SC-100 decision sheets

• AI data governance: Microsoft 365 Copilot vs third-party generative AI apps
• Securing Azure AI services and API Management: identity, network, keys, and exposure
• AKS security hardening: baseline, isolation, image scanning, API server, and node boot integrity
• Conditional Access design: signals, grant controls, and continuous access evaluation
• Defender CSPM vs foundational CSPM: which capabilities need the paid plan
• Defender for IoT: cloud-connected vs on-premises OT sensors and enterprise IoT coverage
• Device access: Intune compliance with Conditional Access vs app protection (MAM) without enrollment
• Endpoint hardening: security baselines vs EDR, and reconciling baseline conflicts
• Enterprise access model: control plane vs management plane vs data/workload plane
• Global Secure Access: Internet Access vs Private Access vs Microsoft traffic profile
• Encryption keys: service-managed vs customer-managed vs Managed HSM
• Platform landing zone vs application landing zone vs management group scope
• Workload identity: system-assigned vs user-assigned managed identity vs service principal vs federation
• Secure Score vs Exposure Management vs regulatory compliance dashboard vs CIEM vs Defender EASM
• Privileged and cross-tenant identity governance: avoiding standing Global Administrator
• Purview and Defender data-security capability selection
• Ransomware readiness: prevent entry, protect recovery assets, and restore identity first
• Windows LAPS: choosing the password backup target by device join state