Pass Your Microsoft SC-100 Exam Easy!

This recommendation fits a different scenario: A security review finds administrative role changes with no change ticket or recorded business purpose. Privileged authorization needs traceability between approvals and actual assignment. It does not solve the specified case, for which Revoke and rotate the exposed credential, then investigate its use and effective grants. is appropriate.

This recommendation fits a different scenario: A security team wants to test emergency access without leaving a highly privileged account active in daily workflows. Recovery readiness depends on tested access and careful operational protection. It does not solve the specified case, for which Revoke and rotate the exposed credential, then investigate its use and effective grants. is appropriate.

This recommendation fits a different scenario: An incident commander suspends a compromised administrator but leaves an active privileged cloud session untouched. Session containment may require actions beyond account state changes. It does not solve the specified case, for which Revoke and rotate the exposed credential, then investigate its use and effective grants. is appropriate.

This recommendation fits a different scenario: A contractor's access remains active after their approved business engagement ends. External identity access must track business sponsorship and contract lifecycle. It does not solve the specified case, for which Combine least-privilege data roles, sensitive-data monitoring and governed exfiltration controls. is appropriate.

This recommendation fits a different scenario: A supply-chain incident compromises a trusted vendor integration that has tenant-wide API permissions. Vendor compromise impact depends on the permissions and persistence granted to the integration. It does not solve the specified case, for which Combine least-privilege data roles, sensitive-data monitoring and governed exfiltration controls. is appropriate.

This recommendation fits a different scenario: An external attacker obtains one employee password and can access several administrative interfaces without a new check. Strong authentication and risk evaluation limit credential replay across privileged surfaces. It does not solve the specified case, for which Combine least-privilege data roles, sensitive-data monitoring and governed exfiltration controls. is appropriate.

This recommendation fits a different scenario: A scheduled job authenticates with a certificate embedded inside a container image copied to every environment. Image distribution must not spread persistent private keys across deployments. It does not solve the specified case, for which Grant its managed identity scoped Azure RBAC for the required storage data operations. is appropriate.

This recommendation fits a different scenario: A Kubernetes pod receives cluster admin privileges to access one Azure Key Vault secret. Access to a cloud secret does not require Kubernetes control-plane administration. It does not solve the specified case, for which Grant its managed identity scoped Azure RBAC for the required storage data operations. is appropriate.

This recommendation fits a different scenario: A service-to-service request succeeds with an OAuth token that belongs to the wrong audience. A valid token for one API does not authorize access to a different service. It does not solve the specified case, for which Grant its managed identity scoped Azure RBAC for the required storage data operations. is appropriate.

This recommendation fits a different scenario: The organization requires suspicious attachments analyzed before employees open them. Dynamic attachment analysis can detect threats that simple filename or signature checks miss. It does not solve the specified case, for which Design targeted anti-phishing impersonation protection using Defender for Office 365. is appropriate.

This recommendation fits a different scenario: A SOC can identify malicious email but lacks a governed process to remove matching messages from other mailboxes. Campaign-level investigation should lead to controlled response across actual affected recipients. It does not solve the specified case, for which Design targeted anti-phishing impersonation protection using Defender for Office 365. is appropriate.

This recommendation fits a different scenario: Employees often click links that become malicious after a message was delivered. URL risk can change between delivery and user interaction, so click-time inspection provides a separate protection opportunity. It does not solve the specified case, for which Design targeted anti-phishing impersonation protection using Defender for Office 365. is appropriate.

This recommendation fits a different scenario: A reimaged laptop appears under three device records and skews threat inventory counts. Accurate inventory is required for meaningful exposure and coverage metrics. It does not solve the specified case, for which Design containment verification and an alternate response path for unreachable devices. is appropriate.

This recommendation fits a different scenario: An attacker disables endpoint telemetry, and the operations team interprets no alerts as no compromise. Telemetry loss can hide attacks and should itself be investigated. It does not solve the specified case, for which Design containment verification and an alternate response path for unreachable devices. is appropriate.

This recommendation fits a different scenario: A client malware alert is closed when the process exits but persistence tasks remain installed. A stopped process does not prove a threat is fully eradicated if persistence mechanisms and related identities remain compromised. It does not solve the specified case, for which Design containment verification and an alternate response path for unreachable devices. is appropriate.

This recommendation fits a different scenario: A vendor engagement ends, but B2B guest users remain members of multiple security groups. Removing one shared link may leave app and group permissions intact, so the full guest entitlement inventory must be reviewed. It does not solve the specified case, for which Use a governed Microsoft Entra B2B cross-tenant collaboration design with scoped resource grants. is appropriate.

This recommendation fits a different scenario: A team wants to rely on a verifiable credential to attest a training qualification without copying the holder's complete identity file. Decentralized credentials can convey attestations without unnecessary personal-data transfer. It does not solve the specified case, for which Use a governed Microsoft Entra B2B cross-tenant collaboration design with scoped resource grants. is appropriate.

This recommendation fits a different scenario: A security architect assumes that verification of an external credential automatically grants access to every company application. Proving an attribute does not override resource-specific permissions. It does not solve the specified case, for which Use a governed Microsoft Entra B2B cross-tenant collaboration design with scoped resource grants. is appropriate.

This recommendation fits a different scenario: Multiple application tiers use a single broad network security group allowing all east-west traffic. Explicit flow restrictions reduce lateral movement between tiers. It does not solve the specified case, for which Design private endpoints and controlled network routing for the database service. is appropriate.

This recommendation fits a different scenario: A hybrid application requires private connectivity but its on-premises network cannot resolve the private endpoint's DNS name. Private connectivity depends on routing and correct name resolution together. It does not solve the specified case, for which Design private endpoints and controlled network routing for the database service. is appropriate.

This recommendation fits a different scenario: An enterprise deploys two regional hubs but forgets to validate asymmetric return traffic through inspection appliances. Inconsistent forward and return paths can break stateful filtering or bypass expected controls. It does not solve the specified case, for which Design private endpoints and controlled network routing for the database service. is appropriate.

This recommendation fits a different scenario: A managed identity can change production network routing despite only needing to read telemetry. Workload identity privileges should be aligned to functions rather than environment ownership. It does not solve the specified case, for which Review effective cloud entitlements and remove unnecessary standing role grants. is appropriate.

This recommendation fits a different scenario: The security team sees role assignments but cannot tell whether users actually exercise their entitlements. Permission presence and actual use both inform the risk of persistent access. It does not solve the specified case, for which Review effective cloud entitlements and remove unnecessary standing role grants. is appropriate.

This recommendation fits a different scenario: A project uses identical privilege reports for Azure and AWS while ignoring provider-specific permission semantics. Multicloud access review needs comparable exposure without assuming the role models are identical. It does not solve the specified case, for which Review effective cloud entitlements and remove unnecessary standing role grants. is appropriate.

This recommendation fits a different scenario: A business continuity plan has no schedule to re-test after the organization moves its primary data platform to another cloud. Recovery documentation becomes unreliable when topology and dependencies evolve without corresponding drills. It does not solve the specified case, for which Assign incident recovery decision rights and approval gates for sensitive data access. is appropriate.

This recommendation fits a different scenario: Two response teams execute contradictory network isolation and service restoration commands during the same ransomware drill. Coordinated authority prevents responders from undoing each other's actions under crisis conditions. It does not solve the specified case, for which Assign incident recovery decision rights and approval gates for sensitive data access. is appropriate.

This recommendation fits a different scenario: Recovery tests meet infrastructure RTOs but fail business-user sign-off because downstream reports lack recent data. Resilience success requires restored business outcomes, not solely server availability. It does not solve the specified case, for which Assign incident recovery decision rights and approval gates for sensitive data access. is appropriate.

This recommendation fits a different scenario: A device gateway accepts unencrypted readings from field sensors across untrusted networks. Protected communication mitigates impersonation and disclosure along sensor paths. It does not solve the specified case, for which Require unique device identity, credential provisioning and asset inventory for IoT onboarding. is appropriate.

This recommendation fits a different scenario: An IoT fleet cannot be patched remotely and no one has documented expected service life or retirement. Unpatchable devices accumulate risk that must be managed through lifecycle planning. It does not solve the specified case, for which Require unique device identity, credential provisioning and asset inventory for IoT onboarding. is appropriate.

This recommendation fits a different scenario: A retail sensor network shares routing with payment processing servers despite no operational dependency. Network isolation reduces lateral movement from less-managed devices to sensitive services. It does not solve the specified case, for which Require unique device identity, credential provisioning and asset inventory for IoT onboarding. is appropriate.

This recommendation fits a different scenario: A gateway logs full bearer tokens and sensitive request payloads to an unrestricted workspace. Observability should not leak the secrets and data it is intended to protect. It does not solve the specified case, for which Design authenticated partner identities and per-API authorization in Azure API Management. is appropriate.

This recommendation fits a different scenario: An API gateway accepts unlimited requests from every subscription and the backend repeatedly exhausts capacity. Traffic governance protects availability and enforces fair resource consumption. It does not solve the specified case, for which Design authenticated partner identities and per-API authorization in Azure API Management. is appropriate.

This recommendation fits a different scenario: An architect publishes an API without a revision or version policy, breaking all consumers when its contract changes. Explicit version lifecycle protects dependent applications during interface evolution. It does not solve the specified case, for which Design authenticated partner identities and per-API authorization in Azure API Management. is appropriate.