Pass Your Microsoft SC-100 Exam Easy!

This recommendation fits a different scenario: An architect enables a tenant-wide block policy without testing emergency account access or report-only results. Controlled policy rollout prevents accidental loss of all tenant administration. It does not solve the specified case, for which Diagnose applied Conditional Access evaluations in the user's sign-in logs. is appropriate.

This recommendation fits a different scenario: A sensitive app requires new access checks when account risk changes after a session was established. CAE can respond to supported critical events without simply assuming every token expires immediately. It does not solve the specified case, for which Diagnose applied Conditional Access evaluations in the user's sign-in logs. is appropriate.

This recommendation fits a different scenario: A finance app must require phishing-resistant sign-in from privileged staff regardless of their office network. Strong factor requirements should follow risk and resource sensitivity rather than location alone. It does not solve the specified case, for which Diagnose applied Conditional Access evaluations in the user's sign-in logs. is appropriate.

This recommendation fits a different scenario: An internet application receives repeated SQL injection probes, but only basic network port filtering is deployed. Application-layer WAF inspection can address HTTP attack patterns outside port-based firewall scope. It does not solve the specified case, for which Inspect WAF logs and apply narrow, justified exclusions after false-positive verification. is appropriate.

This recommendation fits a different scenario: A WAF protects the public hostname, yet the app service's direct origin URL is still reachable. The perimeter defense is ineffective for paths that skip inspection. It does not solve the specified case, for which Inspect WAF logs and apply narrow, justified exclusions after false-positive verification. is appropriate.

This recommendation fits a different scenario: A multilingual API uses custom application routing and the architect assumes one default WAF policy covers every published endpoint. Protection applies only to ingress paths actually associated with the enforced policy. It does not solve the specified case, for which Inspect WAF logs and apply narrow, justified exclusions after false-positive verification. is appropriate.

This recommendation fits a different scenario: The enterprise needs corporate apps protected on BYOD phones without managing every personal app. Application-level management can protect enterprise data independently of full device enrollment. It does not solve the specified case, for which Include device check-in freshness and actual policy application in compliance assurance. is appropriate.

This recommendation fits a different scenario: An organization plans to wipe all user phones when employment ends, including unmanaged personal devices. Deprovisioning must match device ownership and data protection requirements. It does not solve the specified case, for which Include device check-in freshness and actual policy application in compliance assurance. is appropriate.

This recommendation fits a different scenario: A conditional access policy requires compliant devices, but unmanaged laptops have no reported compliance status. Sign-in conditions require a trustworthy management signal to evaluate device compliance. It does not solve the specified case, for which Include device check-in freshness and actual policy application in compliance assurance. is appropriate.

This recommendation fits a different scenario: A monitoring program reports zero security events from one regional site after a firewall upgrade. No alerts can indicate a broken collection pipeline rather than low attack activity. It does not solve the specified case, for which Normalize resource identifiers and business ownership fields during event correlation. is appropriate.

This recommendation fits a different scenario: Azure workloads emit alerts, but on-premises servers are absent from inventory and security baselines. A single governance plane can improve visibility for supported non-Azure machines. It does not solve the specified case, for which Normalize resource identifiers and business ownership fields during event correlation. is appropriate.

This recommendation fits a different scenario: AWS workloads are collecting logs locally, but the central SOC needs consistent incident detection across providers. Cross-provider SIEM coverage requires reliable ingestion rather than assuming Azure telemetry includes AWS automatically. It does not solve the specified case, for which Normalize resource identifiers and business ownership fields during event correlation. is appropriate.

This recommendation fits a different scenario: A SOC proposes keeping all debug logs forever despite contractual limits on personal-data retention. Investigation value must be balanced against regulatory and privacy constraints. It does not solve the specified case, for which Use restricted evidence repositories and access logging for sensitive security event exports. is appropriate.

This recommendation fits a different scenario: A regulator requires a traceable history of administrative data changes, but audit retention varies by workload. Central audit design needs workload coverage and explicit retention boundaries. It does not solve the specified case, for which Use restricted evidence repositories and access logging for sensitive security event exports. is appropriate.

This recommendation fits a different scenario: A security team logs events but fails to synchronize clocks across on-premises and cloud sources. Incorrect time alignment can obscure the order of an attack spanning multiple platforms. It does not solve the specified case, for which Use restricted evidence repositories and access logging for sensitive security event exports. is appropriate.

This recommendation fits a different scenario: A regulated database uses customer-managed encryption keys but key administrators can delete all active key versions. Losing cryptographic keys can make otherwise healthy encrypted datasets unusable. It does not solve the specified case, for which Retrieve protected secrets from a managed vault using workload identity and rotation controls. is appropriate.

This recommendation fits a different scenario: A company wants an extra layer of encryption beyond provider-managed storage encryption for selected high-risk datasets. Additional encryption layers should reflect the required threat model and service support. It does not solve the specified case, for which Retrieve protected secrets from a managed vault using workload identity and rotation controls. is appropriate.

This recommendation fits a different scenario: An application encrypts data at rest but uses plaintext connections when transferring records to a backend service. Storage encryption does not protect data traveling between processing endpoints. It does not solve the specified case, for which Retrieve protected secrets from a managed vault using workload identity and rotation controls. is appropriate.

This recommendation fits a different scenario: An administrator treats a Global Secure Access profile assignment as proof all remote devices are forwarding traffic. Desired policy assignment and observed network path may differ when the client is absent, disconnected or lacks the correct forwarding configuration. It does not solve the specified case, for which Validate Global Secure Access traffic signals with Conditional Access evaluation and supported apps. is appropriate.

This recommendation fits a different scenario: A company routes Microsoft 365 access through distant perimeter infrastructure and experiences inconsistent security controls. Targeted Microsoft traffic profiles can provide identity-aware access handling for eligible services. It does not solve the specified case, for which Validate Global Secure Access traffic signals with Conditional Access evaluation and supported apps. is appropriate.

This recommendation fits a different scenario: Two tenants collaborate but the architect assumes cross-tenant Global Secure Access controls are identical by default. Cross-tenant access needs a deliberate design for identity and forwarding semantics. It does not solve the specified case, for which Validate Global Secure Access traffic signals with Conditional Access evaluation and supported apps. is appropriate.

This recommendation fits a different scenario: A new workload is added to the estate but never appears in the security team's compliance reports. An unmonitored resource cannot be assumed compliant or protected. It does not solve the specified case, for which Design guardrail enforcement and continuous assessment using Azure Policy and Defender for Cloud. is appropriate.

This recommendation fits a different scenario: A hybrid cloud security review has no baseline for comparing Azure workload settings against Microsoft recommendations. Benchmark-linked assessments provide a structured view of configuration gaps across supported workloads. It does not solve the specified case, for which Design guardrail enforcement and continuous assessment using Azure Policy and Defender for Cloud. is appropriate.

This recommendation fits a different scenario: A security officer sees a Secure Score increase and assumes no exploitable public endpoints remain. A summary posture metric does not establish that every attack path has been removed. It does not solve the specified case, for which Design guardrail enforcement and continuous assessment using Azure Policy and Defender for Cloud. is appropriate.

This recommendation fits a different scenario: An enterprise compares OT threats with only workstation-focused MITRE ATT&CK techniques. Industrial attacker techniques and monitoring assumptions differ from enterprise IT. It does not solve the specified case, for which Design a controlled industrial DMZ and brokered time-limited vendor access path. is appropriate.

This recommendation fits a different scenario: An industrial facility wants security monitoring without installing active scanners that may disrupt fragile controllers. Passive observation helps discover industrial assets without unsafe active interrogation. It does not solve the specified case, for which Design a controlled industrial DMZ and brokered time-limited vendor access path. is appropriate.

This recommendation fits a different scenario: The SOC receives PLC network alerts but has no plant owner authorized to investigate a process anomaly. Cyber response in industrial systems must account for physical safety and process availability. It does not solve the specified case, for which Design a controlled industrial DMZ and brokered time-limited vendor access path. is appropriate.

This recommendation fits a different scenario: A tier-zero AD DS service account password is shared in plaintext across several automation scripts. Controlled service identities reduce credential theft and privilege persistence. It does not solve the specified case, for which Prepare offline forest recovery procedures with independent trusted credentials and isolated recovery hosts. is appropriate.

This recommendation fits a different scenario: Domain controllers allow unconstrained remote administrative access from ordinary user networks. Tier-zero access boundaries limit exposure of the domain's most sensitive systems. It does not solve the specified case, for which Prepare offline forest recovery procedures with independent trusted credentials and isolated recovery hosts. is appropriate.

This recommendation fits a different scenario: A security audit detects privileged group membership changes but there is no comparison against an approved baseline. Drift detection makes covert privilege expansion more visible and creates an alertable comparison with approved directory group membership. It does not solve the specified case, for which Prepare offline forest recovery procedures with independent trusted credentials and isolated recovery hosts. is appropriate.

This recommendation fits a different scenario: A Defender posture report shows hundreds of failed checks but the team lacks a risk-ranked remediation plan. Prioritized mitigation directs effort to meaningful exposure rather than check counts. It does not solve the specified case, for which Normalize posture comparisons for coverage, eligibility and differing assessed resource populations. is appropriate.

This recommendation fits a different scenario: An application cannot immediately apply a required patch because its availability architecture has no maintenance window. Operational constraints can be managed without disregarding the vulnerability. It does not solve the specified case, for which Normalize posture comparisons for coverage, eligibility and differing assessed resource populations. is appropriate.

This recommendation fits a different scenario: A security recommendation remains unresolved after the repair team claims the fix was applied. Remediation is complete only when the target state and evidence reflect the desired control. It does not solve the specified case, for which Normalize posture comparisons for coverage, eligibility and differing assessed resource populations. is appropriate.