Microsoft SC-300 Bundle

Noninteractive jobs need application credentials or managed token issuance rather than a person's session, which makes Use a service principal or supported managed identity for the workload appropriate when a headless nightly job should not require human interactive MFA to authenticate; here the task is the job runs on supported Azure compute and currently has a secret in its configuration, requiring Replace the shared secret with an assigned managed identity and target access permissions.

When the application runs exclusively on Azure-hosted compute supporting managed identities, Prefer a managed identity for its cloud token issuance where capabilities match is justified because managed identities reduce manual secret lifecycle and credentials exposure for Azure workloads; here the issue is the job runs on supported Azure compute and currently has a secret in its configuration, and Replace the shared secret with an assigned managed identity and target access permissions addresses that distinction.

Reduce the app and resource grants to only the required operations concerns security finds that the application's service principal has unrelated directory-wide permissions, where application identities can be overprivileged even when their credentials are temporary or federated; the current scenario instead requires the job runs on supported Azure compute and currently has a secret in its configuration, so Replace the shared secret with an assigned managed identity and target access permissions is a closer fit.

Noninteractive jobs need application credentials or managed token issuance rather than a person's session, which makes Use a service principal or supported managed identity for the workload appropriate when a headless nightly job should not require human interactive MFA to authenticate; here the task is the job runs off Azure in a supported workload identity federation platform, requiring Configure federated identity credentials with a constrained external workload issuer and subject.

Replace the shared secret with an assigned managed identity and target access permissions concerns the job runs on supported Azure compute and currently has a secret in its configuration, where managed identity removes the secret distribution burden for supported Azure-hosted workloads; the current scenario instead requires the job runs off Azure in a supported workload identity federation platform, so Configure federated identity credentials with a constrained external workload issuer and subject is a closer fit.

The distinct mechanism for Prefer a managed identity for its cloud token issuance where capabilities match is that managed identities reduce manual secret lifecycle and credentials exposure for Azure workloads; this handles the application runs exclusively on Azure-hosted compute supporting managed identities rather than the job runs off Azure in a supported workload identity federation platform, so use Configure federated identity credentials with a constrained external workload issuer and subject.

When an engineer proposes granting the CI application Global Administrator to update an Azure resource group, Use resource-scoped Azure permissions rather than a tenant directory superuser role is justified because azure resource RBAC and Microsoft Entra directory roles secure different authorization surfaces; here the issue is security finds that the application's service principal has unrelated directory-wide permissions, and Reduce the app and resource grants to only the required operations addresses that distinction.

Replace the shared secret with an assigned managed identity and target access permissions concerns the job runs on supported Azure compute and currently has a secret in its configuration, where managed identity removes the secret distribution burden for supported Azure-hosted workloads; the current scenario instead requires security finds that the application's service principal has unrelated directory-wide permissions, so Reduce the app and resource grants to only the required operations is a closer fit.

The distinct mechanism for Configure federated identity credentials with a constrained external workload issuer and subject is that workload identity federation exchanges verified external tokens without requiring a permanent client secret; this handles the job runs off Azure in a supported workload identity federation platform rather than security finds that the application's service principal has unrelated directory-wide permissions, so use Reduce the app and resource grants to only the required operations.

Reapply required permissions to the newly created principal object concerns a system-assigned identity was recreated after its host resource was rebuilt, where recreating the parent resource creates a new system-assigned service principal rather than preserving the old ID; the current scenario instead requires the research app must access Blob data without giving it subscription Owner, so Assign the specific storage data RBAC role to its managed identity at the needed scope is a closer fit.

The distinct mechanism for Use standard user authentication through Microsoft Entra rather than Azure workload managed identity is that managed identities represent workloads, not a replacement for a person's interactive authorization; this handles students ask to assign a managed identity directly to a browser-based user login flow rather than the research app must access Blob data without giving it subscription Owner, so use Assign the specific storage data RBAC role to its managed identity at the needed scope.

Grant the identity the necessary scoped storage data permission would support the different situation where a system-assigned identity is enabled but still cannot upload to Blob storage: enabling workload identity changes authentication, not the target storage account's authorization policy; however it does not resolve the research app must access Blob data without giving it subscription Owner, which calls for Assign the specific storage data RBAC role to its managed identity at the needed scope.

The distinct mechanism for Assign the specific storage data RBAC role to its managed identity at the needed scope is that storage data access roles can be limited independently of broad Azure subscription management rights; this handles the research app must access Blob data without giving it subscription Owner rather than a system-assigned identity was recreated after its host resource was rebuilt, so use Reapply required permissions to the newly created principal object.

Although Split the identities and resource grants into separately managed production and test principals fits nonproduction instances use the same user-assigned identity as production by accident (sharing a principal can accidentally bridge authorization across environment boundaries), it is not the necessary control for a system-assigned identity was recreated after its host resource was rebuilt. Select Reapply required permissions to the newly created principal object.

User-assigned identities are not automatically deleted with each attached compute resource, which makes Audit and clean up the independent identity and permissions after resource decommission appropriate when a deleted VM leaves an old user-assigned identity and role assignments in the subscription; here the task is a system-assigned identity was recreated after its host resource was rebuilt, requiring Reapply required permissions to the newly created principal object.

Reapply required permissions to the newly created principal object would support the different situation where a system-assigned identity was recreated after its host resource was rebuilt: recreating the parent resource creates a new system-assigned service principal rather than preserving the old ID; however it does not resolve the same permission must survive replacement of three compute resources, which calls for Attach a user-assigned managed identity with its retained resource-scoped roles.

Managed identities represent workloads, not a replacement for a person's interactive authorization, which makes Use standard user authentication through Microsoft Entra rather than Azure workload managed identity appropriate when students ask to assign a managed identity directly to a browser-based user login flow; here the task is the same permission must survive replacement of three compute resources, requiring Attach a user-assigned managed identity with its retained resource-scoped roles.

When the web app needs to read one Key Vault secret but should not administer the vault, Grant the managed identity the least-privilege supported Key Vault data-plane permission is justified because identity creation does not confer permission to read secrets until an appropriate resource access grant exists; here the issue is the same permission must survive replacement of three compute resources, and Attach a user-assigned managed identity with its retained resource-scoped roles addresses that distinction.

Assign the specific storage data RBAC role to its managed identity at the needed scope would support the different situation where the research app must access Blob data without giving it subscription Owner: storage data access roles can be limited independently of broad Azure subscription management rights; however it does not resolve students ask to assign a managed identity directly to a browser-based user login flow, which calls for Use standard user authentication through Microsoft Entra rather than Azure workload managed identity.

Both are directory principals but managed identities have resource-managed lifecycle semantics, which makes Inspect service principal type and associated Azure resource metadata appropriate when security wants to know whether a service principal is application-created or managed-identity-backed; here the task is students ask to assign a managed identity directly to a browser-based user login flow, requiring Use standard user authentication through Microsoft Entra rather than Azure workload managed identity.

Check resource networking and Key Vault access model as well as RBAC concerns the team suspects a managed identity cannot reach Key Vault despite an approved role, where access can fail due to private connectivity or an incorrect policy model even with a valid token; the current scenario instead requires students ask to assign a managed identity directly to a browser-based user login flow, so Use standard user authentication through Microsoft Entra rather than Azure workload managed identity is a closer fit.

Federation can exchange an external identity token for Entra access without persistent secrets, which makes Configure a federated identity credential tied to the approved CI issuer and claim subject appropriate when a Git-based CI workflow should deploy to Azure without a stored service principal client secret; here the task is each Azure Function should request tokens without storing a secret in app settings, requiring Enable a supported managed identity and use the Azure credential flow.

When functions sharing a user-assigned identity should be limited to one Cosmos DB database operation, Grant the identity only the supported Cosmos DB data permissions needed by the job is justified because identity attachment and precise database data authorization must be configured separately; here the issue is each Azure Function should request tokens without storing a secret in app settings, and Enable a supported managed identity and use the Azure credential flow addresses that distinction.

Audit and revoke the obsolete resource-role assignments for that principal concerns an identity was removed from a Function but retained permissions on a downstream resource, where removing a compute association does not automatically clean up every independent authorization grant; the current scenario instead requires each Azure Function should request tokens without storing a secret in app settings, so Enable a supported managed identity and use the Azure credential flow is a closer fit.

When the team suspects a managed identity cannot reach Key Vault despite an approved role, Check resource networking and Key Vault access model as well as RBAC is justified because access can fail due to private connectivity or an incorrect policy model even with a valid token; here the issue is functions sharing a user-assigned identity should be limited to one Cosmos DB database operation, and Grant the identity only the supported Cosmos DB data permissions needed by the job addresses that distinction.

Use a user-assigned managed identity attached to the appropriate VMs concerns two VMs should share a consistent identity across a blue-green deployment, where a user-assigned identity can survive resource replacement and be reused deliberately; the current scenario instead requires functions sharing a user-assigned identity should be limited to one Cosmos DB database operation, so Grant the identity only the supported Cosmos DB data permissions needed by the job is a closer fit.

Although Audit and revoke the obsolete resource-role assignments for that principal fits an identity was removed from a Function but retained permissions on a downstream resource (removing a compute association does not automatically clean up every independent authorization grant), it is not the necessary control for functions sharing a user-assigned identity should be limited to one Cosmos DB database operation. Select Grant the identity only the supported Cosmos DB data permissions needed by the job.

The distinct mechanism for Enable a supported managed identity and use the Azure credential flow is that supported Azure services can obtain identity tokens from their managed environment instead of embedded keys; this handles each Azure Function should request tokens without storing a secret in app settings rather than an identity was removed from a Function but retained permissions on a downstream resource, so use Audit and revoke the obsolete resource-role assignments for that principal.

Although Check resource networking and Key Vault access model as well as RBAC fits the team suspects a managed identity cannot reach Key Vault despite an approved role (access can fail due to private connectivity or an incorrect policy model even with a valid token), it is not the necessary control for an identity was removed from a Function but retained permissions on a downstream resource. Select Audit and revoke the obsolete resource-role assignments for that principal.

Disable or remove affected assignments and revoke resource permissions under the incident procedure would support the different situation where the legal team requires disabling a compromised managed identity immediately: workload containment should remove the ability to acquire or use rights rather than only change a display name; however it does not resolve an identity was removed from a Function but retained permissions on a downstream resource, which calls for Audit and revoke the obsolete resource-role assignments for that principal.

The distinct mechanism for Grant the identity only the supported Cosmos DB data permissions needed by the job is that identity attachment and precise database data authorization must be configured separately; this handles functions sharing a user-assigned identity should be limited to one Cosmos DB database operation rather than the team suspects a managed identity cannot reach Key Vault despite an approved role, so use Check resource networking and Key Vault access model as well as RBAC.

Although Enable a supported managed identity and use the Azure credential flow fits each Azure Function should request tokens without storing a secret in app settings (supported Azure services can obtain identity tokens from their managed environment instead of embedded keys), it is not the necessary control for the team suspects a managed identity cannot reach Key Vault despite an approved role. Select Check resource networking and Key Vault access model as well as RBAC.

Workload containment should remove the ability to acquire or use rights rather than only change a display name, which makes Disable or remove affected assignments and revoke resource permissions under the incident procedure appropriate when the legal team requires disabling a compromised managed identity immediately; here the task is the team suspects a managed identity cannot reach Key Vault despite an approved role, requiring Check resource networking and Key Vault access model as well as RBAC.