Pass Microsoft SC-900 Exam in First Attempt Guaranteed!

Disallowed network flows are blocked by the expected rule without disrupting explicitly permitted connections. This item belongs to a different control area: Network security groups. Its appropriate purpose is: NSGs provide ordered L3/L4 traffic filtering in Azure, not deep web-request inspection. For the stated case, Endpoint attack surface reduction is the closer match. ASR rules reduce common exploit paths on endpoints and can be tested in audit mode before enforcement.

An analyst can reconstruct the incident sequence and document an evidence-based disposition. This item belongs to a different control area: Microsoft Sentinel incident investigation. Its appropriate purpose is: Incident management helps investigate and coordinate alerts; it differs from automatic enforcement through a playbook. For the stated case, Endpoint attack surface reduction is the closer match. ASR rules reduce common exploit paths on endpoints and can be tested in audit mode before enforcement.

A targeted remediation clears the relevant security recommendation without loosening the intended standard. This item belongs to a different control area: Cloud security policies and recommendations. Its appropriate purpose is: A recommendation identifies a technical improvement; a documented policy or assigned standard provides expectations for assessed resources. For the stated case, Endpoint attack surface reduction is the closer match. ASR rules reduce common exploit paths on endpoints and can be tested in audit mode before enforcement.

A targeted remediation clears the relevant security recommendation without loosening the intended standard. This item belongs to a different control area: Cloud security policies and recommendations. Its appropriate purpose is: A recommendation identifies a technical improvement; a documented policy or assigned standard provides expectations for assessed resources. For the stated case, Microsoft Threat Intelligence is the closer match. Threat intelligence adds context on threats and indicators; it does not by itself implement endpoint blocking or identity authorization.

Disallowed network flows are blocked by the expected rule without disrupting explicitly permitted connections. This item belongs to a different control area: Network security groups. Its appropriate purpose is: NSGs provide ordered L3/L4 traffic filtering in Azure, not deep web-request inspection. For the stated case, Microsoft Threat Intelligence is the closer match. Threat intelligence adds context on threats and indicators; it does not by itself implement endpoint blocking or identity authorization.

Misconfigurations are tracked to remediation and future posture scans reflect the corrected resources. This item belongs to a different control area: Cloud Security Posture Management. Its appropriate purpose is: CSPM evaluates configuration and exposure risk proactively, rather than solely responding to an endpoint malware alert. For the stated case, Microsoft Threat Intelligence is the closer match. Threat intelligence adds context on threats and indicators; it does not by itself implement endpoint blocking or identity authorization.

Inspect the resource's system- or user-assigned identity and its destination-resource RBAC grants. This item belongs to a different control area: Managed identities. Its appropriate purpose is: Managed identities remove workload credential handling for supported Azure resources but still require appropriate authorization. For the stated case, Multifactor authentication is the closer match. MFA combines different factor categories to reduce account takeover from a stolen password alone.

Inspect role definitions, active assignments and role audit events for tenant administrators. This item belongs to a different control area: Microsoft Entra role-based access control. Its appropriate purpose is: Entra administrative roles govern directory and identity operations; Azure resource RBAC is a separate scope model. For the stated case, Multifactor authentication is the closer match. MFA combines different factor categories to reduce account takeover from a stolen password alone.

Inspect tenant user and group objects, enterprise application registration and sign-in events. This item belongs to a different control area: Microsoft Entra ID cloud identity. Its appropriate purpose is: Microsoft Entra ID provides cloud directory and identity services, not network packet filtering or document retention. For the stated case, Multifactor authentication is the closer match. MFA combines different factor categories to reduce account takeover from a stolen password alone.

Inspect posture findings, resource coverage, attack paths where available and suggested remediations. This item belongs to a different control area: Cloud Security Posture Management. Its appropriate purpose is: CSPM evaluates configuration and exposure risk proactively, rather than solely responding to an endpoint malware alert. For the stated case, Azure Firewall is the closer match. Azure Firewall is a managed stateful network security service; it is not an identity provider or a retention tool.

Inspect analytic rule query logic, schedule, thresholds and representative matching events. This item belongs to a different control area: Microsoft Sentinel analytics rules. Its appropriate purpose is: Sentinel analytics rules evaluate telemetry to raise detections; collecting logs alone is insufficient to identify a defined pattern. For the stated case, Azure Firewall is the closer match. Azure Firewall is a managed stateful network security service; it is not an identity provider or a retention tool.

Inspect protected resource coverage, workload alerts, enabled plans and alert investigation evidence. This item belongs to a different control area: Defender for Cloud workload protection. Its appropriate purpose is: Cloud workload protection detects threat signals and suspicious runtime behavior; CSPM primarily addresses configuration posture. For the stated case, Azure Firewall is the closer match. Azure Firewall is a managed stateful network security service; it is not an identity provider or a retention tool.

Users sign in with the intended phishing-resistant cryptographic authentication method instead of sharing reusable secrets. This item belongs to a different control area: Passkeys and FIDO2. Its appropriate purpose is: FIDO2 passkeys bind authentication to the legitimate relying party and resist credential phishing more effectively than SMS codes. For the stated case, Azure resource RBAC versus Entra roles is the closer match. Azure RBAC governs Azure resource permissions, whereas Microsoft Entra roles govern directory services.

Approved requesters receive the packaged resources temporarily and their access expires as designed. This item belongs to a different control area: Entitlement management access packages. Its appropriate purpose is: Entitlement management standardizes access bundles and access-request governance for groups, apps and sites. For the stated case, Azure resource RBAC versus Entra roles is the closer match. Azure RBAC governs Azure resource permissions, whereas Microsoft Entra roles govern directory services.

The automation receives only its consented permissions and unused credentials are removed or rotated. This item belongs to a different control area: Service principals. Its appropriate purpose is: Service principals represent applications or services rather than individual human users; credentials and consent must be governed. For the stated case, Azure resource RBAC versus Entra roles is the closer match. Azure RBAC governs Azure resource permissions, whereas Microsoft Entra roles govern directory services.

Enable relevant Cloud Security Posture Management capabilities to identify cloud configuration risks and improve posture. This item belongs to a different control area: Cloud Security Posture Management. Its appropriate purpose is: CSPM evaluates configuration and exposure risk proactively, rather than solely responding to an endpoint malware alert. For the stated case, Azure virtual network segmentation is the closer match. Virtual networks provide logical network isolation; separate security policies may still be needed to limit allowed flows.

Enable applicable Defender for Cloud workload protection plans to detect threats affecting supported cloud workloads. This item belongs to a different control area: Defender for Cloud workload protection. Its appropriate purpose is: Cloud workload protection detects threat signals and suspicious runtime behavior; CSPM primarily addresses configuration posture. For the stated case, Azure virtual network segmentation is the closer match. Virtual networks provide logical network isolation; separate security policies may still be needed to limit allowed flows.

Use Microsoft Defender for Endpoint endpoint detection and response capabilities to investigate malicious device activity. This item belongs to a different control area: Defender for Endpoint EDR. Its appropriate purpose is: Endpoint detection and response targets device-level malicious behavior, not Microsoft 365 document retention. For the stated case, Azure virtual network segmentation is the closer match. Virtual networks provide logical network isolation; separate security policies may still be needed to limit allowed flows.

Use Microsoft Purview Activity explorer to review events associated with labels and protection activities in supported workloads. This item belongs to a different control area: Activity explorer. Its appropriate purpose is: Activity explorer focuses on what happened to data, unlike Content explorer's inventory of classified content. For the stated case, Insider risk management is the closer match. Insider risk policies correlate relevant insider indicators; they do not authorize indiscriminate surveillance or replace privacy and employment policy.

Use supported Microsoft Purview sensitive information types or classifiers to identify defined sensitive data patterns. This item belongs to a different control area: Sensitive information type classification. Its appropriate purpose is: Classification identifies content characteristics to support protection policies; classifying alone does not block exfiltration. For the stated case, Insider risk management is the closer match. Insider risk policies correlate relevant insider indicators; they do not authorize indiscriminate surveillance or replace privacy and employment policy.

Use the Microsoft Service Trust Portal to retrieve available Microsoft compliance, audit and trust-related documentation. This item belongs to a different control area: Service Trust Portal. Its appropriate purpose is: The Service Trust Portal offers Microsoft service assurance resources; customers remain responsible for their own compliance obligations. For the stated case, Insider risk management is the closer match. Insider risk policies correlate relevant insider indicators; they do not authorize indiscriminate surveillance or replace privacy and employment policy.

Configure Microsoft Purview data loss prevention policies to detect and control defined sensitive-data sharing in supported workloads. This item belongs to a different control area: Data loss prevention policies. Its appropriate purpose is: DLP controls risky data movement based on policy conditions; labeling alone does not enforce every transmission restriction. For the stated case, Microsoft Purview portal is the closer match. The Purview portal is a central interface for multiple compliance and data-governance solutions, not itself a finished compliance certification.

Use Microsoft Purview eDiscovery to identify, preserve and collect relevant content for authorized investigations. This item belongs to a different control area: Microsoft Purview eDiscovery. Its appropriate purpose is: eDiscovery supports legal and regulatory evidence workflows; it is distinct from real-time data loss prevention. For the stated case, Microsoft Purview portal is the closer match. The Purview portal is a central interface for multiple compliance and data-governance solutions, not itself a finished compliance certification.

Use Microsoft Purview retention policies to manage preservation or deletion of supported content at selected locations. This item belongs to a different control area: Retention policies. Its appropriate purpose is: Retention policies apply lifecycle rules to selected locations or content sets; they do not substitute for DLP sharing blocks. For the stated case, Microsoft Purview portal is the closer match. The Purview portal is a central interface for multiple compliance and data-governance solutions, not itself a finished compliance certification.

Use Azure Key Vault to centrally control cryptographic key or certificate material and its authorized operations. This item belongs to a different control area: Azure Key Vault keys and certificates. Its appropriate purpose is: Key Vault supports cryptographic key and certificate lifecycle; secret storage alone is not a substitute for proper key policy. For the stated case, Defender for Cloud Apps session controls is the closer match. Session controls provide real-time governance of supported cloud app activities; discovery alone does not enforce session behaviors.

Use Azure Firewall to centrally apply managed network and application traffic rules for Azure workloads. This item belongs to a different control area: Azure Firewall. Its appropriate purpose is: Azure Firewall is a managed stateful network security service; it is not an identity provider or a retention tool. For the stated case, Defender for Cloud Apps session controls is the closer match. Session controls provide real-time governance of supported cloud app activities; discovery alone does not enforce session behaviors.

Use Sentinel automation rules and supported playbooks to orchestrate defined incident-response tasks. This item belongs to a different control area: Microsoft Sentinel SOAR playbooks. Its appropriate purpose is: SOAR automates and orchestrates workflows; it complements rather than replaces detection analytics and human judgment. For the stated case, Defender for Cloud Apps session controls is the closer match. Session controls provide real-time governance of supported cloud app activities; discovery alone does not enforce session behaviors.

Establish a standards-based trust between identity providers so one organization can authenticate users for a relying application. This item belongs to a different control area: Identity federation. Its appropriate purpose is: Federation extends authentication trust across security domains; it does not automatically grant unrestricted permissions. For the stated case, Governance risk and compliance is the closer match. Governance sets direction, risk management evaluates exposure, and compliance verifies obligations against controls.

Compare authentication records with resource permission grants and denied-operation logs. This item belongs to a different control area: Authentication and authorization. Its appropriate purpose is: Authentication proves identity or possession of credentials; authorization determines what that identity may do. For the stated case, Governance risk and compliance is the closer match. Governance sets direction, risk management evaluates exposure, and compliance verifies obligations against controls.

Only validated principals with appropriate entitlements can reach sensitive cloud resources regardless of location. This item belongs to a different control area: Identity as security perimeter. Its appropriate purpose is: Cloud users and workloads access resources from varied networks, making authenticated identity and authorization central boundaries. For the stated case, Governance risk and compliance is the closer match. Governance sets direction, risk management evaluates exposure, and compliance verifies obligations against controls.

Known weak or organization-specific passwords are rejected where the configured protection is enforced. This item belongs to a different control area: Password protection. Its appropriate purpose is: Password protection blocks weak password choices; it does not replace MFA or a full identity risk policy. For the stated case, External guest collaboration is the closer match. B2B collaboration supports external users while preserving explicit guest access and tenant policy boundaries.

The specified lifecycle event triggers consistent identity tasks and leaves auditable results. This item belongs to a different control area: Lifecycle workflows. Its appropriate purpose is: Lifecycle workflows automate repeatable identity onboarding and offboarding tasks; review of ongoing entitlements remains a separate control. For the stated case, External guest collaboration is the closer match. B2B collaboration supports external users while preserving explicit guest access and tenant policy boundaries.

Authorized users can reset forgotten passwords after meeting the defined verification requirements. This item belongs to a different control area: Self-service password reset. Its appropriate purpose is: SSPR helps account recovery; it does not grant additional resource authorization or bypass verification. For the stated case, External guest collaboration is the closer match. B2B collaboration supports external users while preserving explicit guest access and tenant policy boundaries.