Pass Your Microsoft SC-100 Exam Easy!

This recommendation fits a different scenario: A pod runs as a privileged root container with host filesystem mounts for routine application logging. Privileged containers expand the impact of an application compromise to the host. It does not solve the specified case, for which Include image and dependency scanning for the exact release artifact. is appropriate.

This recommendation fits a different scenario: Runtime detections are missing for workloads in a managed Kubernetes cluster despite completed image scanning. Build-time scanning does not observe malicious behavior after deployment. It does not solve the specified case, for which Include image and dependency scanning for the exact release artifact. is appropriate.

This recommendation fits a different scenario: Developers deploy container images directly from an unverified personal registry into production. Secure container supply chains need confidence in artifact origin and content. It does not solve the specified case, for which Include image and dependency scanning for the exact release artifact. is appropriate.

This recommendation fits a different scenario: A workload owner requests a permanent exemption from encryption requirements for a short migration. Exceptions should not silently become enduring gaps in platform policy. It does not solve the specified case, for which Manage shared security templates through branch review and controlled pipeline promotion. is appropriate.

This recommendation fits a different scenario: Administrators make portal edits in production that drift from approved landing-zone templates. Reproducible templates make changes auditable and reduce hidden production variance. It does not solve the specified case, for which Manage shared security templates through branch review and controlled pipeline promotion. is appropriate.

This recommendation fits a different scenario: A team moves a policy assignment into enforcement without testing its effect on existing resources. Preventive policy can disrupt existing operations if not assessed first. It does not solve the specified case, for which Manage shared security templates through branch review and controlled pipeline promotion. is appropriate.

This recommendation fits a different scenario: Security standards require all new storage accounts to disable anonymous public blob access. Preventive guardrails stop noncompliant resources before they become exposed. It does not solve the specified case, for which Require scoped Azure Policy exemptions with recorded rationale, owner and end date. is appropriate.

This recommendation fits a different scenario: Existing resources violate a required diagnostic-settings policy, but the team assumes a policy assignment changes them retroactively. Assessment and remediation are different actions for already-deployed resources. It does not solve the specified case, for which Require scoped Azure Policy exemptions with recorded rationale, owner and end date. is appropriate.

This recommendation fits a different scenario: A compliance team uses an initiative for common controls but cannot identify which resource failed each policy. Aggregated scores cannot replace specific failed-resource findings. It does not solve the specified case, for which Require scoped Azure Policy exemptions with recorded rationale, owner and end date. is appropriate.

This recommendation fits a different scenario: An architect enables all data threat protection plans without assessing resource coverage and ongoing ingestion cost. Protection choices should be justified by workload exposure and supported capabilities. It does not solve the specified case, for which Correlate Defender storage detections with resource identity, workload owner and activity logs. is appropriate.

This recommendation fits a different scenario: A security architect turns on Defender for Cloud posture recommendations for storage but expects runtime alerts on malicious blob access automatically. Storage-specific threat protection is distinct from configuration assessment. It does not solve the specified case, for which Correlate Defender storage detections with resource identity, workload owner and activity logs. is appropriate.

This recommendation fits a different scenario: A SQL team reviews vulnerability recommendations but has no way to investigate suspicious database queries. Data-plane attacks require investigation signals beyond posture findings. It does not solve the specified case, for which Correlate Defender storage detections with resource identity, workload owner and activity logs. is appropriate.

This recommendation fits a different scenario: A SOC cannot explain which playbook isolated a device after several overlapping detections. Automation needs traceability to support review, rollback and accountability. It does not solve the specified case, for which Design action-center review and approval responsibilities into the response workflow. is appropriate.

This recommendation fits a different scenario: A Sentinel analytic rule produces hundreds of identical alerts, and analysts manually open tickets for each. SOAR automates repeatable steps while preserving scoped triggering and response authority. It does not solve the specified case, for which Design action-center review and approval responsibilities into the response workflow. is appropriate.

This recommendation fits a different scenario: An automation deletes suspicious users immediately based only on a low-confidence anomaly signal. Security automation must reflect confidence and potential business disruption. It does not solve the specified case, for which Design action-center review and approval responsibilities into the response workflow. is appropriate.

This recommendation fits a different scenario: A web workload has public TLS but uses plaintext connections between its internal service and database. Internet TLS does not automatically secure backend service communications. It does not solve the specified case, for which Separate web, application and data tiers using controlled network segmentation. is appropriate.

This recommendation fits a different scenario: A public API accepts traffic directly on its application origin even though the architecture diagram shows an edge firewall. A bypassable edge control cannot filter traffic that reaches the origin directly. It does not solve the specified case, for which Separate web, application and data tiers using controlled network segmentation. is appropriate.

This recommendation fits a different scenario: An online store is targeted by repetitive automated login attempts, and the team only considers storage encryption. Credential stuffing is an application authentication threat rather than a data-at-rest issue. It does not solve the specified case, for which Separate web, application and data tiers using controlled network segmentation. is appropriate.

This recommendation fits a different scenario: The AI governance board approves a model but no one owns evaluations for harmful outputs or data leakage. Model approval needs measurable evidence and accountable remediation of observed safety failures. It does not solve the specified case, for which Define permitted training and fine-tuning data categories and privacy protections. is appropriate.

This recommendation fits a different scenario: An autonomous AI agent can call production administration tools with the operator's full credentials. An agent must not inherit unrestricted human powers merely because it is asked to automate tasks. It does not solve the specified case, for which Define permitted training and fine-tuning data categories and privacy protections. is appropriate.

This recommendation fits a different scenario: A company wants to deploy an AI assistant to answer HR questions but has not inventoried the sensitive data sources. Secure AI design starts with knowing which data the assistant may retrieve and expose. It does not solve the specified case, for which Define permitted training and fine-tuning data categories and privacy protections. is appropriate.

This recommendation fits a different scenario: A phishing case is closed as resolved after mailbox cleanup although attacker-issued OAuth grants remain active. Removing an initial artifact does not establish that access mechanisms have been removed. It does not solve the specified case, for which Require confirmation of containment state and follow-up monitoring in incident playbooks. is appropriate.

This recommendation fits a different scenario: After a breach, investigators have no process to incorporate lessons into detection coverage. Repeated attack patterns persist if improvements are not linked to incidents. It does not solve the specified case, for which Require confirmation of containment state and follow-up monitoring in incident playbooks. is appropriate.

This recommendation fits a different scenario: A critical incident is assigned to several teams without a named incident commander or escalation owner. A defined response lifecycle prevents conflicting containment and missed handoffs. It does not solve the specified case, for which Require confirmation of containment state and follow-up monitoring in incident playbooks. is appropriate.

This recommendation fits a different scenario: An AI service sends model prompts into logs containing personal identifiers with indefinite retention. AI operational telemetry can itself contain sensitive regulated content. It does not solve the specified case, for which Treat model input and retrieved text as untrusted, and gate privileged tool execution with policy. is appropriate.

This recommendation fits a different scenario: An Azure AI service endpoint allows public anonymous queries because its output includes safety moderation. Content moderation does not authorize callers or prevent resource abuse. It does not solve the specified case, for which Treat model input and retrieved text as untrusted, and gate privileged tool execution with policy. is appropriate.

This recommendation fits a different scenario: An AI model accesses a document index containing unrelated departments' confidential files. AI applications must respect original data entitlements during retrieval. It does not solve the specified case, for which Treat model input and retrieved text as untrusted, and gate privileged tool execution with policy. is appropriate.

This recommendation fits a different scenario: A hospital has recovery objectives but has never quantified the maximum permissible data loss for patient scheduling. RPO specifies acceptable data loss and drives backup and replication design rather than merely restoration time. It does not solve the specified case, for which Build a dependency map and test recovery of the identity, network and data services required by order processing. is appropriate.

This recommendation fits a different scenario: Executives prioritize systems only by purchase cost, ignoring the operational harm of a manufacturing shutdown. Criticality reflects consequences for the mission and safety, not only the acquisition cost of hardware. It does not solve the specified case, for which Build a dependency map and test recovery of the identity, network and data services required by order processing. is appropriate.

This recommendation fits a different scenario: A retailer cannot decide which workloads to restore first because all servers have equal priority labels. Business impact analysis distinguishes business-critical recovery order from an undifferentiated inventory of machines. It does not solve the specified case, for which Build a dependency map and test recovery of the identity, network and data services required by order processing. is appropriate.

This recommendation fits a different scenario: The security architect wants to prioritize tenant security improvements but cannot quantify the impact of disrupting daily collaboration. Security priorities should integrate risk reduction and operating continuity. It does not solve the specified case, for which Normalize posture assessment for licensed controls, coverage and business-critical workloads. is appropriate.

This recommendation fits a different scenario: A collaboration tenant has several risky sharing settings but leadership only tracks purchased security licenses. Security product licensing does not establish that recommended controls are enabled. It does not solve the specified case, for which Normalize posture assessment for licensed controls, coverage and business-critical workloads. is appropriate.

This recommendation fits a different scenario: A Secure Score rises after a control receives an exception status although the underlying user access configuration is unchanged. Assessment scores may not prove an unsafe configuration has been repaired. It does not solve the specified case, for which Normalize posture assessment for licensed controls, coverage and business-critical workloads. is appropriate.