Pass Your Microsoft SC-100 Exam Easy!

This recommendation fits a different scenario: A gateway logs full bearer tokens and sensitive request payloads to an unrestricted workspace. Observability should not leak the secrets and data it is intended to protect. It does not solve the specified case, for which Design authenticated partner identities and per-API authorization in Azure API Management. is appropriate.

This recommendation fits a different scenario: An API gateway accepts unlimited requests from every subscription and the backend repeatedly exhausts capacity. Traffic governance protects availability and enforces fair resource consumption. It does not solve the specified case, for which Design authenticated partner identities and per-API authorization in Azure API Management. is appropriate.

This recommendation fits a different scenario: An architect publishes an API without a revision or version policy, breaking all consumers when its contract changes. Explicit version lifecycle protects dependent applications during interface evolution. It does not solve the specified case, for which Design authenticated partner identities and per-API authorization in Azure API Management. is appropriate.

This recommendation fits a different scenario: An IaaS administrator assigns subscription Owner to a monitoring agent that only needs to read diagnostics. Service identities should have permissions aligned to their actual operations. It does not solve the specified case, for which Federate the SaaS application with Microsoft Entra ID and govern access through supported assignments. is appropriate.

This recommendation fits a different scenario: A legacy on-premises application cannot use modern federation, but a cloud access design assumes SSO alone resolves the constraint. Legacy protocols need their own migration and protection approach rather than assumed compatibility. It does not solve the specified case, for which Federate the SaaS application with Microsoft Entra ID and govern access through supported assignments. is appropriate.

This recommendation fits a different scenario: An Azure-hosted application uses a shared storage account key although it runs on managed compute. Managed identities avoid long-lived application secrets and permit scoped authorization. It does not solve the specified case, for which Federate the SaaS application with Microsoft Entra ID and govern access through supported assignments. is appropriate.

This recommendation fits a different scenario: A security team proposes blocking every legacy application immediately despite no inventory of affected business functions. Zero Trust transformation needs controlled transition rather than unplanned production lockouts. It does not solve the specified case, for which Design explicit verification of identity, device state and resource authorization for every sensitive access path. is appropriate.

This recommendation fits a different scenario: A Zero Trust roadmap lists technologies but never defines the current maturity of the identity and device estate. Adoption is a staged capability program rather than a single product installation. It does not solve the specified case, for which Design explicit verification of identity, device state and resource authorization for every sensitive access path. is appropriate.

This recommendation fits a different scenario: A company implements least privilege for users but gives unattended integration accounts indefinite broad permissions. Nonhuman identities are principals that can bypass human-focused access reviews if ignored. It does not solve the specified case, for which Design explicit verification of identity, device state and resource authorization for every sensitive access path. is appropriate.

This recommendation fits a different scenario: An enterprise collects custom firewall and application logs from several clouds that lack native XDR incident correlation. A SIEM provides flexible collection and analytics across disparate telemetry sources. It does not solve the specified case, for which Design Microsoft Defender XDR incident correlation for supported cross-workload detections. is appropriate.

This recommendation fits a different scenario: An architect wants Defender XDR incidents and Sentinel investigations to share context without treating them as two competing systems. Integration choices should preserve a consistent case workflow rather than create duplicate response queues. It does not solve the specified case, for which Design Microsoft Defender XDR incident correlation for supported cross-workload detections. is appropriate.

This recommendation fits a different scenario: A threat detection program buys SIEM capacity without deciding which signals are needed or their retention costs. Detection-driven collection balances forensic coverage with sustainable telemetry costs. It does not solve the specified case, for which Design Microsoft Defender XDR incident correlation for supported cross-workload detections. is appropriate.

This recommendation fits a different scenario: A company registers agent identities but has no lifecycle owner or process for revoking their access after retirement. Nonhuman principals can retain persistent access after the associated workflow stops. It does not solve the specified case, for which Design a distinct governed agent identity with only the API privileges required by the task. is appropriate.

This recommendation fits a different scenario: An AI agent can invoke a high-impact resource deletion tool based on text copied from an untrusted document. Untrusted content must not become authority to perform privileged destructive operations. It does not solve the specified case, for which Design a distinct governed agent identity with only the API privileges required by the task. is appropriate.

This recommendation fits a different scenario: A cross-tenant agent integration is proposed without verifying the current Microsoft Entra Agent ID feature and licensing support. Preview and GA boundaries can affect which agent access controls are available in a given tenant. It does not solve the specified case, for which Design a distinct governed agent identity with only the API privileges required by the task. is appropriate.

This recommendation fits a different scenario: An analyst exports large quantities of customer data to personal cloud storage without triggering monitoring. Risky data movement requires context-aware controls beyond source encryption. It does not solve the specified case, for which Separate datasets by sensitivity and apply least-privilege access and data movement controls. is appropriate.

This recommendation fits a different scenario: A team immediately disables an entire shared data platform after one suspicious access alert without checking evidence. Evidence-based response reduces harm from both compromise and unnecessary shutdown. It does not solve the specified case, for which Separate datasets by sensitivity and apply least-privilege access and data movement controls. is appropriate.

This recommendation fits a different scenario: A security program patches database servers but ignores the excessive data-reader permissions granted to application service accounts. Compromised application identities can expose data even on fully patched servers. It does not solve the specified case, for which Separate datasets by sensitivity and apply least-privilege access and data movement controls. is appropriate.

This recommendation fits a different scenario: An e-commerce application needs bot defense and rate limiting for repeated API requests rather than broad network port blocks. Layer-seven abuse controls evaluate HTTP behavior, not only packet ports. It does not solve the specified case, for which Evaluate Azure DDoS Protection with suitable public IP and network architecture. is appropriate.

This recommendation fits a different scenario: A company deploys an edge WAF but never audits rule logs after legitimate customer requests begin failing. Protective rules need operational assurance to avoid undetected service disruption. It does not solve the specified case, for which Evaluate Azure DDoS Protection with suitable public IP and network architecture. is appropriate.

This recommendation fits a different scenario: A web application firewall blocks one SQL injection pattern but its origin server remains reachable through a separate public IP. WAF policy cannot defend traffic routed around the protected edge. It does not solve the specified case, for which Evaluate Azure DDoS Protection with suitable public IP and network architecture. is appropriate.

This recommendation fits a different scenario: A Cosmos DB workload embeds a full-account key in client applications distributed to external users. Exposed account secrets permit operations beyond the intended end-user rights. It does not solve the specified case, for which Evaluate private connectivity, Microsoft Entra authentication and scoped database authorization. is appropriate.

This recommendation fits a different scenario: A Synapse analytics workspace enables data access for every contributor role without distinct SQL or storage permissions. Workspace management permissions do not automatically express least-privilege access to underlying data. It does not solve the specified case, for which Evaluate private connectivity, Microsoft Entra authentication and scoped database authorization. is appropriate.

This recommendation fits a different scenario: A database is encrypted and backed up, but audit trails for sensitive query activity are not retained. Confidentiality and recovery controls do not replace detection and attribution of data access. It does not solve the specified case, for which Evaluate private connectivity, Microsoft Entra authentication and scoped database authorization. is appropriate.

This recommendation fits a different scenario: A workload team claims that a Defender for Cloud recommendation automatically proves every control in a security benchmark is satisfied. Product recommendations are signals, not definitive proof of complete control compliance. It does not solve the specified case, for which Map Microsoft Cloud Security Benchmark control families to applicable workloads and required evidence. is appropriate.

This recommendation fits a different scenario: A policy requires encryption but different teams interpret acceptable key custody in incompatible ways. Written control intent creates a shared basis for architecture evaluation and evidence. It does not solve the specified case, for which Map Microsoft Cloud Security Benchmark control families to applicable workloads and required evidence. is appropriate.

This recommendation fits a different scenario: An organization adopts a security benchmark but never revisits it after changing cloud service models. Required controls may shift between customer and provider as service models evolve. It does not solve the specified case, for which Map Microsoft Cloud Security Benchmark control families to applicable workloads and required evidence. is appropriate.

This recommendation fits a different scenario: An application team wants to deploy production Azure resources into any region without review. Location restrictions translate residency policy into preventive resource configuration. It does not solve the specified case, for which Design a management-group hierarchy with standard landing-zone governance and approved exceptions. is appropriate.

This recommendation fits a different scenario: A new workload has only owner access assigned at subscription root, even though support duties are narrower. Granular role scoping avoids treating every operator as a subscription administrator. It does not solve the specified case, for which Design a management-group hierarchy with standard landing-zone governance and approved exceptions. is appropriate.

This recommendation fits a different scenario: A landing zone is provisioned without any central diagnostic or security event destination. Security telemetry needs to be established as part of the platform baseline, not added after an incident. It does not solve the specified case, for which Design a management-group hierarchy with standard landing-zone governance and approved exceptions. is appropriate.

This recommendation fits a different scenario: A malware campaign changes IP addresses while maintaining the same credential-theft technique. Technique-oriented analytics survive changes to attacker infrastructure. It does not solve the specified case, for which Enrich external indicators with local telemetry, time context and confidence before escalation. is appropriate.

This recommendation fits a different scenario: A detection rule catches a false-positive administrative script, and the owner asks for blanket script exclusions. Scoped exceptions limit noise without removing visibility for genuine malicious variants. It does not solve the specified case, for which Enrich external indicators with local telemetry, time context and confidence before escalation. is appropriate.

This recommendation fits a different scenario: Endpoint detectors become noisy after a new sensor rollout, and leadership believes attacks have doubled. Improved visibility can increase alert counts without a matching change in attacker activity. It does not solve the specified case, for which Enrich external indicators with local telemetry, time context and confidence before escalation. is appropriate.