Pass Microsoft SC-900 Exam in First Attempt Guaranteed!

The workload accesses only the granted resource and no static application credential is embedded in code. This item belongs to a different control area: Managed identities. Its appropriate purpose is: Managed identities remove workload credential handling for supported Azure resources but still require appropriate authorization. For the stated case, Multifactor authentication is the closer match. MFA combines different factor categories to reduce account takeover from a stolen password alone.

Use Microsoft Entra ID as the cloud identity and access-management service for users, groups and applications. This item belongs to a different control area: Microsoft Entra ID cloud identity. Its appropriate purpose is: Microsoft Entra ID provides cloud directory and identity services, not network packet filtering or document retention. For the stated case, Multifactor authentication is the closer match. MFA combines different factor categories to reduce account takeover from a stolen password alone.

Inspect role definitions, active assignments and role audit events for tenant administrators. This item belongs to a different control area: Microsoft Entra role-based access control. Its appropriate purpose is: Entra administrative roles govern directory and identity operations; Azure resource RBAC is a separate scope model. For the stated case, Multifactor authentication is the closer match. MFA combines different factor categories to reduce account takeover from a stolen password alone.

The workload accesses only the granted resource and no static application credential is embedded in code. This item belongs to a different control area: Managed identities. Its appropriate purpose is: Managed identities remove workload credential handling for supported Azure resources but still require appropriate authorization. For the stated case, Access reviews is the closer match. Access reviews periodically reassess existing permissions, unlike a new initial access request.

Known weak or organization-specific passwords are rejected where the configured protection is enforced. This item belongs to a different control area: Password protection. Its appropriate purpose is: Password protection blocks weak password choices; it does not replace MFA or a full identity risk policy. For the stated case, Access reviews is the closer match. Access reviews periodically reassess existing permissions, unlike a new initial access request.

The automation receives only its consented permissions and unused credentials are removed or rotated. This item belongs to a different control area: Service principals. Its appropriate purpose is: Service principals represent applications or services rather than individual human users; credentials and consent must be governed. For the stated case, Access reviews is the closer match. Access reviews periodically reassess existing permissions, unlike a new initial access request.

Use security policies, standards and recommendations to drive governed cloud configuration hardening. This item belongs to a different control area: Cloud security policies and recommendations. Its appropriate purpose is: A recommendation identifies a technical improvement; a documented policy or assigned standard provides expectations for assessed resources. For the stated case, Microsoft Sentinel SOAR playbooks is the closer match. SOAR automates and orchestrates workflows; it complements rather than replaces detection analytics and human judgment.

Store and access application secrets in Azure Key Vault with appropriately controlled authorization. This item belongs to a different control area: Azure Key Vault secrets. Its appropriate purpose is: Key Vault manages keys, secrets and certificates; it is not a general-purpose file storage or SIEM service. For the stated case, Microsoft Sentinel SOAR playbooks is the closer match. SOAR automates and orchestrates workflows; it complements rather than replaces detection analytics and human judgment.

Use supported Defender for Cloud Apps Conditional Access App Control session controls for cloud app activity when configured. This item belongs to a different control area: Defender for Cloud Apps session controls. Its appropriate purpose is: Session controls provide real-time governance of supported cloud app activities; discovery alone does not enforce session behaviors. For the stated case, Microsoft Sentinel SOAR playbooks is the closer match. SOAR automates and orchestrates workflows; it complements rather than replaces detection analytics and human judgment.

Only validated principals with appropriate entitlements can reach sensitive cloud resources regardless of location. This item belongs to a different control area: Identity as security perimeter. Its appropriate purpose is: Cloud users and workloads access resources from varied networks, making authenticated identity and authorization central boundaries. For the stated case, Encryption is the closer match. Encryption makes data unreadable to an unauthorized party without the appropriate key; it differs from a one-way hash.

The application accepts the intended provider's authenticated users and respects account disablement and configured access. This item belongs to a different control area: Identity providers and directories. Its appropriate purpose is: An identity provider handles authentication while a directory stores and organizes identities and attributes; neither equals the protected application. For the stated case, Encryption is the closer match. Encryption makes data unreadable to an unauthorized party without the appropriate key; it differs from a one-way hash.

A verified sign-in succeeds without automatically allowing operations that the identity has not been granted. This item belongs to a different control area: Authentication and authorization. Its appropriate purpose is: Authentication proves identity or possession of credentials; authorization determines what that identity may do. For the stated case, Encryption is the closer match. Encryption makes data unreadable to an unauthorized party without the appropriate key; it differs from a one-way hash.

Deploy Windows Hello for Business for strong device-associated user authentication on supported Windows endpoints. This item belongs to a different control area: Windows Hello for Business. Its appropriate purpose is: Windows Hello for Business replaces reusable password use in supported scenarios with device-bound asymmetric credentials and local user verification. For the stated case, Lifecycle workflows is the closer match. Lifecycle workflows automate repeatable identity onboarding and offboarding tasks; review of ongoing entitlements remains a separate control.

Require an additional authentication factor for relevant user sign-ins using supported Entra MFA methods. This item belongs to a different control area: Multifactor authentication. Its appropriate purpose is: MFA combines different factor categories to reduce account takeover from a stolen password alone. For the stated case, Lifecycle workflows is the closer match. Lifecycle workflows automate repeatable identity onboarding and offboarding tasks; review of ongoing entitlements remains a separate control.

Connect on-premises Active Directory identities with Microsoft Entra ID for a coordinated hybrid identity experience. This item belongs to a different control area: Hybrid identity. Its appropriate purpose is: Hybrid identity coordinates on-premises and cloud identity management; it does not automatically move every workload to Azure. For the stated case, Lifecycle workflows is the closer match. Lifecycle workflows automate repeatable identity onboarding and offboarding tasks; review of ongoing entitlements remains a separate control.

External identities sign in through the trusted home provider and receive only the application's authorized access. This item belongs to a different control area: Identity federation. Its appropriate purpose is: Federation extends authentication trust across security domains; it does not automatically grant unrestricted permissions. For the stated case, Encryption is the closer match. Encryption makes data unreadable to an unauthorized party without the appropriate key; it differs from a one-way hash.

The application accepts the intended provider's authenticated users and respects account disablement and configured access. This item belongs to a different control area: Identity providers and directories. Its appropriate purpose is: An identity provider handles authentication while a directory stores and organizes identities and attributes; neither equals the protected application. For the stated case, Encryption is the closer match. Encryption makes data unreadable to an unauthorized party without the appropriate key; it differs from a one-way hash.

A verified sign-in succeeds without automatically allowing operations that the identity has not been granted. This item belongs to a different control area: Authentication and authorization. Its appropriate purpose is: Authentication proves identity or possession of credentials; authorization determines what that identity may do. For the stated case, Encryption is the closer match. Encryption makes data unreadable to an unauthorized party without the appropriate key; it differs from a one-way hash.

External identities sign in through the trusted home provider and receive only the application's authorized access. This item belongs to a different control area: Identity federation. Its appropriate purpose is: Federation extends authentication trust across security domains; it does not automatically grant unrestricted permissions. For the stated case, Defense in depth is the closer match. Defense in depth reduces reliance on any one protection; it is not a claim that all risks can be eliminated.

Only validated principals with appropriate entitlements can reach sensitive cloud resources regardless of location. This item belongs to a different control area: Identity as security perimeter. Its appropriate purpose is: Cloud users and workloads access resources from varied networks, making authenticated identity and authorization central boundaries. For the stated case, Defense in depth is the closer match. Defense in depth reduces reliance on any one protection; it is not a claim that all risks can be eliminated.

The application accepts the intended provider's authenticated users and respects account disablement and configured access. This item belongs to a different control area: Identity providers and directories. Its appropriate purpose is: An identity provider handles authentication while a directory stores and organizes identities and attributes; neither equals the protected application. For the stated case, Defense in depth is the closer match. Defense in depth reduces reliance on any one protection; it is not a claim that all risks can be eliminated.

Inspect eDiscovery cases, custodians, holds, search results and export or review actions. This item belongs to a different control area: Microsoft Purview eDiscovery. Its appropriate purpose is: eDiscovery supports legal and regulatory evidence workflows; it is distinct from real-time data loss prevention. For the stated case, Activity explorer is the closer match. Activity explorer focuses on what happened to data, unlike Content explorer's inventory of classified content.

Inspect assessments, improvement actions, assigned owners and uploaded evidence. This item belongs to a different control area: Compliance Manager. Its appropriate purpose is: Compliance Manager maps control activities and improvements; it does not automatically guarantee legal compliance. For the stated case, Activity explorer is the closer match. Activity explorer focuses on what happened to data, unlike Content explorer's inventory of classified content.

Inspect the relevant Purview solution pages, available roles and enabled features. This item belongs to a different control area: Microsoft Purview portal. Its appropriate purpose is: The Purview portal is a central interface for multiple compliance and data-governance solutions, not itself a finished compliance certification. For the stated case, Activity explorer is the closer match. Activity explorer focuses on what happened to data, unlike Content explorer's inventory of classified content.

Scope Conditional Access to selected cloud applications and test policy results before enforcement. This item belongs to a different control area: Conditional Access application targeting. Its appropriate purpose is: A policy should be tested for targeted principals and applications, with emergency-access exclusions where appropriate. For the stated case, Password protection is the closer match. Password protection blocks weak password choices; it does not replace MFA or a full identity risk policy.

A managed tenant identity can sign in to integrated cloud resources under assigned access policies. This item belongs to a different control area: Microsoft Entra ID cloud identity. Its appropriate purpose is: Microsoft Entra ID provides cloud directory and identity services, not network packet filtering or document retention. For the stated case, Password protection is the closer match. Password protection blocks weak password choices; it does not replace MFA or a full identity risk policy.

Inspect subscription or resource role assignments and effective permissions for the target resource. This item belongs to a different control area: Azure resource RBAC versus Entra roles. Its appropriate purpose is: Azure RBAC governs Azure resource permissions, whereas Microsoft Entra roles govern directory services. For the stated case, Password protection is the closer match. Password protection blocks weak password choices; it does not replace MFA or a full identity risk policy.

Inspect policy assignments, noncompliant resources and recommendation-to-remediation mappings. This item belongs to a different control area: Cloud security policies and recommendations. Its appropriate purpose is: A recommendation identifies a technical improvement; a documented policy or assigned standard provides expectations for assessed resources. For the stated case, Endpoint attack surface reduction is the closer match. ASR rules reduce common exploit paths on endpoints and can be tested in audit mode before enforcement.

Inspect NSG effective rules, priority ordering and flow evaluation for the affected network interface. This item belongs to a different control area: Network security groups. Its appropriate purpose is: NSGs provide ordered L3/L4 traffic filtering in Azure, not deep web-request inspection. For the stated case, Endpoint attack surface reduction is the closer match. ASR rules reduce common exploit paths on endpoints and can be tested in audit mode before enforcement.

Inspect incident timelines, alert evidence, related entities and assigned ownership. This item belongs to a different control area: Microsoft Sentinel incident investigation. Its appropriate purpose is: Incident management helps investigate and coordinate alerts; it differs from automatic enforcement through a playbook. For the stated case, Endpoint attack surface reduction is the closer match. ASR rules reduce common exploit paths on endpoints and can be tested in audit mode before enforcement.

Use Azure DDoS Protection for protection of exposed Azure public IP resources against volumetric network attacks where appropriate. This item belongs to a different control area: Azure DDoS Protection. Its appropriate purpose is: DDoS Protection addresses distributed denial-of-service traffic aimed at network services; it does not replace a web-application rule engine. For the stated case, Defender for Cloud Apps session controls is the closer match. Session controls provide real-time governance of supported cloud app activities; discovery alone does not enforce session behaviors.

Use Azure Key Vault to centrally control cryptographic key or certificate material and its authorized operations. This item belongs to a different control area: Azure Key Vault keys and certificates. Its appropriate purpose is: Key Vault supports cryptographic key and certificate lifecycle; secret storage alone is not a substitute for proper key policy. For the stated case, Defender for Cloud Apps session controls is the closer match. Session controls provide real-time governance of supported cloud app activities; discovery alone does not enforce session behaviors.

Apply Azure network security group rules to allow or deny traffic by source, destination, port and protocol at subnet or NIC scope. This item belongs to a different control area: Network security groups. Its appropriate purpose is: NSGs provide ordered L3/L4 traffic filtering in Azure, not deep web-request inspection. For the stated case, Defender for Cloud Apps session controls is the closer match. Session controls provide real-time governance of supported cloud app activities; discovery alone does not enforce session behaviors.