SC-100 Certification Practice Question #265

Question

You are designing a ransomware response plan that follows Microsoft Security Best Practices.

You need to recommend a solution to limit the scope of damage of ransomware attacks without being locked out.

What should you include in the recommendation?

Accepted Answer

The decisive phrase is "without being locked out." Microsoft Security Best Practices and the Microsoft cloud security benchmark (PA-5) recommend emergency/break-glass access accounts specifically so an organization is "not accidentally locked out" of its identity infrastructure during a crisis such as a ransomware incident — these are cloud-only, Global Administrator, Conditional Access/MFA-excluded accounts reserved for break-glass use. This requirement is what distinguishes D from the well-argued B (PAWs) dissent: PAWs limit the scope of privileged compromise but provide no guaranteed recovery path if all normal admin accounts are locked. Suggested Answer, the top community vote, and MS Learn all converge on D; confidence is held at 85 rather than higher because the B dissent is substantial (multiple 4-👍 comments) and reasonable on the "limit the scope of damage" half of the prompt.

More SC-100 practice questions