Microsoft SC-300 Bundle

The distinct mechanism for Grant the identity only the supported Cosmos DB data permissions needed by the job is that identity attachment and precise database data authorization must be configured separately; this handles functions sharing a user-assigned identity should be limited to one Cosmos DB database operation rather than the team suspects a managed identity cannot reach Key Vault despite an approved role, so use Check resource networking and Key Vault access model as well as RBAC.

Although Enable a supported managed identity and use the Azure credential flow fits each Azure Function should request tokens without storing a secret in app settings (supported Azure services can obtain identity tokens from their managed environment instead of embedded keys), it is not the necessary control for the team suspects a managed identity cannot reach Key Vault despite an approved role. Select Check resource networking and Key Vault access model as well as RBAC.

Workload containment should remove the ability to acquire or use rights rather than only change a display name, which makes Disable or remove affected assignments and revoke resource permissions under the incident procedure appropriate when the legal team requires disabling a compromised managed identity immediately; here the task is the team suspects a managed identity cannot reach Key Vault despite an approved role, requiring Check resource networking and Key Vault access model as well as RBAC.

Although Use resource-scoped Azure permissions rather than a tenant directory superuser role fits an engineer proposes granting the CI application Global Administrator to update an Azure resource group (azure resource RBAC and Microsoft Entra directory roles secure different authorization surfaces), it is not the necessary control for a Git-based CI workflow should deploy to Azure without a stored service principal client secret. Select Configure a federated identity credential tied to the approved CI issuer and claim subject.

Enable a supported managed identity and use the Azure credential flow would support the different situation where each Azure Function should request tokens without storing a secret in app settings: supported Azure services can obtain identity tokens from their managed environment instead of embedded keys; however it does not resolve a Git-based CI workflow should deploy to Azure without a stored service principal client secret, which calls for Configure a federated identity credential tied to the approved CI issuer and claim subject.

Token authentication does not grant resource-provider actions absent the corresponding RBAC role, which makes Assign the minimum Azure RBAC role to the workload principal at the target scope appropriate when the pipeline has a valid Entra token but lacks deployment permission; here the task is a Git-based CI workflow should deploy to Azure without a stored service principal client secret, requiring Configure a federated identity credential tied to the approved CI issuer and claim subject.

Use resource-scoped Azure permissions rather than a tenant directory superuser role would support the different situation where an engineer proposes granting the CI application Global Administrator to update an Azure resource group: azure resource RBAC and Microsoft Entra directory roles secure different authorization surfaces; however it does not resolve the workload trust allows tokens from every repository in the organization, which calls for Narrow the federated credential's issuer, subject and audience to the intended workflow.

When an application must authenticate to Entra from an external on-premises service that cannot use managed identity, Use an appropriate application registration with secure credential or federation support is justified because an off-Azure workload needs an supported noninteractive authentication mechanism independent of Azure resource identity; here the issue is the workload trust allows tokens from every repository in the organization, and Narrow the federated credential's issuer, subject and audience to the intended workflow addresses that distinction.

Enable a supported managed identity and use the Azure credential flow concerns each Azure Function should request tokens without storing a secret in app settings, where supported Azure services can obtain identity tokens from their managed environment instead of embedded keys; the current scenario instead requires the workload trust allows tokens from every repository in the organization, so Narrow the federated credential's issuer, subject and audience to the intended workflow is a closer fit.

When a Git-based CI workflow should deploy to Azure without a stored service principal client secret, Configure a federated identity credential tied to the approved CI issuer and claim subject is justified because federation can exchange an external identity token for Entra access without persistent secrets; here the issue is the pipeline has a valid Entra token but lacks deployment permission, and Assign the minimum Azure RBAC role to the workload principal at the target scope addresses that distinction.

Inspect the target API's access control and the token's intended audience concerns an application unexpectedly receives a 403 after obtaining an identity token, where an Entra identity token can be valid while the resource independently denies an ungranted action; the current scenario instead requires the pipeline has a valid Entra token but lacks deployment permission, so Assign the minimum Azure RBAC role to the workload principal at the target scope is a closer fit.

The distinct mechanism for Grant the identity the necessary scoped storage data permission is that enabling workload identity changes authentication, not the target storage account's authorization policy; this handles a system-assigned identity is enabled but still cannot upload to Blob storage rather than the pipeline has a valid Entra token but lacks deployment permission, so use Assign the minimum Azure RBAC role to the workload principal at the target scope.

When the pipeline has a valid Entra token but lacks deployment permission, Assign the minimum Azure RBAC role to the workload principal at the target scope is justified because token authentication does not grant resource-provider actions absent the corresponding RBAC role; here the issue is an engineer proposes granting the CI application Global Administrator to update an Azure resource group, and Use resource-scoped Azure permissions rather than a tenant directory superuser role addresses that distinction.

The distinct mechanism for Narrow the federated credential's issuer, subject and audience to the intended workflow is that an overly broad federated subject can let unrelated jobs assume the same application identity; this handles the workload trust allows tokens from every repository in the organization rather than an engineer proposes granting the CI application Global Administrator to update an Azure resource group, so use Use resource-scoped Azure permissions rather than a tenant directory superuser role.

Although Inspect service principal type and associated Azure resource metadata fits security wants to know whether a service principal is application-created or managed-identity-backed (both are directory principals but managed identities have resource-managed lifecycle semantics), it is not the necessary control for an engineer proposes granting the CI application Global Administrator to update an Azure resource group. Select Use resource-scoped Azure permissions rather than a tenant directory superuser role.

Assign its managed identity a production-scoped storage data role without broad subscription grants concerns the production VM should access only production storage containers, where resource-scoped authorization keeps the nonproduction storage boundary intact; the current scenario instead requires containers should use a single explicitly managed workload identity through resource replacement, so Attach an approved user-assigned managed identity to the supported container resources is a closer fit.

The distinct mechanism for Verify all associations and downstream grants before deleting the independent identity is that shared managed identities may be attached to multiple resources and deletion can break several services; this handles operations wants to remove a no-longer-used user-assigned identity rather than containers should use a single explicitly managed workload identity through resource replacement, so use Attach an approved user-assigned managed identity to the supported container resources.

Replace the user session dependency with supported application workload authentication would support the different situation where a developer uses a person's refresh token to let the container call Azure APIs overnight: human refresh tokens are not suitable durable credentials for unattended service workloads; however it does not resolve containers should use a single explicitly managed workload identity through resource replacement, which calls for Attach an approved user-assigned managed identity to the supported container resources.

The distinct mechanism for Assign the minimum Azure RBAC role to the workload principal at the target scope is that token authentication does not grant resource-provider actions absent the corresponding RBAC role; this handles the pipeline has a valid Entra token but lacks deployment permission rather than a developer uses a person's refresh token to let the container call Azure APIs overnight, so use Replace the user session dependency with supported application workload authentication.

Although Use the assigned managed identity's token acquisition path instead of embedding credentials fits a developer proposes hardcoding a client secret despite an available managed identity (a managed identity obtains tokens without storing an independently rotated application secret in code), it is not the necessary control for a developer uses a person's refresh token to let the container call Azure APIs overnight. Select Replace the user session dependency with supported application workload authentication.

Enabling workload identity changes authentication, not the target storage account's authorization policy, which makes Grant the identity the necessary scoped storage data permission appropriate when a system-assigned identity is enabled but still cannot upload to Blob storage; here the task is a developer uses a person's refresh token to let the container call Azure APIs overnight, requiring Replace the user session dependency with supported application workload authentication.

Although Verify all associations and downstream grants before deleting the independent identity fits operations wants to remove a no-longer-used user-assigned identity (shared managed identities may be attached to multiple resources and deletion can break several services), it is not the necessary control for a system-assigned identity is enabled but still cannot upload to Blob storage. Select Grant the identity the necessary scoped storage data permission.

Assign the specific storage data RBAC role to its managed identity at the needed scope would support the different situation where the research app must access Blob data without giving it subscription Owner: storage data access roles can be limited independently of broad Azure subscription management rights; however it does not resolve a system-assigned identity is enabled but still cannot upload to Blob storage, which calls for Grant the identity the necessary scoped storage data permission.

Human refresh tokens are not suitable durable credentials for unattended service workloads, which makes Replace the user session dependency with supported application workload authentication appropriate when a developer uses a person's refresh token to let the container call Azure APIs overnight; here the task is a system-assigned identity is enabled but still cannot upload to Blob storage, requiring Grant the identity the necessary scoped storage data permission.

Grant the identity the necessary scoped storage data permission would support the different situation where a system-assigned identity is enabled but still cannot upload to Blob storage: enabling workload identity changes authentication, not the target storage account's authorization policy; however it does not resolve operations wants to remove a no-longer-used user-assigned identity, which calls for Verify all associations and downstream grants before deleting the independent identity.

When containers should use a single explicitly managed workload identity through resource replacement, Attach an approved user-assigned managed identity to the supported container resources is justified because user-assigned identities survive application revision and resource changes when managed separately; here the issue is operations wants to remove a no-longer-used user-assigned identity, and Verify all associations and downstream grants before deleting the independent identity addresses that distinction.

Correlate managed identity sign-in and resource activity telemetry with the principal ID concerns operations must find which Azure workload used a managed identity last night, where workload access is best traced by identity and resource records rather than VM display names; the current scenario instead requires operations wants to remove a no-longer-used user-assigned identity, so Verify all associations and downstream grants before deleting the independent identity is a closer fit.

Managed identity removes the secret distribution burden for supported Azure-hosted workloads, which makes Replace the shared secret with an assigned managed identity and target access permissions appropriate when the job runs on supported Azure compute and currently has a secret in its configuration; here the task is the application runs exclusively on Azure-hosted compute supporting managed identities, requiring Prefer a managed identity for its cloud token issuance where capabilities match.

Use an appropriate application registration with secure credential or federation support concerns an application must authenticate to Entra from an external on-premises service that cannot use managed identity, where an off-Azure workload needs an supported noninteractive authentication mechanism independent of Azure resource identity; the current scenario instead requires the application runs exclusively on Azure-hosted compute supporting managed identities, so Prefer a managed identity for its cloud token issuance where capabilities match is a closer fit.

The distinct mechanism for Inspect service principal type and associated Azure resource metadata is that both are directory principals but managed identities have resource-managed lifecycle semantics; this handles security wants to know whether a service principal is application-created or managed-identity-backed rather than the application runs exclusively on Azure-hosted compute supporting managed identities, so use Prefer a managed identity for its cloud token issuance where capabilities match.

When the team suspects a managed identity cannot reach Key Vault despite an approved role, Check resource networking and Key Vault access model as well as RBAC is justified because access can fail due to private connectivity or an incorrect policy model even with a valid token; here the issue is an application must authenticate to Entra from an external on-premises service that cannot use managed identity, and Use an appropriate application registration with secure credential or federation support addresses that distinction.

The distinct mechanism for Inspect service principal type and associated Azure resource metadata is that both are directory principals but managed identities have resource-managed lifecycle semantics; this handles security wants to know whether a service principal is application-created or managed-identity-backed rather than an application must authenticate to Entra from an external on-premises service that cannot use managed identity, so use Use an appropriate application registration with secure credential or federation support.

Although Distinguish workload principal identifiers from human user principal names fits an owner asks why a managed identity's application ID cannot be treated like a user UPN (workload applications and human directory users have different identity objects and sign-in flows), it is not the necessary control for an application must authenticate to Entra from an external on-premises service that cannot use managed identity. Select Use an appropriate application registration with secure credential or federation support.