Pass Microsoft SC-900 Exam in First Attempt Guaranteed!

Use Azure DDoS Protection for protection of exposed Azure public IP resources against volumetric network attacks where appropriate. This item belongs to a different control area: Azure DDoS Protection. Its appropriate purpose is: DDoS Protection addresses distributed denial-of-service traffic aimed at network services; it does not replace a web-application rule engine. For the stated case, Defender for Cloud Apps session controls is the closer match. Session controls provide real-time governance of supported cloud app activities; discovery alone does not enforce session behaviors.

Use Azure Key Vault to centrally control cryptographic key or certificate material and its authorized operations. This item belongs to a different control area: Azure Key Vault keys and certificates. Its appropriate purpose is: Key Vault supports cryptographic key and certificate lifecycle; secret storage alone is not a substitute for proper key policy. For the stated case, Defender for Cloud Apps session controls is the closer match. Session controls provide real-time governance of supported cloud app activities; discovery alone does not enforce session behaviors.

Apply Azure network security group rules to allow or deny traffic by source, destination, port and protocol at subnet or NIC scope. This item belongs to a different control area: Network security groups. Its appropriate purpose is: NSGs provide ordered L3/L4 traffic filtering in Azure, not deep web-request inspection. For the stated case, Defender for Cloud Apps session controls is the closer match. Session controls provide real-time governance of supported cloud app activities; discovery alone does not enforce session behaviors.

Establish a standards-based trust between identity providers so one organization can authenticate users for a relying application. This item belongs to a different control area: Identity federation. Its appropriate purpose is: Federation extends authentication trust across security domains; it does not automatically grant unrestricted permissions. For the stated case, Zero Trust is the closer match. Zero Trust does not automatically trust a user, device or connection because it originates on a corporate network.

Authenticate the principal first and separately authorize only the permitted resource actions. This item belongs to a different control area: Authentication and authorization. Its appropriate purpose is: Authentication proves identity or possession of credentials; authorization determines what that identity may do. For the stated case, Zero Trust is the closer match. Zero Trust does not automatically trust a user, device or connection because it originates on a corporate network.

Protect and verify identities as a primary perimeter for cloud access rather than relying only on a building network. This item belongs to a different control area: Identity as security perimeter. Its appropriate purpose is: Cloud users and workloads access resources from varied networks, making authenticated identity and authorization central boundaries. For the stated case, Zero Trust is the closer match. Zero Trust does not automatically trust a user, device or connection because it originates on a corporate network.

Use Defender for Cloud regulatory compliance views to map cloud resource findings to applicable standards. This item belongs to a different control area: Defender for Cloud regulatory compliance. Its appropriate purpose is: Regulatory compliance views relate assessed technical controls to frameworks; they do not by themselves certify organizational legal compliance. For the stated case, Azure Bastion is the closer match. Bastion supplies browser- or client-mediated secure VM management access; it is not a DDoS service.

Relevant on-premises directory attack behavior generates supported identity threat detections. This item belongs to a different control area: Defender for Identity. Its appropriate purpose is: Defender for Identity monitors on-premises identity threats and domain controller signals; it is not a cloud app SaaS discovery catalog. For the stated case, Azure Bastion is the closer match. Bastion supplies browser- or client-mediated secure VM management access; it is not a DDoS service.

Inspect session policy scope, controlled activities and matched cloud app session events. This item belongs to a different control area: Defender for Cloud Apps session controls. Its appropriate purpose is: Session controls provide real-time governance of supported cloud app activities; discovery alone does not enforce session behaviors. For the stated case, Azure Bastion is the closer match. Bastion supplies browser- or client-mediated secure VM management access; it is not a DDoS service.

A qualifying risky activity is triaged through the authorized insider-risk workflow with documented disposition. This item belongs to a different control area: Insider risk management. Its appropriate purpose is: Insider risk policies correlate relevant insider indicators; they do not authorize indiscriminate surveillance or replace privacy and employment policy. For the stated case, Compliance Manager is the closer match. Compliance Manager maps control activities and improvements; it does not automatically guarantee legal compliance.

Inspect audit search parameters, event operations, actors and timestamps for the relevant workload. This item belongs to a different control area: Microsoft Purview Audit. Its appropriate purpose is: Audit provides activity logging and search, not a tool to classify documents or automatically enforce retention. For the stated case, Compliance Manager is the closer match. Compliance Manager maps control activities and improvements; it does not automatically guarantee legal compliance.

Configure Microsoft Purview data loss prevention policies to detect and control defined sensitive-data sharing in supported workloads. This item belongs to a different control area: Data loss prevention policies. Its appropriate purpose is: DLP controls risky data movement based on policy conditions; labeling alone does not enforce every transmission restriction. For the stated case, Compliance Manager is the closer match. Compliance Manager maps control activities and improvements; it does not automatically guarantee legal compliance.

Covered content is retained or disposed of according to the policy and location configuration. This item belongs to a different control area: Retention policies. Its appropriate purpose is: Retention policies apply lifecycle rules to selected locations or content sets; they do not substitute for DLP sharing blocks. For the stated case, Compliance score is the closer match. Compliance score measures tracked improvement progress; it is not a universal regulatory certification or breach-risk guarantee.

The investigator finds applicable activity events and can document who performed an action and when. This item belongs to a different control area: Microsoft Purview Audit. Its appropriate purpose is: Audit provides activity logging and search, not a tool to classify documents or automatically enforce retention. For the stated case, Compliance score is the closer match. Compliance score measures tracked improvement progress; it is not a universal regulatory certification or breach-risk guarantee.

Target items receive the correct retention label and follow the configured item-level lifecycle behavior. This item belongs to a different control area: Retention labels. Its appropriate purpose is: Retention labels govern specific items; a broad location-level retention policy does not provide the same fine-grained labeling behavior. For the stated case, Compliance score is the closer match. Compliance score measures tracked improvement progress; it is not a universal regulatory certification or breach-risk guarantee.

A managed tenant identity can sign in to integrated cloud resources under assigned access policies. This item belongs to a different control area: Microsoft Entra ID cloud identity. Its appropriate purpose is: Microsoft Entra ID provides cloud directory and identity services, not network packet filtering or document retention. For the stated case, Passkeys and FIDO2 is the closer match. FIDO2 passkeys bind authentication to the legitimate relying party and resist credential phishing more effectively than SMS codes.

Approved guests access only shared resources and can be removed without exposing a generic shared account. This item belongs to a different control area: External guest collaboration. Its appropriate purpose is: B2B collaboration supports external users while preserving explicit guest access and tenant policy boundaries. For the stated case, Passkeys and FIDO2 is the closer match. FIDO2 passkeys bind authentication to the legitimate relying party and resist credential phishing more effectively than SMS codes.

Configured controls respond to risky sign-ins or compromised-user signals and investigations track resolution. This item belongs to a different control area: Identity Protection risk detection. Its appropriate purpose is: Identity Protection detects identity-related risk signals; a generic role assignment alone does not assess risk. For the stated case, Passkeys and FIDO2 is the closer match. FIDO2 passkeys bind authentication to the legitimate relying party and resist credential phishing more effectively than SMS codes.

A qualifying incident triggers the approved response steps with auditable execution results. This item belongs to a different control area: Microsoft Sentinel SOAR playbooks. Its appropriate purpose is: SOAR automates and orchestrates workflows; it complements rather than replaces detection analytics and human judgment. For the stated case, Defender for Cloud Apps discovery is the closer match. Cloud app discovery assesses shadow IT usage, not the same task as investigating on-premises domain controller compromise.

Use Azure Key Vault to centrally control cryptographic key or certificate material and its authorized operations. This item belongs to a different control area: Azure Key Vault keys and certificates. Its appropriate purpose is: Key Vault supports cryptographic key and certificate lifecycle; secret storage alone is not a substitute for proper key policy. For the stated case, Defender for Cloud Apps discovery is the closer match. Cloud app discovery assesses shadow IT usage, not the same task as investigating on-premises domain controller compromise.

Inspect protected resource coverage, workload alerts, enabled plans and alert investigation evidence. This item belongs to a different control area: Defender for Cloud workload protection. Its appropriate purpose is: Cloud workload protection detects threat signals and suspicious runtime behavior; CSPM primarily addresses configuration posture. For the stated case, Defender for Cloud Apps discovery is the closer match. Cloud app discovery assesses shadow IT usage, not the same task as investigating on-premises domain controller compromise.

Register an application and control its service principal permissions for unattended application access. This item belongs to a different control area: Service principals. Its appropriate purpose is: Service principals represent applications or services rather than individual human users; credentials and consent must be governed. For the stated case, Access reviews is the closer match. Access reviews periodically reassess existing permissions, unlike a new initial access request.

Assign an Azure managed identity to a supported workload so it obtains Entra tokens without storing app passwords. This item belongs to a different control area: Managed identities. Its appropriate purpose is: Managed identities remove workload credential handling for supported Azure resources but still require appropriate authorization. For the stated case, Access reviews is the closer match. Access reviews periodically reassess existing permissions, unlike a new initial access request.

Apply Microsoft Entra Password Protection policies and custom banned-password screening where supported. This item belongs to a different control area: Password protection. Its appropriate purpose is: Password protection blocks weak password choices; it does not replace MFA or a full identity risk policy. For the stated case, Access reviews is the closer match. Access reviews periodically reassess existing permissions, unlike a new initial access request.

Enable relevant Cloud Security Posture Management capabilities to identify cloud configuration risks and improve posture. This item belongs to a different control area: Cloud Security Posture Management. Its appropriate purpose is: CSPM evaluates configuration and exposure risk proactively, rather than solely responding to an endpoint malware alert. For the stated case, Azure DDoS Protection is the closer match. DDoS Protection addresses distributed denial-of-service traffic aimed at network services; it does not replace a web-application rule engine.

Use Sentinel automation rules and supported playbooks to orchestrate defined incident-response tasks. This item belongs to a different control area: Microsoft Sentinel SOAR playbooks. Its appropriate purpose is: SOAR automates and orchestrates workflows; it complements rather than replaces detection analytics and human judgment. For the stated case, Azure DDoS Protection is the closer match. DDoS Protection addresses distributed denial-of-service traffic aimed at network services; it does not replace a web-application rule engine.

Use Microsoft Threat Intelligence capabilities and relevant threat context to enrich analysis of adversaries and indicators. This item belongs to a different control area: Microsoft Threat Intelligence. Its appropriate purpose is: Threat intelligence adds context on threats and indicators; it does not by itself implement endpoint blocking or identity authorization. For the stated case, Azure DDoS Protection is the closer match. DDoS Protection addresses distributed denial-of-service traffic aimed at network services; it does not replace a web-application rule engine.

Enable relevant Cloud Security Posture Management capabilities to identify cloud configuration risks and improve posture. This item belongs to a different control area: Cloud Security Posture Management. Its appropriate purpose is: CSPM evaluates configuration and exposure risk proactively, rather than solely responding to an endpoint malware alert. For the stated case, Azure Firewall is the closer match. Azure Firewall is a managed stateful network security service; it is not an identity provider or a retention tool.

Enable applicable Defender for Cloud workload protection plans to detect threats affecting supported cloud workloads. This item belongs to a different control area: Defender for Cloud workload protection. Its appropriate purpose is: Cloud workload protection detects threat signals and suspicious runtime behavior; CSPM primarily addresses configuration posture. For the stated case, Azure Firewall is the closer match. Azure Firewall is a managed stateful network security service; it is not an identity provider or a retention tool.

Configure Microsoft Sentinel analytics rules to detect defined suspicious patterns in ingested security data. This item belongs to a different control area: Microsoft Sentinel analytics rules. Its appropriate purpose is: Sentinel analytics rules evaluate telemetry to raise detections; collecting logs alone is insufficient to identify a defined pattern. For the stated case, Azure Firewall is the closer match. Azure Firewall is a managed stateful network security service; it is not an identity provider or a retention tool.

Inspect synchronization health, scope filters, matching rules and recent export errors. This item belongs to a different control area: Microsoft Entra Connect synchronization. Its appropriate purpose is: Directory synchronization must be scoped and observed; enabling it without verifying source objects can create identity drift. For the stated case, Windows Hello for Business is the closer match. Windows Hello for Business replaces reusable password use in supported scenarios with device-bound asymmetric credentials and local user verification.

Use Microsoft Entra Privileged Identity Management to require time-limited activation of eligible privileged roles. This item belongs to a different control area: Privileged Identity Management eligible roles. Its appropriate purpose is: PIM reduces standing privilege and provides just-in-time activation controls for supported roles. For the stated case, Windows Hello for Business is the closer match. Windows Hello for Business replaces reusable password use in supported scenarios with device-bound asymmetric credentials and local user verification.

The automation receives only its consented permissions and unused credentials are removed or rotated. This item belongs to a different control area: Service principals. Its appropriate purpose is: Service principals represent applications or services rather than individual human users; credentials and consent must be governed. For the stated case, Windows Hello for Business is the closer match. Windows Hello for Business replaces reusable password use in supported scenarios with device-bound asymmetric credentials and local user verification.