Pass Microsoft SC-900 Exam in First Attempt Guaranteed!

Schedule Microsoft Entra access reviews to let owners recertify whether users still need access. This item belongs to a different control area: Access reviews. Its appropriate purpose is: Access reviews periodically reassess existing permissions, unlike a new initial access request. For the stated case, Password protection is the closer match. Password protection blocks weak password choices; it does not replace MFA or a full identity risk policy.

Assign an Azure managed identity to a supported workload so it obtains Entra tokens without storing app passwords. This item belongs to a different control area: Managed identities. Its appropriate purpose is: Managed identities remove workload credential handling for supported Azure resources but still require appropriate authorization. For the stated case, Password protection is the closer match. Password protection blocks weak password choices; it does not replace MFA or a full identity risk policy.

Use Microsoft Entra ID Protection signals to identify and respond to risky users or sign-ins. This item belongs to a different control area: Identity Protection risk detection. Its appropriate purpose is: Identity Protection detects identity-related risk signals; a generic role assignment alone does not assess risk. For the stated case, Password protection is the closer match. Password protection blocks weak password choices; it does not replace MFA or a full identity risk policy.

Assign Azure resource RBAC at the smallest practical resource scope for resource management operations. This item belongs to a different control area: Azure resource RBAC versus Entra roles. Its appropriate purpose is: Azure RBAC governs Azure resource permissions, whereas Microsoft Entra roles govern directory services. For the stated case, Hybrid identity is the closer match. Hybrid identity coordinates on-premises and cloud identity management; it does not automatically move every workload to Azure.

Apply Microsoft Entra Password Protection policies and custom banned-password screening where supported. This item belongs to a different control area: Password protection. Its appropriate purpose is: Password protection blocks weak password choices; it does not replace MFA or a full identity risk policy. For the stated case, Hybrid identity is the closer match. Hybrid identity coordinates on-premises and cloud identity management; it does not automatically move every workload to Azure.

Scope Conditional Access to selected cloud applications and test policy results before enforcement. This item belongs to a different control area: Conditional Access application targeting. Its appropriate purpose is: A policy should be tested for targeted principals and applications, with emergency-access exclusions where appropriate. For the stated case, Hybrid identity is the closer match. Hybrid identity coordinates on-premises and cloud identity management; it does not automatically move every workload to Azure.

Inspect attack mitigation telemetry, protected public IP association and network traffic anomaly patterns. This item belongs to a different control area: Azure DDoS Protection. Its appropriate purpose is: DDoS Protection addresses distributed denial-of-service traffic aimed at network services; it does not replace a web-application rule engine. For the stated case, Defender for Identity is the closer match. Defender for Identity monitors on-premises identity threats and domain controller signals; it is not a cloud app SaaS discovery catalog.

Inspect VNet and subnet address plans, peering relationships and route tables. This item belongs to a different control area: Azure virtual network segmentation. Its appropriate purpose is: Virtual networks provide logical network isolation; separate security policies may still be needed to limit allowed flows. For the stated case, Defender for Identity is the closer match. Defender for Identity monitors on-premises identity threats and domain controller signals; it is not a cloud app SaaS discovery catalog.

Inspect NSG effective rules, priority ordering and flow evaluation for the affected network interface. This item belongs to a different control area: Network security groups. Its appropriate purpose is: NSGs provide ordered L3/L4 traffic filtering in Azure, not deep web-request inspection. For the stated case, Defender for Identity is the closer match. Defender for Identity monitors on-premises identity threats and domain controller signals; it is not a cloud app SaaS discovery catalog.

Inspect the review scope, reviewer decisions, cadence and application of review results. This item belongs to a different control area: Access reviews. Its appropriate purpose is: Access reviews periodically reassess existing permissions, unlike a new initial access request. For the stated case, Managed identities is the closer match. Managed identities remove workload credential handling for supported Azure resources but still require appropriate authorization.

Inspect PIM eligible and active assignments, activation policies and role activation logs. This item belongs to a different control area: Privileged Identity Management eligible roles. Its appropriate purpose is: PIM reduces standing privilege and provides just-in-time activation controls for supported roles. For the stated case, Managed identities is the closer match. Managed identities remove workload credential handling for supported Azure resources but still require appropriate authorization.

Inspect workflow triggers, task execution history and resulting group or access changes. This item belongs to a different control area: Lifecycle workflows. Its appropriate purpose is: Lifecycle workflows automate repeatable identity onboarding and offboarding tasks; review of ongoing entitlements remains a separate control. For the stated case, Managed identities is the closer match. Managed identities remove workload credential handling for supported Azure resources but still require appropriate authorization.

Use Microsoft Purview retention labels and publishing or auto-application policies for item-level lifecycle handling. This item belongs to a different control area: Retention labels. Its appropriate purpose is: Retention labels govern specific items; a broad location-level retention policy does not provide the same fine-grained labeling behavior. For the stated case, Microsoft Purview portal is the closer match. The Purview portal is a central interface for multiple compliance and data-governance solutions, not itself a finished compliance certification.

Use Microsoft Purview Content explorer to examine classified content locations and relevant item details with proper roles. This item belongs to a different control area: Content explorer. Its appropriate purpose is: Content explorer helps inspect classified data inventory; Activity explorer focuses on actions and activity history. For the stated case, Microsoft Purview portal is the closer match. The Purview portal is a central interface for multiple compliance and data-governance solutions, not itself a finished compliance certification.

Configure Microsoft Purview data loss prevention policies to detect and control defined sensitive-data sharing in supported workloads. This item belongs to a different control area: Data loss prevention policies. Its appropriate purpose is: DLP controls risky data movement based on policy conditions; labeling alone does not enforce every transmission restriction. For the stated case, Microsoft Purview portal is the closer match. The Purview portal is a central interface for multiple compliance and data-governance solutions, not itself a finished compliance certification.

Deploy Windows Hello for Business for strong device-associated user authentication on supported Windows endpoints. This item belongs to a different control area: Windows Hello for Business. Its appropriate purpose is: Windows Hello for Business replaces reusable password use in supported scenarios with device-bound asymmetric credentials and local user verification. For the stated case, Service principals is the closer match. Service principals represent applications or services rather than individual human users; credentials and consent must be governed.

Assign the least-privileged supported Microsoft Entra administrative role for a directory task. This item belongs to a different control area: Microsoft Entra role-based access control. Its appropriate purpose is: Entra administrative roles govern directory and identity operations; Azure resource RBAC is a separate scope model. For the stated case, Service principals is the closer match. Service principals represent applications or services rather than individual human users; credentials and consent must be governed.

Use location-based Conditional Access rules only as one evaluated sign-in signal, not as proof of identity. This item belongs to a different control area: Conditional Access locations. Its appropriate purpose is: Conditional Access can evaluate network locations alongside identities and risk, but location by itself should not be assumed trustworthy. For the stated case, Service principals is the closer match. Service principals represent applications or services rather than individual human users; credentials and consent must be governed.

Authenticate the principal first and separately authorize only the permitted resource actions. This item belongs to a different control area: Authentication and authorization. Its appropriate purpose is: Authentication proves identity or possession of credentials; authorization determines what that identity may do. For the stated case, Cryptographic hashing is the closer match. Hashing supports integrity checks or password verification when designed correctly; hashing by itself does not provide encryption or confidentiality.

Protect and verify identities as a primary perimeter for cloud access rather than relying only on a building network. This item belongs to a different control area: Identity as security perimeter. Its appropriate purpose is: Cloud users and workloads access resources from varied networks, making authenticated identity and authorization central boundaries. For the stated case, Cryptographic hashing is the closer match. Hashing supports integrity checks or password verification when designed correctly; hashing by itself does not provide encryption or confidentiality.

Use a trusted identity provider and directory to manage identities and support application sign-in. This item belongs to a different control area: Identity providers and directories. Its appropriate purpose is: An identity provider handles authentication while a directory stores and organizes identities and attributes; neither equals the protected application. For the stated case, Cryptographic hashing is the closer match. Hashing supports integrity checks or password verification when designed correctly; hashing by itself does not provide encryption or confidentiality.

Apply Azure network security group rules to allow or deny traffic by source, destination, port and protocol at subnet or NIC scope. This item belongs to a different control area: Network security groups. Its appropriate purpose is: NSGs provide ordered L3/L4 traffic filtering in Azure, not deep web-request inspection. For the stated case, Defender Vulnerability Management is the closer match. Vulnerability management focuses on identifying and prioritizing exposures; it is distinct from active incident correlation.

Inspect asset inventory, secure score, alerts, plans and recommendations in Defender for Cloud. This item belongs to a different control area: Defender for Cloud unified security posture. Its appropriate purpose is: Defender for Cloud combines CSPM and cloud workload protection capabilities; it is not the same as a single network security group. For the stated case, Defender Vulnerability Management is the closer match. Vulnerability management focuses on identifying and prioritizing exposures; it is distinct from active incident correlation.

Malicious web request patterns are blocked or logged while legitimate web requests continue. This item belongs to a different control area: Azure Web Application Firewall. Its appropriate purpose is: A WAF targets application-layer HTTP risks such as injection, unlike basic network port filtering. For the stated case, Defender Vulnerability Management is the closer match. Vulnerability management focuses on identifying and prioritizing exposures; it is distinct from active incident correlation.

Use the Microsoft Defender portal to review integrated Defender alerts, incidents and security investigations. This item belongs to a different control area: Microsoft Defender portal. Its appropriate purpose is: The Defender portal provides a unified security operations interface; it is not a replacement for configuring every underlying product. For the stated case, Defender for Cloud workload protection is the closer match. Cloud workload protection detects threat signals and suspicious runtime behavior; CSPM primarily addresses configuration posture.

Use Defender for Office 365 Safe Attachments to analyze suspicious email attachments with configured protection policies. This item belongs to a different control area: Defender for Office 365 Safe Attachments. Its appropriate purpose is: Safe Attachments focuses on file-based email threats, whereas Safe Links protects URLs. For the stated case, Defender for Cloud workload protection is the closer match. Cloud workload protection detects threat signals and suspicious runtime behavior; CSPM primarily addresses configuration posture.

Use Azure Key Vault to centrally control cryptographic key or certificate material and its authorized operations. This item belongs to a different control area: Azure Key Vault keys and certificates. Its appropriate purpose is: Key Vault supports cryptographic key and certificate lifecycle; secret storage alone is not a substitute for proper key policy. For the stated case, Defender for Cloud workload protection is the closer match. Cloud workload protection detects threat signals and suspicious runtime behavior; CSPM primarily addresses configuration posture.

Target items receive the correct retention label and follow the configured item-level lifecycle behavior. This item belongs to a different control area: Retention labels. Its appropriate purpose is: Retention labels govern specific items; a broad location-level retention policy does not provide the same fine-grained labeling behavior. For the stated case, Compliance score is the closer match. Compliance score measures tracked improvement progress; it is not a universal regulatory certification or breach-risk guarantee.

A qualifying risky activity is triaged through the authorized insider-risk workflow with documented disposition. This item belongs to a different control area: Insider risk management. Its appropriate purpose is: Insider risk policies correlate relevant insider indicators; they do not authorize indiscriminate surveillance or replace privacy and employment policy. For the stated case, Compliance score is the closer match. Compliance score measures tracked improvement progress; it is not a universal regulatory certification or breach-risk guarantee.

The reviewer obtains the applicable provider assurance documentation without treating it as proof of the customer's controls. This item belongs to a different control area: Service Trust Portal. Its appropriate purpose is: The Service Trust Portal offers Microsoft service assurance resources; customers remain responsible for their own compliance obligations. For the stated case, Compliance score is the closer match. Compliance score measures tracked improvement progress; it is not a universal regulatory certification or breach-risk guarantee.

Use Microsoft Threat Intelligence capabilities and relevant threat context to enrich analysis of adversaries and indicators. This item belongs to a different control area: Microsoft Threat Intelligence. Its appropriate purpose is: Threat intelligence adds context on threats and indicators; it does not by itself implement endpoint blocking or identity authorization. For the stated case, Defender for Cloud workload protection is the closer match. Cloud workload protection detects threat signals and suspicious runtime behavior; CSPM primarily addresses configuration posture.

Use Microsoft Sentinel incidents and investigation context to triage related alerts and affected entities. This item belongs to a different control area: Microsoft Sentinel incident investigation. Its appropriate purpose is: Incident management helps investigate and coordinate alerts; it differs from automatic enforcement through a playbook. For the stated case, Defender for Cloud workload protection is the closer match. Cloud workload protection detects threat signals and suspicious runtime behavior; CSPM primarily addresses configuration posture.

Use Defender for Office 365 Safe Attachments to analyze suspicious email attachments with configured protection policies. This item belongs to a different control area: Defender for Office 365 Safe Attachments. Its appropriate purpose is: Safe Attachments focuses on file-based email threats, whereas Safe Links protects URLs. For the stated case, Defender for Cloud workload protection is the closer match. Cloud workload protection detects threat signals and suspicious runtime behavior; CSPM primarily addresses configuration posture.