner asks for blanket script exclusions. Scoped exceptions limit noise without removing visibility for genuine malicious variants. It does not solve the specified case, for which Design behavioral detections and threat-hunting hypotheses beyond one static indicator. is appropriate.

This recommendation fits a different scenario: A SOC promotes every external threat indicator to a high-severity alert without validating matches against tenant events. Intelligence relevance depends on actual environment observations rather than feed labels alone. It does not solve the specified case, for which Design behavioral detections and threat-hunting hypotheses beyond one static indicator. is appropriate.

This recommendation fits a different scenario: Endpoint detectors become noisy after a new sensor rollout, and leadership believes attacks have doubled. Improved visibility can increase alert counts without a matching change in attacker activity. It does not solve the specified case, for which Design behavioral detections and threat-hunting hypotheses beyond one static indicator. is appropriate.