Microsoft SC-300 Bundle

When the team suspects a managed identity cannot reach Key Vault despite an approved role, Check resource networking and Key Vault access model as well as RBAC is justified because access can fail due to private connectivity or an incorrect policy model even with a valid token; here the issue is an application must authenticate to Entra from an external on-premises service that cannot use managed identity, and Use an appropriate application registration with secure credential or federation support addresses that distinction.

The distinct mechanism for Inspect service principal type and associated Azure resource metadata is that both are directory principals but managed identities have resource-managed lifecycle semantics; this handles security wants to know whether a service principal is application-created or managed-identity-backed rather than an application must authenticate to Entra from an external on-premises service that cannot use managed identity, so use Use an appropriate application registration with secure credential or federation support.

Although Distinguish workload principal identifiers from human user principal names fits an owner asks why a managed identity's application ID cannot be treated like a user UPN (workload applications and human directory users have different identity objects and sign-in flows), it is not the necessary control for an application must authenticate to Entra from an external on-premises service that cannot use managed identity. Select Use an appropriate application registration with secure credential or federation support.

Distinguish workload principal identifiers from human user principal names concerns an owner asks why a managed identity's application ID cannot be treated like a user UPN, where workload applications and human directory users have different identity objects and sign-in flows; the current scenario instead requires security wants to know whether a service principal is application-created or managed-identity-backed, so Inspect service principal type and associated Azure resource metadata is a closer fit.

The distinct mechanism for Reduce the app and resource grants to only the required operations is that application identities can be overprivileged even when their credentials are temporary or federated; this handles security finds that the application's service principal has unrelated directory-wide permissions rather than security wants to know whether a service principal is application-created or managed-identity-backed, so use Inspect service principal type and associated Azure resource metadata.

Prefer a managed identity for its cloud token issuance where capabilities match would support the different situation where the application runs exclusively on Azure-hosted compute supporting managed identities: managed identities reduce manual secret lifecycle and credentials exposure for Azure workloads; however it does not resolve security wants to know whether a service principal is application-created or managed-identity-backed, which calls for Inspect service principal type and associated Azure resource metadata.

The distinct mechanism for Use an appropriate application registration with secure credential or federation support is that an off-Azure workload needs an supported noninteractive authentication mechanism independent of Azure resource identity; this handles an application must authenticate to Entra from an external on-premises service that cannot use managed identity rather than an owner asks why a managed identity's application ID cannot be treated like a user UPN, so use Distinguish workload principal identifiers from human user principal names.

Although Assign the specific storage data RBAC role to its managed identity at the needed scope fits the research app must access Blob data without giving it subscription Owner (storage data access roles can be limited independently of broad Azure subscription management rights), it is not the necessary control for an owner asks why a managed identity's application ID cannot be treated like a user UPN. Select Distinguish workload principal identifiers from human user principal names.

Managed identities reduce manual secret lifecycle and credentials exposure for Azure workloads, which makes Prefer a managed identity for its cloud token issuance where capabilities match appropriate when the application runs exclusively on Azure-hosted compute supporting managed identities; here the task is an owner asks why a managed identity's application ID cannot be treated like a user UPN, requiring Distinguish workload principal identifiers from human user principal names.

Although Audit and clean up the independent identity and permissions after resource decommission fits a deleted VM leaves an old user-assigned identity and role assignments in the subscription (user-assigned identities are not automatically deleted with each attached compute resource), it is not the necessary control for the production VM should access only production storage containers. Select Assign its managed identity a production-scoped storage data role without broad subscription grants.

Attach an approved user-assigned managed identity to the supported container resources would support the different situation where containers should use a single explicitly managed workload identity through resource replacement: user-assigned identities survive application revision and resource changes when managed separately; however it does not resolve the production VM should access only production storage containers, which calls for Assign its managed identity a production-scoped storage data role without broad subscription grants.

When an operator mistakes the service principal's ability to request a token for authority to read private files, Verify the token audience and target storage data-plane role assignment is justified because valid workload authentication is necessary but insufficient for the requested resource data action; here the issue is the production VM should access only production storage containers, and Assign its managed identity a production-scoped storage data role without broad subscription grants addresses that distinction.

Verify the token audience and target storage data-plane role assignment would support the different situation where an operator mistakes the service principal's ability to request a token for authority to read private files: valid workload authentication is necessary but insufficient for the requested resource data action; however it does not resolve nonproduction instances use the same user-assigned identity as production by accident, which calls for Split the identities and resource grants into separately managed production and test principals.

User-assigned identities survive application revision and resource changes when managed separately, which makes Attach an approved user-assigned managed identity to the supported container resources appropriate when containers should use a single explicitly managed workload identity through resource replacement; here the task is nonproduction instances use the same user-assigned identity as production by accident, requiring Split the identities and resource grants into separately managed production and test principals.

Assign its managed identity a production-scoped storage data role without broad subscription grants concerns the production VM should access only production storage containers, where resource-scoped authorization keeps the nonproduction storage boundary intact; the current scenario instead requires nonproduction instances use the same user-assigned identity as production by accident, so Split the identities and resource grants into separately managed production and test principals is a closer fit.

When the production VM should access only production storage containers, Assign its managed identity a production-scoped storage data role without broad subscription grants is justified because resource-scoped authorization keeps the nonproduction storage boundary intact; here the issue is a deleted VM leaves an old user-assigned identity and role assignments in the subscription, and Audit and clean up the independent identity and permissions after resource decommission addresses that distinction.

Split the identities and resource grants into separately managed production and test principals concerns nonproduction instances use the same user-assigned identity as production by accident, where sharing a principal can accidentally bridge authorization across environment boundaries; the current scenario instead requires a deleted VM leaves an old user-assigned identity and role assignments in the subscription, so Audit and clean up the independent identity and permissions after resource decommission is a closer fit.

The distinct mechanism for Choose a system-assigned managed identity on the VM is that a system-assigned identity is bound to its parent resource and has no independent reattachment lifecycle; this handles a VM's workload identity must disappear when that VM is permanently deleted rather than a deleted VM leaves an old user-assigned identity and role assignments in the subscription, so use Audit and clean up the independent identity and permissions after resource decommission.

When the pipeline has a valid Entra token but lacks deployment permission, Assign the minimum Azure RBAC role to the workload principal at the target scope is justified because token authentication does not grant resource-provider actions absent the corresponding RBAC role; here the issue is an operator mistakes the service principal's ability to request a token for authority to read private files, and Verify the token audience and target storage data-plane role assignment addresses that distinction.

The distinct mechanism for Split the identities and resource grants into separately managed production and test principals is that sharing a principal can accidentally bridge authorization across environment boundaries; this handles nonproduction instances use the same user-assigned identity as production by accident rather than an operator mistakes the service principal's ability to request a token for authority to read private files, so use Verify the token audience and target storage data-plane role assignment.

Although Audit and clean up the independent identity and permissions after resource decommission fits a deleted VM leaves an old user-assigned identity and role assignments in the subscription (user-assigned identities are not automatically deleted with each attached compute resource), it is not the necessary control for an operator mistakes the service principal's ability to request a token for authority to read private files. Select Verify the token audience and target storage data-plane role assignment.

Disable or remove affected assignments and revoke resource permissions under the incident procedure concerns the legal team requires disabling a compromised managed identity immediately, where workload containment should remove the ability to acquire or use rights rather than only change a display name; the current scenario instead requires investigators require a stable identity for a multi-resource automation that is moved across approved compute pools, so Provision an independently governed user-assigned managed identity for supported resources is a closer fit.

The distinct mechanism for Check resource networking and Key Vault access model as well as RBAC is that access can fail due to private connectivity or an incorrect policy model even with a valid token; this handles the team suspects a managed identity cannot reach Key Vault despite an approved role rather than investigators require a stable identity for a multi-resource automation that is moved across approved compute pools, so use Provision an independently governed user-assigned managed identity for supported resources.

Although Revoke the exposed credential and migrate to a managed or federated identity where feasible fits a code review finds a production service principal secret checked into source control (rotating or eliminating the leaked secret limits reuse and removes the persistent credential from source), it is not the necessary control for investigators require a stable identity for a multi-resource automation that is moved across approved compute pools. Select Provision an independently governed user-assigned managed identity for supported resources.

The distinct mechanism for Inspect the target API's access control and the token's intended audience is that an Entra identity token can be valid while the resource independently denies an ungranted action; this handles an application unexpectedly receives a 403 after obtaining an identity token rather than the legal team requires disabling a compromised managed identity immediately, so use Disable or remove affected assignments and revoke resource permissions under the incident procedure.

Although Provision an independently governed user-assigned managed identity for supported resources fits investigators require a stable identity for a multi-resource automation that is moved across approved compute pools (a separate identity can be attached to successive eligible compute resources under the same access controls), it is not the necessary control for the legal team requires disabling a compromised managed identity immediately. Select Disable or remove affected assignments and revoke resource permissions under the incident procedure.

Access can fail due to private connectivity or an incorrect policy model even with a valid token, which makes Check resource networking and Key Vault access model as well as RBAC appropriate when the team suspects a managed identity cannot reach Key Vault despite an approved role; here the task is the legal team requires disabling a compromised managed identity immediately, requiring Disable or remove affected assignments and revoke resource permissions under the incident procedure.

Prefer a managed identity for its cloud token issuance where capabilities match would support the different situation where the application runs exclusively on Azure-hosted compute supporting managed identities: managed identities reduce manual secret lifecycle and credentials exposure for Azure workloads; however it does not resolve an application unexpectedly receives a 403 after obtaining an identity token, which calls for Inspect the target API's access control and the token's intended audience.

Rotating or eliminating the leaked secret limits reuse and removes the persistent credential from source, which makes Revoke the exposed credential and migrate to a managed or federated identity where feasible appropriate when a code review finds a production service principal secret checked into source control; here the task is an application unexpectedly receives a 403 after obtaining an identity token, requiring Inspect the target API's access control and the token's intended audience.

When the legal team requires disabling a compromised managed identity immediately, Disable or remove affected assignments and revoke resource permissions under the incident procedure is justified because workload containment should remove the ability to acquire or use rights rather than only change a display name; here the issue is an application unexpectedly receives a 403 after obtaining an identity token, and Inspect the target API's access control and the token's intended audience addresses that distinction.

Application identities can be overprivileged even when their credentials are temporary or federated, which makes Reduce the app and resource grants to only the required operations appropriate when security finds that the application's service principal has unrelated directory-wide permissions; here the task is a code review finds a production service principal secret checked into source control, requiring Revoke the exposed credential and migrate to a managed or federated identity where feasible.

When an application unexpectedly receives a 403 after obtaining an identity token, Inspect the target API's access control and the token's intended audience is justified because an Entra identity token can be valid while the resource independently denies an ungranted action; here the issue is a code review finds a production service principal secret checked into source control, and Revoke the exposed credential and migrate to a managed or federated identity where feasible addresses that distinction.

Provision an independently governed user-assigned managed identity for supported resources concerns investigators require a stable identity for a multi-resource automation that is moved across approved compute pools, where a separate identity can be attached to successive eligible compute resources under the same access controls; the current scenario instead requires a code review finds a production service principal secret checked into source control, so Revoke the exposed credential and migrate to a managed or federated identity where feasible is a closer fit.