Pass Your Microsoft SC-100 Exam Easy!

This recommendation fits a different scenario: A network team proposes exempting all Teams traffic from every security control to resolve poor call quality. Performance optimization should not eliminate resource authorization or protection. It does not solve the specified case, for which Verify monitoring coverage and telemetry health before interpreting low alert counts as low risk. is appropriate.

This recommendation fits a different scenario: A tenant allows external collaboration but no one reviews guests after their projects end. External collaboration risk persists when access remains after legitimate need ends. It does not solve the specified case, for which Verify monitoring coverage and telemetry health before interpreting low alert counts as low risk. is appropriate.

This recommendation fits a different scenario: A SOC investigates user phishing incidents without checking related endpoint and identity alerts. Email threats can lead to identity and endpoint compromise that a mailbox-only view misses. It does not solve the specified case, for which Verify monitoring coverage and telemetry health before interpreting low alert counts as low risk. is appropriate.

This recommendation fits a different scenario: Domain admin accounts browse email and administer production domain controllers from the same workstation. Preventing routine browsing from privileged sessions reduces credential exposure. It does not solve the specified case, for which Inventory and migrate legacy AD authentication dependencies using monitored phased enforcement. is appropriate.

This recommendation fits a different scenario: Legacy service accounts have unrestricted domain administrator memberships for scheduled file transfers. Limiting standing AD rights reduces the lateral-movement value of a compromised service account. It does not solve the specified case, for which Inventory and migrate legacy AD authentication dependencies using monitored phased enforcement. is appropriate.

This recommendation fits a different scenario: Attackers could modify domain controller backups because they reside on a file share writable by ordinary domain users. Domain recovery depends on trusted, access-controlled backup state. It does not solve the specified case, for which Inventory and migrate legacy AD authentication dependencies using monitored phased enforcement. is appropriate.

This recommendation fits a different scenario: A public-cloud failover design relies on a single private DNS server in an on-premises data center. Cross-environment recovery fails when a shared name-resolution dependency remains a single point of failure. It does not solve the specified case, for which Test disaster-recovery endpoint identities, certificate trust, firewall rules and service-to-service authorization. is appropriate.

This recommendation fits a different scenario: A multicloud application replicates data but has never tested whether its secondary cloud can obtain required encryption keys. Replicated ciphertext is unusable if the required decryption authority is unavailable after failover. It does not solve the specified case, for which Test disaster-recovery endpoint identities, certificate trust, firewall rules and service-to-service authorization. is appropriate.

This recommendation fits a different scenario: The recovery architect chooses asynchronous replication without evaluating the impact of losing recent transactions. Replication mode must reflect acceptable data loss, not only infrastructure cost. It does not solve the specified case, for which Test disaster-recovery endpoint identities, certificate trust, firewall rules and service-to-service authorization. is appropriate.

This recommendation fits a different scenario: A VM uses a hard-coded database password in its startup script and the image is shared across environments. Shared images must not distribute reusable production authentication secrets. It does not solve the specified case, for which Separate workload administration from security-monitoring change authority and audit modifications. is appropriate.

This recommendation fits a different scenario: An Azure web app has HTTPS on its public endpoint but its backend storage connection uses a public shared key. Front-end TLS does not establish least privilege for data-plane operations. It does not solve the specified case, for which Separate workload administration from security-monitoring change authority and audit modifications. is appropriate.

This recommendation fits a different scenario: A cloud project encrypts disks with customer-managed keys but its key vault allows unrestricted delete operations. Data availability depends on protecting the encryption key against unauthorized destruction. It does not solve the specified case, for which Separate workload administration from security-monitoring change authority and audit modifications. is appropriate.

This recommendation fits a different scenario: A public API needs authentication but the team proposes a WAF as the only protection. WAF filtering does not establish which caller may access protected business data. It does not solve the specified case, for which Define API-specific authorization requirements based on resources, callers and business risk. is appropriate.

This recommendation fits a different scenario: A sensitive internal application relies on user IP addresses as its sole authorization check. Network source is not a durable proof of the caller's privileges. It does not solve the specified case, for which Define API-specific authorization requirements based on resources, callers and business risk. is appropriate.

This recommendation fits a different scenario: A cloud-native app has redundant load balancers but a single shared production secret across all microservices. Service-level trust isolation reduces the blast radius of compromised workload credentials. It does not solve the specified case, for which Define API-specific authorization requirements based on resources, callers and business risk. is appropriate.

This recommendation fits a different scenario: An organization uses Azure and AWS but its Defender for Cloud dashboard only shows Azure resources. Multicloud posture monitoring requires explicit source-account integration. It does not solve the specified case, for which Normalize cloud resource inventory and accountability metadata across connected environments. is appropriate.

This recommendation fits a different scenario: Cloud security teams want unified posture control reporting for resources in Google Cloud as well as Azure. GCP workloads are not automatically part of Azure's monitored inventory. It does not solve the specified case, for which Normalize cloud resource inventory and accountability metadata across connected environments. is appropriate.

This recommendation fits a different scenario: An external account connector receives permanent administrator permissions although it only needs approved posture collection. Broad multicloud connector rights increase the blast radius of integration compromise. It does not solve the specified case, for which Normalize cloud resource inventory and accountability metadata across connected environments. is appropriate.

This recommendation fits a different scenario: All Kubernetes service accounts can read every namespace secret through overbroad cluster roles. Namespaced least privilege limits impact of compromised pods by constraining access to secrets and orchestration APIs. It does not solve the specified case, for which Govern cluster secrets and adopt supported workload identity and registry authentication where feasible. is appropriate.

This recommendation fits a different scenario: An AKS cluster exposes its control-plane API to the internet without approved access restrictions. API server reachability should follow the documented management trust boundary. It does not solve the specified case, for which Govern cluster secrets and adopt supported workload identity and registry authentication where feasible. is appropriate.

This recommendation fits a different scenario: Applications in separate security zones exchange traffic freely because no network policies are applied. Namespace labels alone are not equivalent to network isolation without an enforcing policy and compatible networking provider. It does not solve the specified case, for which Govern cluster secrets and adopt supported workload identity and registry authentication where feasible. is appropriate.

This recommendation fits a different scenario: An external auditor requests proof that privileged data-export approvals were granted before each release. Audit evidence must connect authorization to the actual operation. It does not solve the specified case, for which Maintain risk acceptance records with approver, scope, compensating controls and expiry. is appropriate.

This recommendation fits a different scenario: A multinational organization exports Purview logs to an unrestricted analytics workspace containing personal identifiers. Compliance logging can become a privacy exposure if exported without controls. It does not solve the specified case, for which Maintain risk acceptance records with approver, scope, compensating controls and expiry. is appropriate.

This recommendation fits a different scenario: A team claims a monthly compliance check is sufficient for continuously deployed cloud resources. Continuous deployment requires assurance that reflects current infrastructure states. It does not solve the specified case, for which Maintain risk acceptance records with approver, scope, compensating controls and expiry. is appropriate.

This recommendation fits a different scenario: Developers store infrastructure credentials in deployment YAML inside a public code repository. Removing long-lived embedded secrets reduces credential exposure from source code. It does not solve the specified case, for which Establish a documented emergency change path with bounded approvals and postrelease validation. is appropriate.

This recommendation fits a different scenario: Security defects are discovered only during annual penetration tests, long after feature release. Earlier testing reduces the cost and likelihood of deploying exploitable changes. It does not solve the specified case, for which Establish a documented emergency change path with bounded approvals and postrelease validation. is appropriate.

This recommendation fits a different scenario: A build pipeline publishes unverified container images directly to production without independent approvals. Supply-chain assurance verifies the artifact being deployed rather than trusting an unreviewed build. It does not solve the specified case, for which Establish a documented emergency change path with bounded approvals and postrelease validation. is appropriate.

This recommendation fits a different scenario: A ransomware incident deletes storage blobs and their latest versions before the recovery team investigates. Recoverable history and protected deletion controls reduce irreversible storage loss. It does not solve the specified case, for which Validate storage network rules, private endpoint connectivity and hybrid DNS together. is appropriate.

This recommendation fits a different scenario: An application creates a container with anonymous public blob read enabled for a confidential document repository. Public blob exposure bypasses the intended identity-based data boundary. It does not solve the specified case, for which Validate storage network rules, private endpoint connectivity and hybrid DNS together. is appropriate.

This recommendation fits a different scenario: A batch job uses one account-level storage key for all containers even though it only writes to one folder. Broad persistent storage keys exceed the permissions needed by one workload. It does not solve the specified case, for which Validate storage network rules, private endpoint connectivity and hybrid DNS together. is appropriate.

This recommendation fits a different scenario: An incident commander suspends a compromised administrator but leaves an active privileged cloud session untouched. Session containment may require actions beyond account state changes. It does not solve the specified case, for which Rehearse emergency access under controlled monitoring and document safe credential custody. is appropriate.

This recommendation fits a different scenario: A security review finds administrative role changes with no change ticket or recorded business purpose. Privileged authorization needs traceability between approvals and actual assignment. It does not solve the specified case, for which Rehearse emergency access under controlled monitoring and document safe credential custody. is appropriate.

This recommendation fits a different scenario: A high-privilege application credential appears in a public repository and the response team plans only to delete the commit. Repository removal does not invalidate a secret that attackers may have copied. It does not solve the specified case, for which Rehearse emergency access under controlled monitoring and document safe credential custody. is appropriate.