StudyByteLearn
← SC-100: Microsoft Cybersecurity Architect
SC-100 · SaaS PaaS IaaS containers and AI services

Practice question 314 of 498 · medium

A backend service needs only a specific IoT Hub operation. What access design best follows least privilege?

Choose the single best answer.

  1. A.Give the backend an Azure management-plane Reader role and expect all device-service operations to work
  2. B.Use supported Entra authentication with the appropriate scoped role
  3. C.Embed the full hub-owner key in every application configuration
  4. D.Give the backend IoT Hub Data Contributor at subscription scope regardless of its operation
Show the answer and explanation

✓ Correct answer

  • Use supported Entra authentication with the appropriate scoped role

Use supported Entra authentication with a role and scope matching the required service operation. A full hub-owner key or unnecessarily broad Data Contributor scope grants excess authority. A management-plane Reader role does not automatically authorize IoT Hub data-plane operations.

Read the source reference

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study material. Not affiliated with or endorsed by Microsoft. These are original learning questions, not actual exam questions. Product capabilities and exam objectives can change; verify current Microsoft documentation. Practice scores do not predict or guarantee an exam result.