Microsoft SC-300 Bundle

When only the enrollment application should be reachable through the new private access connection, Configure the specific Private Access application segment instead of exposing a broad address range is justified because narrow app segments reduce unnecessary access to unrelated internal resources; here the issue is the university needs to observe whether endpoint traffic reaches the correct security processing service, and Examine the Global Secure Access traffic log and forwarding status for sample connections addresses that distinction.

Check whether the appropriate Internet Access forwarding profile is enabled and assigned concerns a newly installed client is healthy but never forwards Internet traffic, where client installation alone does not make every traffic category eligible for Global Secure Access forwarding; the current scenario instead requires the university needs to observe whether endpoint traffic reaches the correct security processing service, so Examine the Global Secure Access traffic log and forwarding status for sample connections is a closer fit.

Although Inspect profile assignments and supported client diagnostic logs fits the service desk must determine why the endpoint client missed a required traffic profile (traffic acquisition depends on the assigned forwarding profile rather than simply having a user license), it is not the necessary control for the university needs to observe whether endpoint traffic reaches the correct security processing service. Select Examine the Global Secure Access traffic log and forwarding status for sample connections.

Audit and revoke the obsolete resource-role assignments for that principal concerns an identity was removed from a Function but retained permissions on a downstream resource, where removing a compute association does not automatically clean up every independent authorization grant; the current scenario instead requires each web app should receive its own identity automatically removed when the app is deleted, so Enable a system-assigned managed identity on the supported App Service is a closer fit.

The distinct mechanism for Audit and clean up the independent identity and permissions after resource decommission is that user-assigned identities are not automatically deleted with each attached compute resource; this handles a deleted VM leaves an old user-assigned identity and role assignments in the subscription rather than each web app should receive its own identity automatically removed when the app is deleted, so use Enable a system-assigned managed identity on the supported App Service.

Narrow the federated credential's issuer, subject and audience to the intended workflow would support the different situation where the workload trust allows tokens from every repository in the organization: an overly broad federated subject can let unrelated jobs assume the same application identity; however it does not resolve each web app should receive its own identity automatically removed when the app is deleted, which calls for Enable a system-assigned managed identity on the supported App Service.

Although Reduce the app and resource grants to only the required operations fits security finds that the application's service principal has unrelated directory-wide permissions (application identities can be overprivileged even when their credentials are temporary or federated), it is not the necessary control for several approved web apps should intentionally share one reusable workload principal. Select Create and attach a user-assigned managed identity to each eligible app.

Configure a federated identity credential tied to the approved CI issuer and claim subject would support the different situation where a Git-based CI workflow should deploy to Azure without a stored service principal client secret: federation can exchange an external identity token for Entra access without persistent secrets; however it does not resolve several approved web apps should intentionally share one reusable workload principal, which calls for Create and attach a user-assigned managed identity to each eligible app.

Identity creation does not confer permission to read secrets until an appropriate resource access grant exists, which makes Grant the managed identity the least-privilege supported Key Vault data-plane permission appropriate when the web app needs to read one Key Vault secret but should not administer the vault; here the task is several approved web apps should intentionally share one reusable workload principal, requiring Create and attach a user-assigned managed identity to each eligible app.

Use the assigned managed identity's token acquisition path instead of embedding credentials would support the different situation where a developer proposes hardcoding a client secret despite an available managed identity: a managed identity obtains tokens without storing an independently rotated application secret in code; however it does not resolve the web app needs to read one Key Vault secret but should not administer the vault, which calls for Grant the managed identity the least-privilege supported Key Vault data-plane permission.

Valid workload authentication is necessary but insufficient for the requested resource data action, which makes Verify the token audience and target storage data-plane role assignment appropriate when an operator mistakes the service principal's ability to request a token for authority to read private files; here the task is the web app needs to read one Key Vault secret but should not administer the vault, requiring Grant the managed identity the least-privilege supported Key Vault data-plane permission.

When several approved web apps should intentionally share one reusable workload principal, Create and attach a user-assigned managed identity to each eligible app is justified because user-assigned identities have independent lifecycles and can be reused across supported resources; here the issue is the web app needs to read one Key Vault secret but should not administer the vault, and Grant the managed identity the least-privilege supported Key Vault data-plane permission addresses that distinction.

Federation can exchange an external identity token for Entra access without persistent secrets, which makes Configure a federated identity credential tied to the approved CI issuer and claim subject appropriate when a Git-based CI workflow should deploy to Azure without a stored service principal client secret; here the task is a developer proposes hardcoding a client secret despite an available managed identity, requiring Use the assigned managed identity's token acquisition path instead of embedding credentials.

When the web app needs to read one Key Vault secret but should not administer the vault, Grant the managed identity the least-privilege supported Key Vault data-plane permission is justified because identity creation does not confer permission to read secrets until an appropriate resource access grant exists; here the issue is a developer proposes hardcoding a client secret despite an available managed identity, and Use the assigned managed identity's token acquisition path instead of embedding credentials addresses that distinction.

Revoke the exposed credential and migrate to a managed or federated identity where feasible concerns a code review finds a production service principal secret checked into source control, where rotating or eliminating the leaked secret limits reuse and removes the persistent credential from source; the current scenario instead requires a developer proposes hardcoding a client secret despite an available managed identity, so Use the assigned managed identity's token acquisition path instead of embedding credentials is a closer fit.

When a deleted VM leaves an old user-assigned identity and role assignments in the subscription, Audit and clean up the independent identity and permissions after resource decommission is justified because user-assigned identities are not automatically deleted with each attached compute resource; here the issue is a VM's workload identity must disappear when that VM is permanently deleted, and Choose a system-assigned managed identity on the VM addresses that distinction.

Configure a federated identity credential tied to the approved CI issuer and claim subject concerns a Git-based CI workflow should deploy to Azure without a stored service principal client secret, where federation can exchange an external identity token for Entra access without persistent secrets; the current scenario instead requires a VM's workload identity must disappear when that VM is permanently deleted, so Choose a system-assigned managed identity on the VM is a closer fit.

The distinct mechanism for Check the managed identity's target-resource RBAC and data-plane assignment is that successful token issuance proves identity authentication, not permission for the requested storage operation; this handles an automation job can get a token but storage rejects its operation rather than a VM's workload identity must disappear when that VM is permanently deleted, so use Choose a system-assigned managed identity on the VM.

Assign the minimum Azure RBAC role to the workload principal at the target scope concerns the pipeline has a valid Entra token but lacks deployment permission, where token authentication does not grant resource-provider actions absent the corresponding RBAC role; the current scenario instead requires two VMs should share a consistent identity across a blue-green deployment, so Use a user-assigned managed identity attached to the appropriate VMs is a closer fit.

The distinct mechanism for Check the managed identity's target-resource RBAC and data-plane assignment is that successful token issuance proves identity authentication, not permission for the requested storage operation; this handles an automation job can get a token but storage rejects its operation rather than two VMs should share a consistent identity across a blue-green deployment, so use Use a user-assigned managed identity attached to the appropriate VMs.

Although Use standard user authentication through Microsoft Entra rather than Azure workload managed identity fits students ask to assign a managed identity directly to a browser-based user login flow (managed identities represent workloads, not a replacement for a person's interactive authorization), it is not the necessary control for two VMs should share a consistent identity across a blue-green deployment. Select Use a user-assigned managed identity attached to the appropriate VMs.

The distinct mechanism for Assign the minimum Azure RBAC role to the workload principal at the target scope is that token authentication does not grant resource-provider actions absent the corresponding RBAC role; this handles the pipeline has a valid Entra token but lacks deployment permission rather than an automation job can get a token but storage rejects its operation, so use Check the managed identity's target-resource RBAC and data-plane assignment.

Although Choose a system-assigned managed identity on the VM fits a VM's workload identity must disappear when that VM is permanently deleted (a system-assigned identity is bound to its parent resource and has no independent reattachment lifecycle), it is not the necessary control for an automation job can get a token but storage rejects its operation. Select Check the managed identity's target-resource RBAC and data-plane assignment.

Inspect the target API's access control and the token's intended audience would support the different situation where an application unexpectedly receives a 403 after obtaining an identity token: an Entra identity token can be valid while the resource independently denies an ungranted action; however it does not resolve an automation job can get a token but storage rejects its operation, which calls for Check the managed identity's target-resource RBAC and data-plane assignment.

The distinct mechanism for Verify all associations and downstream grants before deleting the independent identity is that shared managed identities may be attached to multiple resources and deletion can break several services; this handles operations wants to remove a no-longer-used user-assigned identity rather than operations must find which Azure workload used a managed identity last night, so use Correlate managed identity sign-in and resource activity telemetry with the principal ID.

Although Use standard user authentication through Microsoft Entra rather than Azure workload managed identity fits students ask to assign a managed identity directly to a browser-based user login flow (managed identities represent workloads, not a replacement for a person's interactive authorization), it is not the necessary control for operations must find which Azure workload used a managed identity last night. Select Correlate managed identity sign-in and resource activity telemetry with the principal ID.

Choose a system-assigned managed identity on the VM would support the different situation where a VM's workload identity must disappear when that VM is permanently deleted: a system-assigned identity is bound to its parent resource and has no independent reattachment lifecycle; however it does not resolve operations must find which Azure workload used a managed identity last night, which calls for Correlate managed identity sign-in and resource activity telemetry with the principal ID.

Although Configure federated identity credentials with a constrained external workload issuer and subject fits the job runs off Azure in a supported workload identity federation platform (workload identity federation exchanges verified external tokens without requiring a permanent client secret), it is not the necessary control for a headless nightly job should not require human interactive MFA to authenticate. Select Use a service principal or supported managed identity for the workload.

Reduce the app and resource grants to only the required operations would support the different situation where security finds that the application's service principal has unrelated directory-wide permissions: application identities can be overprivileged even when their credentials are temporary or federated; however it does not resolve a headless nightly job should not require human interactive MFA to authenticate, which calls for Use a service principal or supported managed identity for the workload.

When an owner asks why a managed identity's application ID cannot be treated like a user UPN, Distinguish workload principal identifiers from human user principal names is justified because workload applications and human directory users have different identity objects and sign-in flows; here the issue is a headless nightly job should not require human interactive MFA to authenticate, and Use a service principal or supported managed identity for the workload addresses that distinction.

Noninteractive jobs need application credentials or managed token issuance rather than a person's session, which makes Use a service principal or supported managed identity for the workload appropriate when a headless nightly job should not require human interactive MFA to authenticate; here the task is the job runs on supported Azure compute and currently has a secret in its configuration, requiring Replace the shared secret with an assigned managed identity and target access permissions.

When the application runs exclusively on Azure-hosted compute supporting managed identities, Prefer a managed identity for its cloud token issuance where capabilities match is justified because managed identities reduce manual secret lifecycle and credentials exposure for Azure workloads; here the issue is the job runs on supported Azure compute and currently has a secret in its configuration, and Replace the shared secret with an assigned managed identity and target access permissions addresses that distinction.

Reduce the app and resource grants to only the required operations concerns security finds that the application's service principal has unrelated directory-wide permissions, where application identities can be overprivileged even when their credentials are temporary or federated; the current scenario instead requires the job runs on supported Azure compute and currently has a secret in its configuration, so Replace the shared secret with an assigned managed identity and target access permissions is a closer fit.