Pass Microsoft SC-900 Exam in First Attempt Guaranteed!

Use Microsoft Purview retention labels and publishing or auto-application policies for item-level lifecycle handling. This item belongs to a different control area: Retention labels. Its appropriate purpose is: Retention labels govern specific items; a broad location-level retention policy does not provide the same fine-grained labeling behavior. For the stated case, Compliance Manager is the closer match. Compliance Manager maps control activities and improvements; it does not automatically guarantee legal compliance.

Use Microsoft Purview Content explorer to examine classified content locations and relevant item details with proper roles. This item belongs to a different control area: Content explorer. Its appropriate purpose is: Content explorer helps inspect classified data inventory; Activity explorer focuses on actions and activity history. For the stated case, Compliance Manager is the closer match. Compliance Manager maps control activities and improvements; it does not automatically guarantee legal compliance.

Use Microsoft Purview retention policies to manage preservation or deletion of supported content at selected locations. This item belongs to a different control area: Retention policies. Its appropriate purpose is: Retention policies apply lifecycle rules to selected locations or content sets; they do not substitute for DLP sharing blocks. For the stated case, Compliance Manager is the closer match. Compliance Manager maps control activities and improvements; it does not automatically guarantee legal compliance.

Inspect incident timelines, alert evidence, related entities and assigned ownership. This item belongs to a different control area: Microsoft Sentinel incident investigation. Its appropriate purpose is: Incident management helps investigate and coordinate alerts; it differs from automatic enforcement through a playbook. For the stated case, Azure DDoS Protection is the closer match. DDoS Protection addresses distributed denial-of-service traffic aimed at network services; it does not replace a web-application rule engine.

Inspect assigned compliance standards, evaluated controls and their associated resource assessments. This item belongs to a different control area: Defender for Cloud regulatory compliance. Its appropriate purpose is: Regulatory compliance views relate assessed technical controls to frameworks; they do not by themselves certify organizational legal compliance. For the stated case, Azure DDoS Protection is the closer match. DDoS Protection addresses distributed denial-of-service traffic aimed at network services; it does not replace a web-application rule engine.

Inspect protected resource coverage, workload alerts, enabled plans and alert investigation evidence. This item belongs to a different control area: Defender for Cloud workload protection. Its appropriate purpose is: Cloud workload protection detects threat signals and suspicious runtime behavior; CSPM primarily addresses configuration posture. For the stated case, Azure DDoS Protection is the closer match. DDoS Protection addresses distributed denial-of-service traffic aimed at network services; it does not replace a web-application rule engine.

Inspect NSG effective rules, priority ordering and flow evaluation for the affected network interface. This item belongs to a different control area: Network security groups. Its appropriate purpose is: NSGs provide ordered L3/L4 traffic filtering in Azure, not deep web-request inspection. For the stated case, Microsoft Sentinel analytics rules is the closer match. Sentinel analytics rules evaluate telemetry to raise detections; collecting logs alone is insufficient to identify a defined pattern.

Inspect WAF rules, managed-rule matches and HTTP request logs for the affected endpoint. This item belongs to a different control area: Azure Web Application Firewall. Its appropriate purpose is: A WAF targets application-layer HTTP risks such as injection, unlike basic network port filtering. For the stated case, Microsoft Sentinel analytics rules is the closer match. Sentinel analytics rules evaluate telemetry to raise detections; collecting logs alone is insufficient to identify a defined pattern.

Inspect asset inventory, secure score, alerts, plans and recommendations in Defender for Cloud. This item belongs to a different control area: Defender for Cloud unified security posture. Its appropriate purpose is: Defender for Cloud combines CSPM and cloud workload protection capabilities; it is not the same as a single network security group. For the stated case, Microsoft Sentinel analytics rules is the closer match. Sentinel analytics rules evaluate telemetry to raise detections; collecting logs alone is insufficient to identify a defined pattern.

Access decisions re-evaluate context and give only the privileges required for an approved task. This item belongs to a different control area: Zero Trust. Its appropriate purpose is: Zero Trust does not automatically trust a user, device or connection because it originates on a corporate network. For the stated case, Authentication and authorization is the closer match. Authentication proves identity or possession of credentials; authorization determines what that identity may do.

Identify storage encryption state, TLS connection settings and custody of cryptographic keys. This item belongs to a different control area: Encryption. Its appropriate purpose is: Encryption makes data unreadable to an unauthorized party without the appropriate key; it differs from a one-way hash. For the stated case, Authentication and authorization is the closer match. Authentication proves identity or possession of credentials; authorization determines what that identity may do.

Apply the customer's responsibility for identities, data and cloud configuration rather than assuming the provider performs every control. This item belongs to a different control area: Cloud shared responsibility. Its appropriate purpose is: Shared responsibility divides security obligations according to the cloud service model; provider data-center security does not replace tenant controls. For the stated case, Authentication and authorization is the closer match. Authentication proves identity or possession of credentials; authorization determines what that identity may do.

Offer phishing-resistant FIDO2 passkey authentication with supported Microsoft Entra methods. This item belongs to a different control area: Passkeys and FIDO2. Its appropriate purpose is: FIDO2 passkeys bind authentication to the legitimate relying party and resist credential phishing more effectively than SMS codes. For the stated case, Azure resource RBAC versus Entra roles is the closer match. Azure RBAC governs Azure resource permissions, whereas Microsoft Entra roles govern directory services.

Use Microsoft Entra entitlement management access packages with governed request, approval and expiration rules. This item belongs to a different control area: Entitlement management access packages. Its appropriate purpose is: Entitlement management standardizes access bundles and access-request governance for groups, apps and sites. For the stated case, Azure resource RBAC versus Entra roles is the closer match. Azure RBAC governs Azure resource permissions, whereas Microsoft Entra roles govern directory services.

Register an application and control its service principal permissions for unattended application access. This item belongs to a different control area: Service principals. Its appropriate purpose is: Service principals represent applications or services rather than individual human users; credentials and consent must be governed. For the stated case, Azure resource RBAC versus Entra roles is the closer match. Azure RBAC governs Azure resource permissions, whereas Microsoft Entra roles govern directory services.

Inspect Safe Links policy assignments, URL click events and detections. This item belongs to a different control area: Defender for Office 365 Safe Links. Its appropriate purpose is: Safe Links addresses URL-based threats; it does not inspect attached files for malware. For the stated case, Defender for Cloud regulatory compliance is the closer match. Regulatory compliance views relate assessed technical controls to frameworks; they do not by themselves certify organizational legal compliance.

Inspect VNet and subnet address plans, peering relationships and route tables. This item belongs to a different control area: Azure virtual network segmentation. Its appropriate purpose is: Virtual networks provide logical network isolation; separate security policies may still be needed to limit allowed flows. For the stated case, Defender for Cloud regulatory compliance is the closer match. Regulatory compliance views relate assessed technical controls to frameworks; they do not by themselves certify organizational legal compliance.

Inspect ASR rule configuration, audit or block events and exclusions for the affected endpoints. This item belongs to a different control area: Endpoint attack surface reduction. Its appropriate purpose is: ASR rules reduce common exploit paths on endpoints and can be tested in audit mode before enforcement. For the stated case, Defender for Cloud regulatory compliance is the closer match. Regulatory compliance views relate assessed technical controls to frameworks; they do not by themselves certify organizational legal compliance.

Security owners see prioritized exposures and applicable workload detections in the expected scope. This item belongs to a different control area: Defender for Cloud unified security posture. Its appropriate purpose is: Defender for Cloud combines CSPM and cloud workload protection capabilities; it is not the same as a single network security group. For the stated case, Microsoft Sentinel SIEM ingestion is the closer match. A SIEM collects and correlates security telemetry; data ingestion is foundational before analytic rules can detect events.

Inspect VNet and subnet address plans, peering relationships and route tables. This item belongs to a different control area: Azure virtual network segmentation. Its appropriate purpose is: Virtual networks provide logical network isolation; separate security policies may still be needed to limit allowed flows. For the stated case, Microsoft Sentinel SIEM ingestion is the closer match. A SIEM collects and correlates security telemetry; data ingestion is foundational before analytic rules can detect events.

Enable applicable Defender for Cloud workload protection plans to detect threats affecting supported cloud workloads. This item belongs to a different control area: Defender for Cloud workload protection. Its appropriate purpose is: Cloud workload protection detects threat signals and suspicious runtime behavior; CSPM primarily addresses configuration posture. For the stated case, Microsoft Sentinel SIEM ingestion is the closer match. A SIEM collects and correlates security telemetry; data ingestion is foundational before analytic rules can detect events.

Separate workloads into appropriately designed Azure virtual networks and subnets with explicit connectivity boundaries. This item belongs to a different control area: Azure virtual network segmentation. Its appropriate purpose is: Virtual networks provide logical network isolation; separate security policies may still be needed to limit allowed flows. For the stated case, Defender for Identity is the closer match. Defender for Identity monitors on-premises identity threats and domain controller signals; it is not a cloud app SaaS discovery catalog.

Store and access application secrets in Azure Key Vault with appropriately controlled authorization. This item belongs to a different control area: Azure Key Vault secrets. Its appropriate purpose is: Key Vault manages keys, secrets and certificates; it is not a general-purpose file storage or SIEM service. For the stated case, Defender for Identity is the closer match. Defender for Identity monitors on-premises identity threats and domain controller signals; it is not a cloud app SaaS discovery catalog.

Apply Azure Web Application Firewall to inspect HTTP and HTTPS requests for common web-application attacks. This item belongs to a different control area: Azure Web Application Firewall. Its appropriate purpose is: A WAF targets application-layer HTTP risks such as injection, unlike basic network port filtering. For the stated case, Defender for Identity is the closer match. Defender for Identity monitors on-premises identity threats and domain controller signals; it is not a cloud app SaaS discovery catalog.

The engineer can perform the allowed resource action but cannot manage unrelated resources or tenant identity settings. This item belongs to a different control area: Azure resource RBAC versus Entra roles. Its appropriate purpose is: Azure RBAC governs Azure resource permissions, whereas Microsoft Entra roles govern directory services. For the stated case, Self-service password reset is the closer match. SSPR helps account recovery; it does not grant additional resource authorization or bypass verification.

The operator can perform the approved directory task without access to unrelated privileged functions. This item belongs to a different control area: Microsoft Entra role-based access control. Its appropriate purpose is: Entra administrative roles govern directory and identity operations; Azure resource RBAC is a separate scope model. For the stated case, Self-service password reset is the closer match. SSPR helps account recovery; it does not grant additional resource authorization or bypass verification.

A noncompliant device is blocked or challenged while compliant devices can access the targeted app. This item belongs to a different control area: Conditional Access compliant devices. Its appropriate purpose is: Conditional Access combines signals and access controls; device compliance comes from the supported management and enrollment state. For the stated case, Self-service password reset is the closer match. SSPR helps account recovery; it does not grant additional resource authorization or bypass verification.

Use Microsoft Purview retention policies to manage preservation or deletion of supported content at selected locations. This item belongs to a different control area: Retention policies. Its appropriate purpose is: Retention policies apply lifecycle rules to selected locations or content sets; they do not substitute for DLP sharing blocks. For the stated case, Microsoft Purview portal is the closer match. The Purview portal is a central interface for multiple compliance and data-governance solutions, not itself a finished compliance certification.

Use supported Microsoft Purview sensitive information types or classifiers to identify defined sensitive data patterns. This item belongs to a different control area: Sensitive information type classification. Its appropriate purpose is: Classification identifies content characteristics to support protection policies; classifying alone does not block exfiltration. For the stated case, Microsoft Purview portal is the closer match. The Purview portal is a central interface for multiple compliance and data-governance solutions, not itself a finished compliance certification.

Use Microsoft Purview retention labels and publishing or auto-application policies for item-level lifecycle handling. This item belongs to a different control area: Retention labels. Its appropriate purpose is: Retention labels govern specific items; a broad location-level retention policy does not provide the same fine-grained labeling behavior. For the stated case, Microsoft Purview portal is the closer match. The Purview portal is a central interface for multiple compliance and data-governance solutions, not itself a finished compliance certification.

Review identities, sign-in activity, access entitlements and whether resource decisions use identity signals. This item belongs to a different control area: Identity as security perimeter. Its appropriate purpose is: Cloud users and workloads access resources from varied networks, making authenticated identity and authorization central boundaries. For the stated case, Zero Trust is the closer match. Zero Trust does not automatically trust a user, device or connection because it originates on a corporate network.

Compare authentication records with resource permission grants and denied-operation logs. This item belongs to a different control area: Authentication and authorization. Its appropriate purpose is: Authentication proves identity or possession of credentials; authorization determines what that identity may do. For the stated case, Zero Trust is the closer match. Zero Trust does not automatically trust a user, device or connection because it originates on a corporate network.

Inspect identity records, provider trust configuration, account lifecycle status and application sign-in integration. This item belongs to a different control area: Identity providers and directories. Its appropriate purpose is: An identity provider handles authentication while a directory stores and organizes identities and attributes; neither equals the protected application. For the stated case, Zero Trust is the closer match. Zero Trust does not automatically trust a user, device or connection because it originates on a corporate network.