Pass Your Microsoft SC-100 Exam Easy!

This recommendation fits a different scenario: A security board authorizes a new application but no one owns future dependency updates. Application protection must continue after initial launch and approval. It does not solve the specified case, for which Build an application security inventory with criticality, exposure, ownership and identity dependencies. is appropriate.

This recommendation fits a different scenario: An application assessment scores a public healthcare API and an internal demo app equally because both lack one HTTP header. Contextual risk matters more than equal treatment of every checklist failure. It does not solve the specified case, for which Build an application security inventory with criticality, exposure, ownership and identity dependencies. is appropriate.

This recommendation fits a different scenario: A software vendor claims SOC reports prove that every custom configuration of its application is secure. General vendor audits do not verify the purchaser's unique deployment controls. It does not solve the specified case, for which Build an application security inventory with criticality, exposure, ownership and identity dependencies. is appropriate.

This recommendation fits a different scenario: The same baseline is applied without adaptation to Kubernetes nodes, managed SQL and Microsoft 365. IaaS, PaaS and SaaS expose different customer-configurable control surfaces. It does not solve the specified case, for which Define customer-owned SaaS identity, sharing and data-protection configuration requirements. is appropriate.

This recommendation fits a different scenario: An Azure VM owner assumes Microsoft patches every custom application installed inside the guest. IaaS customers remain responsible for many workload and software controls. It does not solve the specified case, for which Define customer-owned SaaS identity, sharing and data-protection configuration requirements. is appropriate.

This recommendation fits a different scenario: A PaaS application team disables authentication because the underlying service platform already uses encryption. Provider platform safeguards do not authenticate application users or authorize data access. It does not solve the specified case, for which Define customer-owned SaaS identity, sharing and data-protection configuration requirements. is appropriate.

This recommendation fits a different scenario: A database export crosses a legal jurisdiction without a documented business purpose or residency assessment. Data transfers may trigger obligations that network encryption alone cannot satisfy. It does not solve the specified case, for which Conduct third-party data-processing due diligence and define contractual security obligations. is appropriate.

This recommendation fits a different scenario: A vendor requests unrestricted production database access to provide temporary support. Contracted support does not justify enduring broad access to regulated records. It does not solve the specified case, for which Conduct third-party data-processing due diligence and define contractual security obligations. is appropriate.

This recommendation fits a different scenario: A project retires a cloud application but leaves external vendors with active keys to its archived data. Retired workloads can retain accessible sensitive data if external grants persist. It does not solve the specified case, for which Conduct third-party data-processing due diligence and define contractual security obligations. is appropriate.

This recommendation fits a different scenario: A model deployment accepts unfiltered user prompts that may cause the assistant to reveal privileged system instructions. Untrusted prompts must not be treated as authority to use privileged tools or disclose protected context. It does not solve the specified case, for which Restrict retrieval to user-authorized content and enforce data-plane access controls in the AI pipeline. is appropriate.

This recommendation fits a different scenario: A chatbot sends sensitive prompts to a third-party service without documenting retention or residency terms. Secure AI adoption includes privacy and contractual data processing controls, not only model accuracy. It does not solve the specified case, for which Restrict retrieval to user-authorized content and enforce data-plane access controls in the AI pipeline. is appropriate.

This recommendation fits a different scenario: An AI team enables broad model endpoint access because it assumes safety filters also restrict callers. Content filtering evaluates outputs but does not substitute for access control to model resources. It does not solve the specified case, for which Restrict retrieval to user-authorized content and enforce data-plane access controls in the AI pipeline. is appropriate.

This recommendation fits a different scenario: The exposure team treats every modeled attack path as evidence that an adversary has already traversed it. Risk graph edges show possible paths, not proof of actual execution. It does not solve the specified case, for which Use Security Exposure Management attack paths and asset criticality to prioritize the chained risk. is appropriate.

This recommendation fits a different scenario: A security program wants to track whether strategic exposure-reduction initiatives improve over several months. Trend assessment requires stable coverage and explicit outcomes, not only one dashboard snapshot. It does not solve the specified case, for which Use Security Exposure Management attack paths and asset criticality to prioritize the chained risk. is appropriate.

This recommendation fits a different scenario: Two teams independently patch the same low-impact issue while a high-risk identity-to-server path remains open. Cross-domain attack paths require joint mitigation rather than isolated asset queues. It does not solve the specified case, for which Use Security Exposure Management attack paths and asset criticality to prioritize the chained risk. is appropriate.

This recommendation fits a different scenario: A privileged role activation proceeds without approval even though high-impact changes require a second person. Privilege elevation can be gated on accountable independent authorization. It does not solve the specified case, for which Use Entra Privileged Identity Management eligible assignments with time-bounded activation. is appropriate.

This recommendation fits a different scenario: A former contractor remains eligible for Global Administrator role activation months after their project ends. Eligible assignments are still an access risk even when not activated. It does not solve the specified case, for which Use Entra Privileged Identity Management eligible assignments with time-bounded activation. is appropriate.

This recommendation fits a different scenario: The SOC cannot identify who activated a privileged role just before suspicious tenant configuration changes. Traceable activation events connect privileged authority to specific actions and dates. It does not solve the specified case, for which Use Entra Privileged Identity Management eligible assignments with time-bounded activation. is appropriate.

This recommendation fits a different scenario: A prompt contains untrusted instructions telling a tool-using model to disclose the full hidden customer dataset. Model instruction filters cannot replace independent enforcement on protected data tools. It does not solve the specified case, for which Enforce user-context data authorization before returning retrieved passages to the model. is appropriate.

This recommendation fits a different scenario: A model training job copies regulated customer records into a globally shared temporary storage account. AI development pipelines require the same confidentiality and residency safeguards as production systems. It does not solve the specified case, for which Enforce user-context data authorization before returning retrieved passages to the model. is appropriate.

This recommendation fits a different scenario: A generative AI team logs raw confidential prompts for debugging but cannot define who is permitted to access them. Generated and submitted content can contain regulated information needing protective handling. It does not solve the specified case, for which Enforce user-context data authorization before returning retrieved passages to the model. is appropriate.

This recommendation fits a different scenario: A business removes a legacy service but external scanners still find the previous endpoint. Internet-facing exposure can persist after internal retirement records say a service is gone. It does not solve the specified case, for which Use Defender External Attack Surface Management discovery to inventory internet-visible assets. is appropriate.

This recommendation fits a different scenario: An exposure report shows an unknown domain and administrators assume the organization owns it. Discovery signals require evidence before responsibility or remediation is assigned. It does not solve the specified case, for which Use Defender External Attack Surface Management discovery to inventory internet-visible assets. is appropriate.

This recommendation fits a different scenario: An externally accessible test API contains a stale authentication endpoint, but no business owner is listed. Unknown ownership delays remediation of publicly reachable sensitive interfaces. It does not solve the specified case, for which Use Defender External Attack Surface Management discovery to inventory internet-visible assets. is appropriate.

This recommendation fits a different scenario: An application team assumes Arc-enabled machines automatically become full Azure virtual machines for every control. Azure Arc extends selected management capabilities without replacing the original hosting environment. It does not solve the specified case, for which Connect eligible non-Azure machines using Azure Arc-enabled servers and approved onboarding methods. is appropriate.

This recommendation fits a different scenario: An Arc deployment script embeds a long-lived tenant secret with unrestricted resource creation rights. Hybrid management agents must not create an uncontrolled credential exposure path. It does not solve the specified case, for which Connect eligible non-Azure machines using Azure Arc-enabled servers and approved onboarding methods. is appropriate.

This recommendation fits a different scenario: A Linux estate appears Arc-connected but security extensions are missing on half the servers. Registration alone does not prove that each required protection component is installed. It does not solve the specified case, for which Connect eligible non-Azure machines using Azure Arc-enabled servers and approved onboarding methods. is appropriate.

This recommendation fits a different scenario: A program proposes one global firewall as a substitute for application, identity and data security controls. No single perimeter control replaces workload-specific authorization and protection. It does not solve the specified case, for which Map security requirements to Microsoft Cybersecurity Reference Architectures capabilities before selecting products. is appropriate.

This recommendation fits a different scenario: A regional team wants to deploy controls without identifying the owner responsible for operating them. Control ownership makes an architectural recommendation maintainable and auditable after rollout. It does not solve the specified case, for which Map security requirements to Microsoft Cybersecurity Reference Architectures capabilities before selecting products. is appropriate.

This recommendation fits a different scenario: A merger introduces a new cloud estate but the reference architecture has not mapped its administrative trust boundaries. Security architecture must represent newly introduced identity boundaries and lateral-movement paths. It does not solve the specified case, for which Map security requirements to Microsoft Cybersecurity Reference Architectures capabilities before selecting products. is appropriate.

This recommendation fits a different scenario: Runtime detections are missing for workloads in a managed Kubernetes cluster despite completed image scanning. Build-time scanning does not observe malicious behavior after deployment. It does not solve the specified case, for which Require trusted registry sources, image vulnerability checks and provenance verification. is appropriate.

This recommendation fits a different scenario: A pod runs as a privileged root container with host filesystem mounts for routine application logging. Privileged containers expand the impact of an application compromise to the host. It does not solve the specified case, for which Require trusted registry sources, image vulnerability checks and provenance verification. is appropriate.

This recommendation fits a different scenario: A team scans source code but never examines third-party packages shipped in the final container image. The deployed container can contain vulnerable components absent from source scans. It does not solve the specified case, for which Require trusted registry sources, image vulnerability checks and provenance verification. is appropriate.