Pass Microsoft SC-900 Exam in First Attempt Guaranteed!

Protect and verify identities as a primary perimeter for cloud access rather than relying only on a building network. This item belongs to a different control area: Identity as security perimeter. Its appropriate purpose is: Cloud users and workloads access resources from varied networks, making authenticated identity and authorization central boundaries. For the stated case, Zero Trust is the closer match. Zero Trust does not automatically trust a user, device or connection because it originates on a corporate network.

Use a trusted identity provider and directory to manage identities and support application sign-in. This item belongs to a different control area: Identity providers and directories. Its appropriate purpose is: An identity provider handles authentication while a directory stores and organizes identities and attributes; neither equals the protected application. For the stated case, Zero Trust is the closer match. Zero Trust does not automatically trust a user, device or connection because it originates on a corporate network.

Authenticate the principal first and separately authorize only the permitted resource actions. This item belongs to a different control area: Authentication and authorization. Its appropriate purpose is: Authentication proves identity or possession of credentials; authorization determines what that identity may do. For the stated case, Zero Trust is the closer match. Zero Trust does not automatically trust a user, device or connection because it originates on a corporate network.

Use Azure Bastion to reach supported Azure VMs over RDP or SSH without exposing public management ports directly. This item belongs to a different control area: Azure Bastion. Its appropriate purpose is: Bastion supplies browser- or client-mediated secure VM management access; it is not a DDoS service. For the stated case, Endpoint attack surface reduction is the closer match. ASR rules reduce common exploit paths on endpoints and can be tested in audit mode before enforcement.

Enable relevant Cloud Security Posture Management capabilities to identify cloud configuration risks and improve posture. This item belongs to a different control area: Cloud Security Posture Management. Its appropriate purpose is: CSPM evaluates configuration and exposure risk proactively, rather than solely responding to an endpoint malware alert. For the stated case, Endpoint attack surface reduction is the closer match. ASR rules reduce common exploit paths on endpoints and can be tested in audit mode before enforcement.

Apply Azure network security group rules to allow or deny traffic by source, destination, port and protocol at subnet or NIC scope. This item belongs to a different control area: Network security groups. Its appropriate purpose is: NSGs provide ordered L3/L4 traffic filtering in Azure, not deep web-request inspection. For the stated case, Endpoint attack surface reduction is the closer match. ASR rules reduce common exploit paths on endpoints and can be tested in audit mode before enforcement.

The intended risky session action is monitored or restricted according to configured controls. This item belongs to a different control area: Defender for Cloud Apps session controls. Its appropriate purpose is: Session controls provide real-time governance of supported cloud app activities; discovery alone does not enforce session behaviors. For the stated case, Azure Web Application Firewall is the closer match. A WAF targets application-layer HTTP risks such as injection, unlike basic network port filtering.

Affected endpoints generate actionable detections and responders can investigate the activity chain. This item belongs to a different control area: Defender for Endpoint EDR. Its appropriate purpose is: Endpoint detection and response targets device-level malicious behavior, not Microsoft 365 document retention. For the stated case, Azure Web Application Firewall is the closer match. A WAF targets application-layer HTTP risks such as injection, unlike basic network port filtering.

Unapproved cloud app usage becomes visible to reviewers with relevant discovery evidence. This item belongs to a different control area: Defender for Cloud Apps discovery. Its appropriate purpose is: Cloud app discovery assesses shadow IT usage, not the same task as investigating on-premises domain controller compromise. For the stated case, Azure Web Application Firewall is the closer match. A WAF targets application-layer HTTP risks such as injection, unlike basic network port filtering.

Use a trusted identity provider and directory to manage identities and support application sign-in. This item belongs to a different control area: Identity providers and directories. Its appropriate purpose is: An identity provider handles authentication while a directory stores and organizes identities and attributes; neither equals the protected application. For the stated case, Cloud shared responsibility is the closer match. Shared responsibility divides security obligations according to the cloud service model; provider data-center security does not replace tenant controls.

Protect and verify identities as a primary perimeter for cloud access rather than relying only on a building network. This item belongs to a different control area: Identity as security perimeter. Its appropriate purpose is: Cloud users and workloads access resources from varied networks, making authenticated identity and authorization central boundaries. For the stated case, Cloud shared responsibility is the closer match. Shared responsibility divides security obligations according to the cloud service model; provider data-center security does not replace tenant controls.

Establish a standards-based trust between identity providers so one organization can authenticate users for a relying application. This item belongs to a different control area: Identity federation. Its appropriate purpose is: Federation extends authentication trust across security domains; it does not automatically grant unrestricted permissions. For the stated case, Cloud shared responsibility is the closer match. Shared responsibility divides security obligations according to the cloud service model; provider data-center security does not replace tenant controls.

Inspect application and service principal objects, consented permissions and authentication credential lifecycle. This item belongs to a different control area: Service principals. Its appropriate purpose is: Service principals represent applications or services rather than individual human users; credentials and consent must be governed. For the stated case, Identity Protection risk detection is the closer match. Identity Protection detects identity-related risk signals; a generic role assignment alone does not assess risk.

Inspect registered passkey credentials, permitted authentication-method settings and sign-in method details. This item belongs to a different control area: Passkeys and FIDO2. Its appropriate purpose is: FIDO2 passkeys bind authentication to the legitimate relying party and resist credential phishing more effectively than SMS codes. For the stated case, Identity Protection risk detection is the closer match. Identity Protection detects identity-related risk signals; a generic role assignment alone does not assess risk.

Inspect role definitions, active assignments and role audit events for tenant administrators. This item belongs to a different control area: Microsoft Entra role-based access control. Its appropriate purpose is: Entra administrative roles govern directory and identity operations; Azure resource RBAC is a separate scope model. For the stated case, Identity Protection risk detection is the closer match. Identity Protection detects identity-related risk signals; a generic role assignment alone does not assess risk.

The compliance dashboard reflects assessment status and supporting remediation evidence for selected standards. This item belongs to a different control area: Defender for Cloud regulatory compliance. Its appropriate purpose is: Regulatory compliance views relate assessed technical controls to frameworks; they do not by themselves certify organizational legal compliance. For the stated case, Microsoft Sentinel SIEM ingestion is the closer match. A SIEM collects and correlates security telemetry; data ingestion is foundational before analytic rules can detect events.

A targeted remediation clears the relevant security recommendation without loosening the intended standard. This item belongs to a different control area: Cloud security policies and recommendations. Its appropriate purpose is: A recommendation identifies a technical improvement; a documented policy or assigned standard provides expectations for assessed resources. For the stated case, Microsoft Sentinel SIEM ingestion is the closer match. A SIEM collects and correlates security telemetry; data ingestion is foundational before analytic rules can detect events.

Analysts can connect relevant observed indicators with contextualized threat information to guide investigation. This item belongs to a different control area: Microsoft Threat Intelligence. Its appropriate purpose is: Threat intelligence adds context on threats and indicators; it does not by itself implement endpoint blocking or identity authorization. For the stated case, Microsoft Sentinel SIEM ingestion is the closer match. A SIEM collects and correlates security telemetry; data ingestion is foundational before analytic rules can detect events.

Use the compliance score in Microsoft Purview Compliance Manager as a progress indicator for assessed improvement actions. This item belongs to a different control area: Compliance score. Its appropriate purpose is: Compliance score measures tracked improvement progress; it is not a universal regulatory certification or breach-risk guarantee. For the stated case, Retention policies is the closer match. Retention policies apply lifecycle rules to selected locations or content sets; they do not substitute for DLP sharing blocks.

Use Microsoft Purview Insider Risk Management to investigate configured potentially risky user activities under approved privacy safeguards. This item belongs to a different control area: Insider risk management. Its appropriate purpose is: Insider risk policies correlate relevant insider indicators; they do not authorize indiscriminate surveillance or replace privacy and employment policy. For the stated case, Retention policies is the closer match. Retention policies apply lifecycle rules to selected locations or content sets; they do not substitute for DLP sharing blocks.

Use Microsoft Purview Compliance Manager to organize improvement actions and track regulatory assessment progress. This item belongs to a different control area: Compliance Manager. Its appropriate purpose is: Compliance Manager maps control activities and improvements; it does not automatically guarantee legal compliance. For the stated case, Retention policies is the closer match. Retention policies apply lifecycle rules to selected locations or content sets; they do not substitute for DLP sharing blocks.

Inspect score breakdown, applicable improvement actions and updates to action completion. This item belongs to a different control area: Compliance score. Its appropriate purpose is: Compliance score measures tracked improvement progress; it is not a universal regulatory certification or breach-risk guarantee. For the stated case, Sensitive information type classification is the closer match. Classification identifies content characteristics to support protection policies; classifying alone does not block exfiltration.

Inspect Service Trust Portal document categories and available audit reports for the requested service. This item belongs to a different control area: Service Trust Portal. Its appropriate purpose is: The Service Trust Portal offers Microsoft service assurance resources; customers remain responsible for their own compliance obligations. For the stated case, Sensitive information type classification is the closer match. Classification identifies content characteristics to support protection policies; classifying alone does not block exfiltration.

Inspect assessments, improvement actions, assigned owners and uploaded evidence. This item belongs to a different control area: Compliance Manager. Its appropriate purpose is: Compliance Manager maps control activities and improvements; it does not automatically guarantee legal compliance. For the stated case, Sensitive information type classification is the closer match. Classification identifies content characteristics to support protection policies; classifying alone does not block exfiltration.

Review identities, sign-in activity, access entitlements and whether resource decisions use identity signals. This item belongs to a different control area: Identity as security perimeter. Its appropriate purpose is: Cloud users and workloads access resources from varied networks, making authenticated identity and authorization central boundaries. For the stated case, Governance risk and compliance is the closer match. Governance sets direction, risk management evaluates exposure, and compliance verifies obligations against controls.

Review the federation trust, issuer metadata, accepted tokens and sign-in transaction records. This item belongs to a different control area: Identity federation. Its appropriate purpose is: Federation extends authentication trust across security domains; it does not automatically grant unrestricted permissions. For the stated case, Governance risk and compliance is the closer match. Governance sets direction, risk management evaluates exposure, and compliance verifies obligations against controls.

Compare authentication records with resource permission grants and denied-operation logs. This item belongs to a different control area: Authentication and authorization. Its appropriate purpose is: Authentication proves identity or possession of credentials; authorization determines what that identity may do. For the stated case, Governance risk and compliance is the closer match. Governance sets direction, risk management evaluates exposure, and compliance verifies obligations against controls.

Target items receive the correct retention label and follow the configured item-level lifecycle behavior. This item belongs to a different control area: Retention labels. Its appropriate purpose is: Retention labels govern specific items; a broad location-level retention policy does not provide the same fine-grained labeling behavior. For the stated case, Microsoft privacy principles is the closer match. Privacy principles guide responsible data handling and transparency; they do not automatically classify every document.

Authorized investigators can preserve and retrieve relevant evidence with traceable case handling. This item belongs to a different control area: Microsoft Purview eDiscovery. Its appropriate purpose is: eDiscovery supports legal and regulatory evidence workflows; it is distinct from real-time data loss prevention. For the stated case, Microsoft privacy principles is the closer match. Privacy principles guide responsible data handling and transparency; they do not automatically classify every document.

Intended users can apply the approved label and the configured protection behaves on labeled content. This item belongs to a different control area: Sensitivity labels. Its appropriate purpose is: Sensitivity labels classify content and may apply protection; labels must be made available through appropriate policy publishing. For the stated case, Microsoft privacy principles is the closer match. Privacy principles guide responsible data handling and transparency; they do not automatically classify every document.

Inspect incident timelines, alert evidence, related entities and assigned ownership. This item belongs to a different control area: Microsoft Sentinel incident investigation. Its appropriate purpose is: Incident management helps investigate and coordinate alerts; it differs from automatic enforcement through a playbook. For the stated case, Defender for Cloud regulatory compliance is the closer match. Regulatory compliance views relate assessed technical controls to frameworks; they do not by themselves certify organizational legal compliance.

Inspect monitored domain controllers, identity alerts and suspicious activity timelines. This item belongs to a different control area: Defender for Identity. Its appropriate purpose is: Defender for Identity monitors on-premises identity threats and domain controller signals; it is not a cloud app SaaS discovery catalog. For the stated case, Defender for Cloud regulatory compliance is the closer match. Regulatory compliance views relate assessed technical controls to frameworks; they do not by themselves certify organizational legal compliance.

Inspect discovered app inventory, traffic evidence and application risk scores. This item belongs to a different control area: Defender for Cloud Apps discovery. Its appropriate purpose is: Cloud app discovery assesses shadow IT usage, not the same task as investigating on-premises domain controller compromise. For the stated case, Defender for Cloud regulatory compliance is the closer match. Regulatory compliance views relate assessed technical controls to frameworks; they do not by themselves certify organizational legal compliance.