Microsoft Security, Compliance, and Identity Fundamentals SC-900 (SC-900) — Questions 1051–1125

Information Protection focuses on classifying, labeling, and protecting sensitive data (e.g., encryption, rights management), not on assessing compliance posture against multiple regulations or tracking improvement actions.

Data Lifecycle Management focuses on governing data retention and deletion policies, not on assessing compliance posture against regulations or tracking improvement actions.

Insider Risk Management is designed to detect, investigate, and act on risky user activities (e.g., data theft, policy violations), not to assess compliance posture against regulations or track improvement actions.

A question asking which Microsoft Purview solution to use for automatically classifying and protecting sensitive data (e.g., credit card numbers, health records) with sensitivity labels and encryption would make Information Protection the correct answer.

A question asking which solution manages retention and deletion of data to meet regulatory requirements, such as automatically archiving or deleting emails after a specified period for GDPR compliance.

A question asks: 'Which Microsoft Purview solution helps detect and investigate potential data security incidents caused by malicious or inadvertent insider activities, such as unauthorized data exfiltration?'

Candidates may confuse 'compliance' with 'protecting information' because both involve regulatory requirements, but Information Protection is about data security controls, not continuous compliance assessment and action tracking.

Candidates may mistakenly think that managing data lifecycle is sufficient for compliance, overlooking the need for continuous assessment and action tracking provided by Compliance Manager.

Candidates may confuse 'compliance' broadly with 'risk management' and assume Insider Risk Management covers regulatory compliance assessments, not realizing it focuses on user behavior risks rather than framework-based compliance scoring.

Data Lifecycle Management focuses on retaining or deleting data based on policies (e.g., retention labels), not on detecting, classifying, or protecting sensitive health information like medical record numbers.

Audit logs user and admin activities but does not detect, classify, or protect sensitive data like medical records. The question requires automatic detection, classification, encryption, and access restriction, which are capabilities of Information Protection, not Audit.

eDiscovery is used for searching and exporting content for legal or investigative purposes, not for automatically detecting, classifying, and protecting sensitive data like medical records.

A question asking which Microsoft Purview solution to use for automatically retaining healthcare records for a specific period (e.g., 6 years) to meet HIPAA retention requirements, then deleting them afterward.

A company needs to track who accessed sensitive documents in SharePoint and OneDrive for compliance reporting. They want to see a history of actions like viewing, editing, or sharing files. In this scenario, Audit would be the correct solution.

An organization needs to search for and export content related to a legal case or regulatory investigation, such as finding all emails and documents mentioning a specific patient's medical record number across Exchange Online and SharePoint.

Candidates may confuse lifecycle management with protection because both involve labels, and they might think managing data includes security controls like encryption.

Candidates may think Audit is needed to monitor compliance with HIPAA, but they overlook that the primary requirement is proactive data protection (detection, classification, encryption) rather than just logging activities.

Candidates may confuse eDiscovery's search capabilities with the detection and classification features of Information Protection, assuming that searching for sensitive data implies automatic protection.

Integrity ensures data accuracy and prevents unauthorized modification, not restriction of access. The question focuses on limiting who can view records, which is confidentiality.

The question specifies that the measure ensures only authorized employees can view records, which directly protects confidentiality (preventing unauthorized access), not availability (ensuring access when needed).

Accountability is not a principle of the CIA triad; the CIA triad consists of Confidentiality, Integrity, and Availability. This question specifically asks about the CIA triad, so Accountability is not a valid option.

A question asking which CIA principle is primarily protected by a measure that uses hashing to verify that customer records have not been altered during transmission.

A question stating: 'A company implements redundant servers and backup power to ensure customer records are always accessible. Which CIA principle does this protect?' would make availability correct.

A question asks: 'Which security principle ensures that actions can be traced back to a specific user?' In that context, Accountability would be the correct answer because it involves auditing and non-repudiation.

Candidates may confuse 'authorized employees' with data accuracy, thinking integrity involves ensuring only authorized changes, but the core here is viewing, not modifying.

Candidates may confuse 'access control' with 'availability' because both involve access, but availability focuses on uptime and reliability, not authorization.

Candidates may confuse Accountability with Confidentiality because both involve controlling access to data, but Accountability focuses on tracking who did what, not on preventing unauthorized viewing.

This option only enforces MFA, but the question explicitly requires both MFA and device compliance. It fails to block sign-ins from non-compliant devices, so it does not meet the full requirement.

The question requires both MFA and device compliance to be enforced simultaneously. Option C, 'Require one of the selected controls,' would allow sign-in if either MFA or device compliance is met, not both, failing to meet the requirement.

This option would be correct if the question asked only to require MFA when signing in from an untrusted network, without any device compliance requirement. For example: 'Ensure users complete MFA when accessing a financial app from an untrusted network.'

In a scenario where the security team wants to allow access if the user either completes MFA OR uses a compliant device (e.g., for a less critical app where flexibility is acceptable), selecting 'Require one of the selected controls' would be correct.

Candidates may think MFA alone is sufficient for security, overlooking the additional device compliance requirement. They might also assume that MFA implicitly covers device health, which is incorrect.

Candidates may misinterpret 'one of the selected controls' as meaning both controls are required, or they may think it provides a flexible way to enforce either condition without understanding that it grants access if only one condition is satisfied.

Data Lifecycle Management focuses on governing data retention and deletion policies, not on assessing compliance posture against frameworks like GDPR and ISO 27001 or tracking improvement actions.

Audit is used for investigating specific security or compliance events by searching the unified audit log, not for assessing compliance posture against frameworks like GDPR and ISO 27001 or tracking improvement actions.

eDiscovery is used for identifying and preserving electronic content for legal cases, not for assessing compliance posture against frameworks like GDPR and ISO 27001 or tracking improvement actions.

A question asking which Microsoft Purview solution to use for automatically retaining or deleting data based on regulatory requirements (e.g., GDPR data retention) would make Data Lifecycle Management the correct answer.

A question asking which Microsoft Purview solution allows an organization to search and export user and admin activity logs to investigate a security incident or perform forensic analysis would have Audit as the correct answer.

A legal team needs to identify and preserve all emails and documents related to a pending lawsuit across Microsoft 365. They require a tool to search, hold, and export relevant data for litigation purposes.

Candidates may confuse managing data lifecycle with managing compliance, as both involve regulatory requirements, but Data Lifecycle Management does not provide assessment or action tracking.

Candidates may confuse Audit with Compliance Manager because both are compliance-related, and they might think auditing is sufficient for compliance assessment without understanding the distinct capabilities of each solution.

Candidates may confuse eDiscovery with compliance because both involve data management and regulatory requirements, but eDiscovery focuses on litigation, not continuous compliance assessment.

The requirement to restrict access to customer data to authorized sales representatives directly enforces confidentiality, not integrity. Integrity ensures data is not tampered with or modified by unauthorized parties, but the primary goal here is preventing unauthorized access.

Non-repudiation ensures that a party cannot deny having performed an action (e.g., signing a document), but the requirement to restrict access to customer data is about preventing unauthorized disclosure, which is confidentiality.

A question that asks: 'A company wants to ensure that customer data has not been altered during transmission. Which security principle does this enforce?' In that context, integrity would be correct because it focuses on protecting data from unauthorized modification.

A question where the security policy requires that sales representatives cannot deny having accessed or modified customer data, such as 'The company needs to prove that a sales representative viewed a customer record; which principle is enforced?'

Candidates may confuse confidentiality with integrity because both involve protecting data. They might think that restricting access also ensures data remains unchanged, but integrity specifically addresses unauthorized modification, not access control.

Candidates may confuse non-repudiation with access control because both involve authorization and accountability, but non-repudiation specifically addresses denial of actions, not access restriction.

The scenario involves verifying that the file has not been altered, which is a matter of data integrity, not confidentiality. Confidentiality is about preventing unauthorized access, not ensuring data remains unchanged.

Availability ensures that resources are accessible when needed, but comparing hashes verifies that the file has not been altered, which is a matter of integrity, not availability.

Authentication verifies the identity of a user or system, not the integrity of data. Comparing hashes ensures the file hasn't been altered, which is integrity, not authentication.

A user downloads a sensitive document from a company's internal website that is encrypted using HTTPS. The user verifies that the document was not intercepted by checking the TLS certificate. This demonstrates confidentiality because encryption protects the data from being read during transmission.

A question describing a scenario where a company implements redundant servers and load balancing to ensure users can always download updates, even during high traffic or server failures, would demonstrate availability.

A user logs in using a password and biometric scan. Which security concept is demonstrated? The answer would be authentication, as it verifies the user's identity.

Candidates may confuse hashing with encryption or think that protecting data from tampering also keeps it secret, but hashing does not conceal the content.

Candidates may confuse availability with the ability to access and verify the file, thinking that the hash comparison confirms the file is 'available' in its original form, rather than recognizing it as an integrity check.

Candidates may confuse authentication with integrity because both involve verification processes, but authentication verifies identity, while integrity verifies data unchanged.

This option applies MFA to all users, including internal employees, which contradicts the requirement to enforce MFA only for external guest users.

Excluding internal users by group does not specifically target external guest users; it would still require MFA for all other users, including guests, but the question asks for MFA only for external guests, not all users.

Identity Protection's user risk policy requires Azure AD Premium P2 and evaluates sign-in risk, not user type. It cannot target only external guest users for MFA enforcement.

In a scenario where the company requires MFA for all users regardless of identity type, such as a security policy mandating MFA for every sign-in to protect against credential theft.

If the requirement were to enforce MFA for all users except a specific group of internal employees (e.g., IT admins), then excluding that group by group membership would be correct.

A question asks: 'A company wants to block sign-ins for users with compromised credentials detected by Microsoft. Which policy should be configured?' Then Identity Protection's user risk policy would be correct.

Candidates may think requiring MFA for all users is simpler and still covers external users, overlooking the need to exclude internal employees as specified.

Candidates may think that excluding internal users by group is a straightforward way to exempt them, but they overlook that the policy would still apply to all other users, including guests, which is not the desired outcome.

Candidates may confuse risk-based policies with identity-based targeting, assuming user risk policy can be scoped to guest users only.

Microsoft Defender for Cloud Apps focuses on shadow IT discovery and cloud app governance, not on email-level URL analysis or time-of-click verification for phishing protection.

Microsoft Defender for Endpoint focuses on endpoint devices (e.g., PCs, servers) and does not provide real-time URL analysis or sandboxing for email attachments. The question specifically requires email protection and time-of-click verification, which is outside Defender for Endpoint's scope.

Microsoft Cloud App Security (now part of Defender for Cloud Apps) is a CASB for controlling cloud app access and data, not for real-time URL analysis and sandboxing of email attachments. The question specifically requires email protection features like time-of-click verification and attachment sandboxing, which are provided by Defender for Office 365.

A company wants to discover and control the use of unsanctioned cloud apps, enforce data loss prevention policies across cloud services, and protect against malicious OAuth apps. In that scenario, Microsoft Defender for Cloud Apps would be the correct answer.

A company needs to protect its endpoints from malware and advanced threats. The solution must provide antivirus, endpoint detection and response (EDR), and automated investigation on devices. In this scenario, Microsoft Defender for Endpoint would be the correct answer.

This option would be correct if the question asked about discovering and controlling the use of third-party cloud apps, enforcing data loss prevention policies for cloud storage, or detecting anomalous behavior in cloud applications (e.g., unusual file downloads from Salesforce).

Candidates may confuse 'cloud apps' with email protection, or assume that any security solution from Microsoft can handle phishing, overlooking the specific email-focused capabilities of Defender for Office 365.

Candidates may confuse the broad 'Defender' branding, assuming all Defender products offer similar email protection, or they may think endpoint security includes email scanning because email clients run on endpoints.

Candidates may confuse Cloud App Security with email security because both involve threat protection, or they might think 'cloud' includes email (Exchange Online) and assume it covers phishing, not realizing Defender for Office 365 is the dedicated email security solution.

Encryption at rest protects data from being read, which is a confidentiality concern, not integrity. Integrity ensures data is not tampered with, but encryption alone does not prevent modification.

Encryption at rest protects data from being read, which is a confidentiality concern, not availability. Availability ensures data is accessible when needed, which encryption does not directly address.

Authorization controls who can access the data, but encryption at rest protects data from being read even if physical access is gained. The question asks about reading data from physical media, which is a confidentiality issue, not authorization.

A question asking which security concept is provided by hashing or digital signatures to ensure data has not been altered during transmission or storage would make integrity the correct answer.

In a question about ensuring that a cloud database remains accessible during a DDoS attack, the correct answer would be availability, as it focuses on uptime and access despite disruptions.

A question like 'Which security concept is enforced by requiring a user to authenticate before accessing a database?' would make Authorization correct, as it involves granting or denying access based on identity.

Candidates may confuse encryption with integrity because both involve cryptographic techniques, but encryption primarily protects confidentiality, while integrity is about detecting unauthorized changes.

Candidates may confuse encryption with overall security, thinking it contributes to availability by preventing data loss from theft, but encryption primarily protects confidentiality, not system uptime.

Candidates may confuse encryption with access control, thinking that encryption 'authorizes' only certain users to read data, but encryption primarily ensures confidentiality, not authorization.

Microsoft Defender for Endpoint focuses on endpoint device protection (antivirus, threat detection, and response), not on discovering cloud app usage, assessing app risk, or controlling data sharing in sanctioned cloud apps like Box or Dropbox.

Microsoft Defender for Office 365 focuses on protecting email and collaboration tools like Exchange, SharePoint, and Teams from threats such as phishing and malware, not on discovering and controlling cloud app usage or assessing app risk.

Microsoft Defender for Identity focuses on detecting and investigating advanced attacks on on-premises Active Directory, not on discovering or controlling cloud app usage or data sharing in sanctioned apps like Box or Dropbox.

A company wants to protect its endpoints (e.g., laptops, servers) from malware, detect advanced threats, and provide incident response capabilities. Which Microsoft solution should they implement?

This option would be correct if the question asked about protecting against email-based threats, such as phishing attacks, malware in attachments, or malicious links in Office 365, or securing SharePoint and OneDrive from malicious content.

This option would be correct in a scenario where the company needs to protect on-premises identities from advanced threats like Pass-the-Hash, Kerberos Golden Ticket attacks, or suspicious lateral movement, especially in a hybrid environment with Active Directory.

Candidates may confuse 'Defender' branding and assume all Defender products cover cloud app security, or they may think endpoint protection includes monitoring cloud app usage on devices.

Candidates may confuse the cloud app discovery and data control capabilities of Defender for Cloud Apps with the Office 365 security features, assuming that Office 365 security covers all cloud app usage since Office 365 is a cloud suite.

Candidates may confuse identity protection with cloud app security, assuming that securing identities automatically controls cloud app usage, or they may think Defender for Identity covers all Microsoft security solutions broadly.

Microsoft Defender for Cloud is a cloud security posture management (CSPM) and cloud workload protection platform (CWPP) that focuses on securing cloud resources, not on centralizing security logs from multiple sources (including on-premises) with built-in SIEM analytics and automated response playbooks.

Microsoft 365 Defender is designed to protect Microsoft 365 workloads (e.g., email, endpoints, identities) and does not natively ingest third-party logs like AWS CloudTrail or on-premises firewalls, nor does it provide centralized SIEM capabilities for multi-source log collection and custom automated playbooks.

Microsoft Defender for Cloud Apps is a cloud access security broker (CASB) focused on shadow IT discovery and controlling access to cloud apps, not a centralized SIEM/SOAR for multi-source log collection and automated threat response.

A company wants to assess and improve the security posture of their Azure, AWS, and GCP workloads, get recommendations for hardening, and protect against cloud-specific threats like misconfigurations and vulnerabilities. They need a solution that provides unified visibility and threat protection across cloud environments.

A company wants to unify detection and response across Microsoft 365 services (Exchange, SharePoint, Teams, endpoints) and use built-in automated investigation and remediation for threats like phishing or malware, without needing to ingest non-Microsoft logs or create custom playbooks.

A company wants to discover and control the use of unsanctioned cloud apps (shadow IT), enforce data loss prevention policies for cloud applications, and get visibility into user activities across SaaS apps like Office 365, Salesforce, or AWS.

Candidates may confuse Defender for Cloud's multi-cloud support and threat detection capabilities with the centralized log collection and SIEM/SOAR features of Sentinel, especially since both involve security monitoring and analytics.

Candidates may confuse Microsoft 365 Defender's security analytics and automation features with Sentinel's SIEM capabilities, or assume that 'Defender' products cover all security needs, overlooking the requirement for multi-source log ingestion and custom playbooks.

Candidates may confuse Defender for Cloud Apps with a general security analytics tool because its name includes 'Defender' and it deals with cloud logs, but it lacks the centralized SIEM and SOAR capabilities of Sentinel.

Confidentiality ensures data is accessible only to authorized users, but the described architecture focuses on maintaining service uptime across regions, which is a core availability concern.

Integrity ensures data is not tampered with, but the scenario describes deploying across regions for automatic failover, which directly addresses availability, not integrity.

Non-repudiation ensures that actions or transactions cannot be denied by the parties involved, typically through digital signatures or audit logs. The scenario describes a multi-region deployment for failover, which directly addresses availability, not non-repudiation.

A question describing encryption of customer data at rest and in transit, or implementing access controls to prevent unauthorized disclosure, would make confidentiality the correct answer.

Integrity would be correct if the question described a scenario where the company uses Azure SQL Database with transparent data encryption (TDE) or Azure Storage with immutable blobs to prevent unauthorized modification of customer data.

An exam question might ask: 'A company needs to ensure that customers cannot deny having placed orders on an e-commerce site. Which security goal is primarily addressed by implementing digital signatures on order confirmations?' In that context, non-repudiation would be the correct answer.

Candidates may confuse high-availability architectures with security measures, mistakenly thinking that ensuring continuous access also protects data secrecy.

Candidates may confuse high availability with data protection, thinking that replicating data across regions also ensures its integrity, but integrity is about preventing unauthorized changes, not uptime.

Candidates may confuse non-repudiation with high availability or disaster recovery, thinking that ensuring service continuity also prevents denial of actions, but non-repudiation is about accountability and proof, not uptime.

Communication Compliance is designed to detect and manage inappropriate communications (e.g., harassment, insider trading), not to automatically block outgoing emails containing PII with user override capabilities.

Records Management focuses on managing retention, disposition, and classification of records, not on preventing data leakage via email. It does not provide the ability to block outgoing emails containing PII or allow user overrides.

Audit in Microsoft Purview is used for logging and reviewing user and admin activities, not for creating policies that block or allow emails based on content like PII.

A company needs to monitor employee communications for policy violations (e.g., offensive language or sharing confidential information) and allow managers to review and take action. The question would specify detecting and remediating communication risks rather than blocking data exfiltration.

A company needs to automatically apply retention labels to emails containing specific keywords and ensure they are retained for a regulatory period. Records Management would be the correct solution for defining retention policies and labels.

An organization needs to investigate a specific data breach by reviewing detailed logs of who accessed sensitive files and when. Audit would be the correct solution to enable and search the audit log for relevant events.

Candidates may confuse Communication Compliance with DLP because both deal with email content and compliance, but Communication Compliance focuses on human behavior monitoring rather than automated data protection.

Candidates may confuse Records Management with data governance or mistakenly think it includes data loss prevention capabilities, especially since both involve policies and sensitive data classification.

Candidates may confuse Audit with monitoring or compliance solutions, thinking that auditing can enforce policies, but it only provides visibility after the fact, not real-time control.

Data Lifecycle Management (DLM) manages retention and deletion of data but does not enforce immutability or prevent users from editing/deleting records during the retention period. The question requires that contracts cannot be edited or deleted, which is a records management feature.

A company needs to automatically delete old customer data after 5 years to comply with a data privacy law, but users can edit the data during the retention period. DLM would be the correct solution to set retention and deletion policies without requiring record-level restrictions.

Candidates may confuse DLM with Records Management because both handle retention and deletion, but DLM lacks the immutability and legal hold capabilities required for records that must be preserved unaltered.

Data Lifecycle Management focuses on governing data retention and deletion policies, not on detecting insider threats or risky user behavior using machine learning.

Compliance Manager is a risk assessment tool that helps organizations evaluate their compliance posture against regulations, not a solution for detecting insider threats via machine learning on user activities.

A question asking which solution to automatically retain or delete data based on regulatory requirements, such as implementing a policy to delete customer records after 7 years, would make Data Lifecycle Management the correct answer.

An organization needs to assess and improve its compliance posture against industry standards like GDPR or ISO 27001, and requires a dashboard to track remediation actions and control effectiveness.

Candidates may confuse data governance with security monitoring, assuming that managing data lifecycles includes preventing data theft, but the two are distinct functions.

Candidates may confuse 'compliance' in the name with the compliance team's need, or think Compliance Manager covers all compliance-related detection scenarios.

Hybrid Microsoft Entra ID Joined requires devices to be domain-joined and managed by on-premises AD with synchronization to Entra ID, which contradicts the requirement to avoid full management or domain-joining of personal smartphones.

Active Directory Joined requires devices to be domain-joined to an on-premises Active Directory, which involves full management and does not support personal smartphones that are not domain-joined. The question specifies that devices should not be fully managed or domain-joined.

A company with on-premises Active Directory wants devices that are both domain-joined and registered in Entra ID for SSO and conditional access, while still being managed via Group Policy. The question would specify that devices are corporate-owned and need hybrid management.

A company has on-premises Windows computers that need to authenticate against on-premises Active Directory for access to network resources, and there is no requirement for cloud-based identity or device management.

Candidates may think 'Hybrid' implies a middle ground between registered and joined, or they may confuse it with the ability to support personal devices, not realizing it still requires domain join and full management.

Candidates may confuse Active Directory Joined with Microsoft Entra ID Joined, thinking that any device identity option that links a user account to a device must involve traditional domain joining, especially if they are more familiar with on-premises AD than cloud identity solutions.

Microsoft Defender for Endpoint focuses on endpoint devices (workstations, servers) and does not monitor domain controller traffic or detect Active Directory-specific attacks like Golden Ticket or skeleton key.

Microsoft Defender for Cloud is designed for protecting cloud workloads (IaaS, PaaS, and hybrid) and does not monitor on-premises Active Directory traffic or detect Kerberos attacks like Golden Ticket or pass-the-hash.

Microsoft Sentinel is a SIEM/SOAR platform that ingests logs and alerts but does not natively monitor domain controller traffic or detect Active Directory attacks like Golden Ticket or skeleton key. It relies on other solutions (e.g., Defender for Identity) for such detections.

A company needs to detect and respond to advanced malware and fileless attacks on endpoints, such as ransomware or exploit kits, and requires integration with Microsoft Sentinel for incident response.

A company wants to assess the security posture of their Azure and hybrid cloud resources, detect misconfigurations, and protect against cloud-specific threats like compromised storage accounts or vulnerable VMs. They need a Cloud Security Posture Management (CSPM) and Cloud Workload Protection Platform (CWPP).

A company needs a cloud-native SIEM to centralize security logs from multiple sources (e.g., firewalls, servers, cloud apps) and automate incident response. The question would specify that the goal is log aggregation and orchestration, not direct AD attack detection.

Candidates may confuse endpoint protection with identity protection, assuming that 'Defender for Endpoint' covers all security scenarios including Active Directory attacks.

Candidates may confuse 'Defender for Cloud' with identity protection because the name includes 'Defender' and they think it covers all security, not realizing it focuses on cloud infrastructure rather than on-premises Active Directory.

Candidates may confuse Sentinel as the solution because it integrates with many security tools and can ingest identity-related alerts, but they overlook that it does not perform the actual monitoring of domain controller traffic or entity behavior analysis itself.

Defense in depth is a layered security approach using multiple controls, but it does not inherently assume no entity is trustworthy or require continuous verification; it focuses on redundancy, not the zero-trust principle of 'never trust, always verify.'

The question describes a model where no entity is trusted by default and continuous verification is required, which is the definition of Zero Trust. Least privilege is a principle of granting only necessary permissions, not a model for continuous verification and encryption of all access requests.

The shared responsibility model describes the division of security tasks between a cloud provider and customer, not the principle of never trusting any entity by default and requiring continuous verification.

Defense in depth would be correct for a question describing a security strategy that implements multiple layers of defense (e.g., firewalls, antivirus, intrusion detection) to protect against a single point of failure, without emphasizing continuous verification or distrust of all entities.

A question that asks: 'A company wants to ensure users have only the minimum permissions needed to perform their job functions. Which security principle should they apply?' In that context, least privilege would be the correct answer.

In a question like 'Which model outlines that the cloud provider is responsible for security of the cloud, while the customer is responsible for security in the cloud?', shared responsibility would be the correct answer.

Candidates may confuse defense in depth with zero trust because both involve multiple security controls, but defense in depth lacks the core zero-trust requirement of continuous verification and implicit distrust of all access requests.

Candidates may confuse least privilege with Zero Trust because both involve limiting access, but they fail to recognize that Zero Trust is a broader security model encompassing continuous verification, while least privilege is a specific access control principle.

Candidates may confuse the broad security concept of Zero Trust with the operational division of duties in cloud environments, especially when the question mentions 'security model' without specifying cloud context.

In Azure App Service, configuring network firewall rules is a customer responsibility, not Microsoft's. The shared responsibility model assigns platform-level security (like OS patching) to Microsoft, but network configuration for the app is managed by the customer.

In Azure App Service, managing user authentication and authorization is a customer responsibility, not Microsoft's. The shared responsibility model assigns application-level access control to the customer.

In the shared responsibility model for Azure App Service, Microsoft is responsible for the physical infrastructure and platform, but encryption of application data at rest is typically the customer's responsibility because they control the data and can enable encryption features like Azure Storage Service Encryption.

This option would be correct in a question about Azure infrastructure services (IaaS), such as a virtual machine, where Microsoft manages the physical host and network, but the customer configures firewall rules for the VM. For example: 'Which of the following is a customer responsibility when using an Azure VM?'

This option would be correct in a question about Azure Active Directory (Azure AD) as an identity provider, where Microsoft manages the authentication service itself, including user authentication and authorization for cloud resources.

This option would be correct in a question about Azure SQL Database or Azure Storage, where Microsoft manages encryption at rest by default (e.g., transparent data encryption). For example: 'Which responsibility does Microsoft retain for Azure SQL Database?'

Candidates may confuse the shared responsibility model for PaaS (App Service) with IaaS, assuming Microsoft handles all network security. They might also think that because Microsoft manages the platform, it also configures network firewalls for the app.

Candidates may confuse the platform's built-in authentication features (which are configurable by the customer) with Microsoft-managed responsibilities, assuming that because Azure offers authentication modules, Microsoft handles all aspects of it.

Candidates may assume that because Azure offers encryption features, Microsoft handles all encryption responsibilities, overlooking that customers must configure and manage encryption for their application data.

Data Loss Prevention (DLP) is designed to prevent accidental sharing or leakage of sensitive data, not to automate retention and deletion of records based on a fixed time period.

Information Protection focuses on classifying, labeling, and protecting sensitive data (e.g., encryption, rights management), not on automated retention and deletion schedules. The requirement to retain and then delete contracts after 10 years is a lifecycle management task, not a protection task.

A company wants to automatically detect and block emails containing credit card numbers from being sent to external recipients. DLP policies would be the correct solution to enforce this rule.

A company needs to automatically apply encryption and access restrictions to all customer contracts containing personally identifiable information (PII) to prevent unauthorized sharing. Information Protection with sensitivity labels would be the correct solution.

Candidates may confuse DLP with retention policies because both involve data governance, but DLP focuses on preventing data loss, not lifecycle management.

Candidates may confuse 'protecting' data with 'managing its lifecycle,' assuming that retention and deletion are part of protection. The term 'Information Protection' sounds broad enough to include retention policies, but in Microsoft Purview it specifically covers classification and protection controls.

Conditional Access enforces access policies based on signals like user location or device state, but it does not provide time-limited, approval-based activation of privileged roles or automatic revocation.

Identity Protection is designed to detect and respond to identity-based risks, such as compromised credentials or suspicious sign-ins, not to manage time-limited privileged role assignments with approval workflows.

Entitlement Management manages access packages and resource access requests, but it does not provide time-limited, automatically revoked privileged role assignments with manager approval; PIM handles just-in-time privileged role activation.

A company needs to require multi-factor authentication or block access from untrusted locations when administrators sign in to the Azure portal. Conditional Access would be the correct feature to enforce such policies.

A company wants to automatically detect and block sign-ins from anonymous IP addresses or enforce multi-factor authentication based on risk level. Which Microsoft Entra ID feature should be used?

A company needs to allow employees to request access to a set of applications and groups for a specific project, with approval from their manager and automatic expiration after 30 days. Entitlement Management would be the correct feature to create access packages for this scenario.

Candidates may confuse Conditional Access with access control for privileged roles, not realizing it governs sign-in conditions rather than role activation and approval workflows.

Candidates may confuse Identity Protection with Privileged Identity Management because both involve security and identity, but Identity Protection focuses on risk detection rather than role activation and approval workflows.

Candidates may confuse Entitlement Management's approval and expiration features with PIM's privileged role activation, not realizing that Entitlement Management is for general resource access, not privileged role management.

Conditional Access enforces access policies based on signals like user location or device state, but it does not provide just-in-time role activation with approval and automatic expiry.

Access Reviews are used to audit and confirm the ongoing need for group memberships or role assignments, not to grant temporary, approval-based activation of privileged roles with automatic expiration.

An organization needs to require multi-factor authentication for all users accessing a sensitive application from outside the corporate network. Conditional Access would be the correct feature to configure such a policy.

An organization needs to periodically verify that all users with Global Administrator access still require that role, and remove those who no longer need it. Access Reviews would be the correct feature to configure.

Candidates may confuse Conditional Access with access control for privileged roles, not realizing it governs user access to resources rather than role activation workflows.

Candidates may confuse Access Reviews with PIM because both involve privileged roles and oversight, but Access Reviews focus on periodic attestation rather than just-in-time activation with approval.