Microsoft SC-300 Bundle

Review the directory audit logs for the relevant app consent or role change would support the different situation where security needs to know which administrator modified an application permission grant: directory audit events record configuration changes and their initiators rather than authentication attempts; however it does not resolve identity logs must be searchable in a central Log Analytics workspace, which calls for Configure Microsoft Entra diagnostic settings to send selected log categories to that workspace.

Workbook visualizations can summarize repeated identity events when the underlying logs are available, which makes Use a supported Entra workbook or Log Analytics query over collected sign-in data appropriate when management requests a weekly workbook showing MFA challenges and sign-in failures by application; here the task is identity logs must be searchable in a central Log Analytics workspace, requiring Configure Microsoft Entra diagnostic settings to send selected log categories to that workspace.

When the SOC needs to investigate why a specific employee's interactive sign-in failed, Filter Microsoft Entra sign-in logs by user, application, time, and failure details is justified because sign-in events record authentication and Conditional Access outcomes that a directory audit log alone does not show; here the issue is identity logs must be searchable in a central Log Analytics workspace, and Configure Microsoft Entra diagnostic settings to send selected log categories to that workspace addresses that distinction.

Directory audit events record configuration changes and their initiators rather than authentication attempts, which makes Review the directory audit logs for the relevant app consent or role change appropriate when security needs to know which administrator modified an application permission grant; here the task is an analyst needs to retrieve recent failed sign-ins for a named app using a log query, requiring Query the SigninLogs table in Log Analytics with KQL filters for status, app and time.

Use a supported Entra workbook or Log Analytics query over collected sign-in data concerns management requests a weekly workbook showing MFA challenges and sign-in failures by application, where workbook visualizations can summarize repeated identity events when the underlying logs are available; the current scenario instead requires an analyst needs to retrieve recent failed sign-ins for a named app using a log query, so Query the SigninLogs table in Log Analytics with KQL filters for status, app and time is a closer fit.

The distinct mechanism for Configure Microsoft Entra diagnostic settings to send selected log categories to that workspace is that diagnostic settings export supported logs to Azure Monitor destinations for query and retention management; this handles identity logs must be searchable in a central Log Analytics workspace rather than an analyst needs to retrieve recent failed sign-ins for a named app using a log query, so use Query the SigninLogs table in Log Analytics with KQL filters for status, app and time.

Review connector credential status and failed provisioning execution details concerns the provisioning connector was updated and now returns an authorization error, where the target service's API credentials can break provisioning independently of employee sign-in; the current scenario instead requires a new staff user's account failed to provision into the target application, so Inspect Entra provisioning logs for the enterprise app and user identifier is a closer fit.

The distinct mechanism for Use a supported Entra workbook or Log Analytics query over collected sign-in data is that workbook visualizations can summarize repeated identity events when the underlying logs are available; this handles management requests a weekly workbook showing MFA challenges and sign-in failures by application rather than a new staff user's account failed to provision into the target application, so use Inspect Entra provisioning logs for the enterprise app and user identifier.

Although Export diagnostic logs to an authorized destination with appropriate retention settings fits logs disappear before the internal retention period required for investigations (native log availability may be limited; explicit retention design is needed for long-running audits), it is not the necessary control for a new staff user's account failed to provision into the target application. Select Inspect Entra provisioning logs for the enterprise app and user identifier.

Use KQL aggregation with distinct principal keys and relevant event filters concerns a report displays an incorrect total because it counts the same principal across multiple role events, where distinct principal counting is different from counting every audit operation; the current scenario instead requires a user can access Entra but is denied by the SaaS because no local account was created, so Correlate provisioning status with app assignment and target account state is a closer fit.

The distinct mechanism for Configure authorized diagnostic delivery to a storage account with retention governance is that an archival destination retains events for compliance without relying on interactive query retention; this handles the records must also be preserved in a lower-cost long-term archive rather than a user can access Entra but is denied by the SaaS because no local account was created, so use Correlate provisioning status with app assignment and target account state.

Although Inspect Entra provisioning logs for the enterprise app and user identifier fits a new staff user's account failed to provision into the target application (provisioning telemetry explains downstream create or update failures that interactive sign-in logs may not include), it is not the necessary control for a user can access Entra but is denied by the SaaS because no local account was created. Select Correlate provisioning status with app assignment and target account state.

The distinct mechanism for Correlate provisioning status with app assignment and target account state is that successful user authentication does not guarantee that the destination SaaS account exists; this handles a user can access Entra but is denied by the SaaS because no local account was created rather than the identity operations team needs trends in failed provisioning executions, so use Analyze provisioning log events and related application health reports over time.

Although Build a supported Azure Monitor query or alert over exported provisioning telemetry fits the security team wants alerting when provisioning errors exceed a threshold (automated monitoring can detect rising errors before users report widespread access failures), it is not the necessary control for the identity operations team needs trends in failed provisioning executions. Select Analyze provisioning log events and related application health reports over time.

Export diagnostic logs to an authorized destination with appropriate retention settings would support the different situation where logs disappear before the internal retention period required for investigations: native log availability may be limited; explicit retention design is needed for long-running audits; however it does not resolve the identity operations team needs trends in failed provisioning executions, which calls for Analyze provisioning log events and related application health reports over time.

Route relevant log categories into a Log Analytics workspace would support the different situation where a compliance team wants searchable KQL investigations rather than immutable archive-only files: log Analytics provides a queryable store for structured identity diagnostics; however it does not resolve logs disappear before the internal retention period required for investigations, which calls for Export diagnostic logs to an authorized destination with appropriate retention settings.

Portal retention cannot be relied on alone for long-term regulatory event preservation, which makes Verify that Entra diagnostic exports deliver the selected events to the protected retention destination appropriate when the company needs an independently retained copy of the outage logs for external audit; here the task is logs disappear before the internal retention period required for investigations, requiring Export diagnostic logs to an authorized destination with appropriate retention settings.

When a new staff user's account failed to provision into the target application, Inspect Entra provisioning logs for the enterprise app and user identifier is justified because provisioning telemetry explains downstream create or update failures that interactive sign-in logs may not include; here the issue is logs disappear before the internal retention period required for investigations, and Export diagnostic logs to an authorized destination with appropriate retention settings addresses that distinction.

Use the SigninLogs records and summarize failure counts by status or result field would support the different situation where an analyst needs to group sign-in failures by status code using KQL: aggregated query results expose recurring authentication failure patterns; however it does not resolve administrators need to know which CA policies blocked a specific sign-in, which calls for Inspect the sign-in log's Conditional Access policy evaluation details.

When management requests a weekly workbook showing MFA challenges and sign-in failures by application, Use a supported Entra workbook or Log Analytics query over collected sign-in data is justified because workbook visualizations can summarize repeated identity events when the underlying logs are available; here the issue is administrators need to know which CA policies blocked a specific sign-in, and Inspect the sign-in log's Conditional Access policy evaluation details addresses that distinction.

Query the collected sign-ins with guest filters and distinct principal counting in KQL concerns operations must count unique blocked guest identities during an outage, where counting unique affected users differs from the number of failed authentication attempts; the current scenario instead requires administrators need to know which CA policies blocked a specific sign-in, so Inspect the sign-in log's Conditional Access policy evaluation details is a closer fit.

When an analyst needs to group sign-in failures by status code using KQL, Use the SigninLogs records and summarize failure counts by status or result field is justified because aggregated query results expose recurring authentication failure patterns; here the issue is management requests a weekly workbook showing MFA challenges and sign-in failures by application, and Use a supported Entra workbook or Log Analytics query over collected sign-in data addresses that distinction.

Filter Microsoft Entra sign-in logs by user, application, time, and failure details concerns the SOC needs to investigate why a specific employee's interactive sign-in failed, where sign-in events record authentication and Conditional Access outcomes that a directory audit log alone does not show; the current scenario instead requires management requests a weekly workbook showing MFA challenges and sign-in failures by application, so Use a supported Entra workbook or Log Analytics query over collected sign-in data is a closer fit.

The distinct mechanism for Track applicable Identity Secure Score recommendations and completed actions over time is that secure Score helps prioritize identity posture changes rather than functioning as a sign-in log; this handles the identity team wants to measure whether policy updates improved its security baseline rather than management requests a weekly workbook showing MFA challenges and sign-in failures by application, so use Use a supported Entra workbook or Log Analytics query over collected sign-in data.

When the identity team wants to measure whether policy updates improved its security baseline, Track applicable Identity Secure Score recommendations and completed actions over time is justified because secure Score helps prioritize identity posture changes rather than functioning as a sign-in log; here the issue is an analyst needs to group sign-in failures by status code using KQL, and Use the SigninLogs records and summarize failure counts by status or result field addresses that distinction.

Inspect the sign-in log's Conditional Access policy evaluation details concerns administrators need to know which CA policies blocked a specific sign-in, where policy evaluation provides specific conditions and results rather than only a generic failure message; the current scenario instead requires an analyst needs to group sign-in failures by status code using KQL, so Use the SigninLogs records and summarize failure counts by status or result field is a closer fit.

The distinct mechanism for Correlate sign-in details with relevant directory audit operations for the same principal is that combining authentication and configuration events establishes sequence and context; this handles a privileged user signed in from an unfamiliar device before modifying settings rather than an analyst needs to group sign-in failures by status code using KQL, so use Use the SigninLogs records and summarize failure counts by status or result field.

Use a supported Entra workbook or Log Analytics query over collected sign-in data concerns management requests a weekly workbook showing MFA challenges and sign-in failures by application, where workbook visualizations can summarize repeated identity events when the underlying logs are available; the current scenario instead requires the identity team wants to measure whether policy updates improved its security baseline, so Track applicable Identity Secure Score recommendations and completed actions over time is a closer fit.

The distinct mechanism for Send selected diagnostic categories to an Azure Event Hubs destination is that event Hubs supports downstream log consumers when diagnostic forwarding is configured; this handles security operations wants near-real-time forwarding of supported Entra log streams to a central event processor rather than the identity team wants to measure whether policy updates improved its security baseline, so use Track applicable Identity Secure Score recommendations and completed actions over time.

Although Inspect the sign-in log's Conditional Access policy evaluation details fits administrators need to know which CA policies blocked a specific sign-in (policy evaluation provides specific conditions and results rather than only a generic failure message), it is not the necessary control for the identity team wants to measure whether policy updates improved its security baseline. Select Track applicable Identity Secure Score recommendations and completed actions over time.

The distinct mechanism for Review Entra audit records for cross-tenant access settings modifications is that cross-tenant configuration edits are auditable directory operations, not ordinary provisioning events; this handles an analyst wants to identify exactly when an organization-specific trust setting changed rather than directory audit records must be retained longer than the default tenant portal period, so use Export relevant Microsoft Entra logs to a protected storage destination.

Although Route relevant log categories into a Log Analytics workspace fits a compliance team wants searchable KQL investigations rather than immutable archive-only files (log Analytics provides a queryable store for structured identity diagnostics), it is not the necessary control for directory audit records must be retained longer than the default tenant portal period. Select Export relevant Microsoft Entra logs to a protected storage destination.

Monitoring authorization should be separate from rights to alter production identity controls, which makes Grant log delivery and read roles without unrelated directory administrative rights appropriate when a data owner wants to prevent the log collector from changing identity policies; here the task is directory audit records must be retained longer than the default tenant portal period, requiring Export relevant Microsoft Entra logs to a protected storage destination.