Pass Microsoft SC-900 Exam in First Attempt Guaranteed!

Disallowed network flows are blocked by the expected rule without disrupting explicitly permitted connections. This item belongs to a different control area: Network security groups. Its appropriate purpose is: NSGs provide ordered L3/L4 traffic filtering in Azure, not deep web-request inspection. For the stated case, Defender for Identity is the closer match. Defender for Identity monitors on-premises identity threats and domain controller signals; it is not a cloud app SaaS discovery catalog.

Use Azure DDoS Protection for protection of exposed Azure public IP resources against volumetric network attacks where appropriate. This item belongs to a different control area: Azure DDoS Protection. Its appropriate purpose is: DDoS Protection addresses distributed denial-of-service traffic aimed at network services; it does not replace a web-application rule engine. For the stated case, Defender for Identity is the closer match. Defender for Identity monitors on-premises identity threats and domain controller signals; it is not a cloud app SaaS discovery catalog.

Inspect VNet and subnet address plans, peering relationships and route tables. This item belongs to a different control area: Azure virtual network segmentation. Its appropriate purpose is: Virtual networks provide logical network isolation; separate security policies may still be needed to limit allowed flows. For the stated case, Defender for Identity is the closer match. Defender for Identity monitors on-premises identity threats and domain controller signals; it is not a cloud app SaaS discovery catalog.

Inspect firewall policies, rule collections, traffic logs and routed connection paths. This item belongs to a different control area: Azure Firewall. Its appropriate purpose is: Azure Firewall is a managed stateful network security service; it is not an identity provider or a retention tool. For the stated case, Cloud security policies and recommendations is the closer match. A recommendation identifies a technical improvement; a documented policy or assigned standard provides expectations for assessed resources.

Inspect key or certificate versions, permissions and renewal or rotation configuration. This item belongs to a different control area: Azure Key Vault keys and certificates. Its appropriate purpose is: Key Vault supports cryptographic key and certificate lifecycle; secret storage alone is not a substitute for proper key policy. For the stated case, Cloud security policies and recommendations is the closer match. A recommendation identifies a technical improvement; a documented policy or assigned standard provides expectations for assessed resources.

Inspect session policy scope, controlled activities and matched cloud app session events. This item belongs to a different control area: Defender for Cloud Apps session controls. Its appropriate purpose is: Session controls provide real-time governance of supported cloud app activities; discovery alone does not enforce session behaviors. For the stated case, Cloud security policies and recommendations is the closer match. A recommendation identifies a technical improvement; a documented policy or assigned standard provides expectations for assessed resources.

Inspect tenant user and group objects, enterprise application registration and sign-in events. This item belongs to a different control area: Microsoft Entra ID cloud identity. Its appropriate purpose is: Microsoft Entra ID provides cloud directory and identity services, not network packet filtering or document retention. For the stated case, Conditional Access application targeting is the closer match. A policy should be tested for targeted principals and applications, with emergency-access exclusions where appropriate.

Inspect synchronization health, scope filters, matching rules and recent export errors. This item belongs to a different control area: Microsoft Entra Connect synchronization. Its appropriate purpose is: Directory synchronization must be scoped and observed; enabling it without verifying source objects can create identity drift. For the stated case, Conditional Access application targeting is the closer match. A policy should be tested for targeted principals and applications, with emergency-access exclusions where appropriate.

Inspect workflow triggers, task execution history and resulting group or access changes. This item belongs to a different control area: Lifecycle workflows. Its appropriate purpose is: Lifecycle workflows automate repeatable identity onboarding and offboarding tasks; review of ongoing entitlements remains a separate control. For the stated case, Conditional Access application targeting is the closer match. A policy should be tested for targeted principals and applications, with emergency-access exclusions where appropriate.

Separate workloads into appropriately designed Azure virtual networks and subnets with explicit connectivity boundaries. This item belongs to a different control area: Azure virtual network segmentation. Its appropriate purpose is: Virtual networks provide logical network isolation; separate security policies may still be needed to limit allowed flows. For the stated case, Defender for Office 365 Safe Attachments is the closer match. Safe Attachments focuses on file-based email threats, whereas Safe Links protects URLs.

Use security policies, standards and recommendations to drive governed cloud configuration hardening. This item belongs to a different control area: Cloud security policies and recommendations. Its appropriate purpose is: A recommendation identifies a technical improvement; a documented policy or assigned standard provides expectations for assessed resources. For the stated case, Defender for Office 365 Safe Attachments is the closer match. Safe Attachments focuses on file-based email threats, whereas Safe Links protects URLs.

Configure Microsoft Sentinel analytics rules to detect defined suspicious patterns in ingested security data. This item belongs to a different control area: Microsoft Sentinel analytics rules. Its appropriate purpose is: Sentinel analytics rules evaluate telemetry to raise detections; collecting logs alone is insufficient to identify a defined pattern. For the stated case, Defender for Office 365 Safe Attachments is the closer match. Safe Attachments focuses on file-based email threats, whereas Safe Links protects URLs.

Inspect asset inventory, secure score, alerts, plans and recommendations in Defender for Cloud. This item belongs to a different control area: Defender for Cloud unified security posture. Its appropriate purpose is: Defender for Cloud combines CSPM and cloud workload protection capabilities; it is not the same as a single network security group. For the stated case, Microsoft Sentinel SOAR playbooks is the closer match. SOAR automates and orchestrates workflows; it complements rather than replaces detection analytics and human judgment.

Inspect session policy scope, controlled activities and matched cloud app session events. This item belongs to a different control area: Defender for Cloud Apps session controls. Its appropriate purpose is: Session controls provide real-time governance of supported cloud app activities; discovery alone does not enforce session behaviors. For the stated case, Microsoft Sentinel SOAR playbooks is the closer match. SOAR automates and orchestrates workflows; it complements rather than replaces detection analytics and human judgment.

Inspect WAF rules, managed-rule matches and HTTP request logs for the affected endpoint. This item belongs to a different control area: Azure Web Application Firewall. Its appropriate purpose is: A WAF targets application-layer HTTP risks such as injection, unlike basic network port filtering. For the stated case, Microsoft Sentinel SOAR playbooks is the closer match. SOAR automates and orchestrates workflows; it complements rather than replaces detection analytics and human judgment.

Inspect posture findings, resource coverage, attack paths where available and suggested remediations. This item belongs to a different control area: Cloud Security Posture Management. Its appropriate purpose is: CSPM evaluates configuration and exposure risk proactively, rather than solely responding to an endpoint malware alert. For the stated case, Defender for Office 365 Safe Links is the closer match. Safe Links addresses URL-based threats; it does not inspect attached files for malware.

Inspect policy assignments, noncompliant resources and recommendation-to-remediation mappings. This item belongs to a different control area: Cloud security policies and recommendations. Its appropriate purpose is: A recommendation identifies a technical improvement; a documented policy or assigned standard provides expectations for assessed resources. For the stated case, Defender for Office 365 Safe Links is the closer match. Safe Links addresses URL-based threats; it does not inspect attached files for malware.

Inspect attack mitigation telemetry, protected public IP association and network traffic anomaly patterns. This item belongs to a different control area: Azure DDoS Protection. Its appropriate purpose is: DDoS Protection addresses distributed denial-of-service traffic aimed at network services; it does not replace a web-application rule engine. For the stated case, Defender for Office 365 Safe Links is the closer match. Safe Links addresses URL-based threats; it does not inspect attached files for malware.

Configure and monitor an appropriate supported Microsoft Entra Connect synchronization method for hybrid users. This item belongs to a different control area: Microsoft Entra Connect synchronization. Its appropriate purpose is: Directory synchronization must be scoped and observed; enabling it without verifying source objects can create identity drift. For the stated case, Conditional Access application targeting is the closer match. A policy should be tested for targeted principals and applications, with emergency-access exclusions where appropriate.

Use Microsoft Entra ID as the cloud identity and access-management service for users, groups and applications. This item belongs to a different control area: Microsoft Entra ID cloud identity. Its appropriate purpose is: Microsoft Entra ID provides cloud directory and identity services, not network packet filtering or document retention. For the stated case, Conditional Access application targeting is the closer match. A policy should be tested for targeted principals and applications, with emergency-access exclusions where appropriate.

Automate defined joiner, mover and leaver identity tasks using Microsoft Entra Lifecycle Workflows where supported. This item belongs to a different control area: Lifecycle workflows. Its appropriate purpose is: Lifecycle workflows automate repeatable identity onboarding and offboarding tasks; review of ongoing entitlements remains a separate control. For the stated case, Conditional Access application targeting is the closer match. A policy should be tested for targeted principals and applications, with emergency-access exclusions where appropriate.

An analyst can reconstruct the incident sequence and document an evidence-based disposition. This item belongs to a different control area: Microsoft Sentinel incident investigation. Its appropriate purpose is: Incident management helps investigate and coordinate alerts; it differs from automatic enforcement through a playbook. For the stated case, Defender for Cloud workload protection is the closer match. Cloud workload protection detects threat signals and suspicious runtime behavior; CSPM primarily addresses configuration posture.

Traffic paths honor the intended segment boundaries and only deliberately connected networks can communicate. This item belongs to a different control area: Azure virtual network segmentation. Its appropriate purpose is: Virtual networks provide logical network isolation; separate security policies may still be needed to limit allowed flows. For the stated case, Defender for Cloud workload protection is the closer match. Cloud workload protection detects threat signals and suspicious runtime behavior; CSPM primarily addresses configuration posture.

Only approved flows traverse the central firewall while prohibited traffic is logged or denied. This item belongs to a different control area: Azure Firewall. Its appropriate purpose is: Azure Firewall is a managed stateful network security service; it is not an identity provider or a retention tool. For the stated case, Defender for Cloud workload protection is the closer match. Cloud workload protection detects threat signals and suspicious runtime behavior; CSPM primarily addresses configuration posture.

Inspect synchronization health, scope filters, matching rules and recent export errors. This item belongs to a different control area: Microsoft Entra Connect synchronization. Its appropriate purpose is: Directory synchronization must be scoped and observed; enabling it without verifying source objects can create identity drift. For the stated case, Conditional Access locations is the closer match. Conditional Access can evaluate network locations alongside identities and risk, but location by itself should not be assumed trustworthy.

Inspect tenant user and group objects, enterprise application registration and sign-in events. This item belongs to a different control area: Microsoft Entra ID cloud identity. Its appropriate purpose is: Microsoft Entra ID provides cloud directory and identity services, not network packet filtering or document retention. For the stated case, Conditional Access locations is the closer match. Conditional Access can evaluate network locations alongside identities and risk, but location by itself should not be assumed trustworthy.

Inspect registered passkey credentials, permitted authentication-method settings and sign-in method details. This item belongs to a different control area: Passkeys and FIDO2. Its appropriate purpose is: FIDO2 passkeys bind authentication to the legitimate relying party and resist credential phishing more effectively than SMS codes. For the stated case, Conditional Access locations is the closer match. Conditional Access can evaluate network locations alongside identities and risk, but location by itself should not be assumed trustworthy.

Malicious web request patterns are blocked or logged while legitimate web requests continue. This item belongs to a different control area: Azure Web Application Firewall. Its appropriate purpose is: A WAF targets application-layer HTTP risks such as injection, unlike basic network port filtering. For the stated case, Defender for Office 365 Safe Attachments is the closer match. Safe Attachments focuses on file-based email threats, whereas Safe Links protects URLs.

Traffic paths honor the intended segment boundaries and only deliberately connected networks can communicate. This item belongs to a different control area: Azure virtual network segmentation. Its appropriate purpose is: Virtual networks provide logical network isolation; separate security policies may still be needed to limit allowed flows. For the stated case, Defender for Office 365 Safe Attachments is the closer match. Safe Attachments focuses on file-based email threats, whereas Safe Links protects URLs.

Test events meeting detection criteria produce expected alerts or incidents without overwhelming false positives. This item belongs to a different control area: Microsoft Sentinel analytics rules. Its appropriate purpose is: Sentinel analytics rules evaluate telemetry to raise detections; collecting logs alone is insufficient to identify a defined pattern. For the stated case, Defender for Office 365 Safe Attachments is the closer match. Safe Attachments focuses on file-based email threats, whereas Safe Links protects URLs.

Inspect onboarded device inventory, detection alerts, process timelines and investigation findings. This item belongs to a different control area: Defender for Endpoint EDR. Its appropriate purpose is: Endpoint detection and response targets device-level malicious behavior, not Microsoft 365 document retention. For the stated case, Microsoft Sentinel SIEM ingestion is the closer match. A SIEM collects and correlates security telemetry; data ingestion is foundational before analytic rules can detect events.

Inspect NSG effective rules, priority ordering and flow evaluation for the affected network interface. This item belongs to a different control area: Network security groups. Its appropriate purpose is: NSGs provide ordered L3/L4 traffic filtering in Azure, not deep web-request inspection. For the stated case, Microsoft Sentinel SIEM ingestion is the closer match. A SIEM collects and correlates security telemetry; data ingestion is foundational before analytic rules can detect events.

Inspect policy assignments, noncompliant resources and recommendation-to-remediation mappings. This item belongs to a different control area: Cloud security policies and recommendations. Its appropriate purpose is: A recommendation identifies a technical improvement; a documented policy or assigned standard provides expectations for assessed resources. For the stated case, Microsoft Sentinel SIEM ingestion is the closer match. A SIEM collects and correlates security telemetry; data ingestion is foundational before analytic rules can detect events.