SC-100 Certification Practice Question #61

Question

You receive a security alert in Microsoft Defender for Cloud as shown in the exhibit. (Click the Exhibit tab.)

After remediating the threat, which policy definition should you assign to prevent the threat from reoccurring?

Accepted Answer

The alert (ARM_MicroBurst.AZStorageKeysREST) is a key-extraction attack — a script enumerating storage accounts and pulling their access keys. The correct preventive policy is the one that makes those keys unusable: "Storage accounts should prevent shared key access," which forces all requests to use Microsoft Entra ID and rejects any request authorized with the account access key. MS Learn states this explicitly, and the official Suggested Answer plus a strongly unanimous community vote (54, with the top 33-👍 comment) all converge on C. Answer A (disallow public access) is a popular dissent but only limits network reachability; it does nothing to prevent an authenticated/internal actor from extracting and using the shared keys, so it does not "prevent the threat from reoccurring."

More SC-100 practice questions