StudyByteLearn
← SC-100: Microsoft Cybersecurity Architect
SC-100 · Application lifecycle workload identities and APIs

Practice question 415 of 498 · easy

A team wants one default authorization rule for new services. Which standard is most appropriate?

Choose the single best answer.

  1. A.Deny access unless the caller is explicitly authorized
  2. B.Permit every operation unless someone later adds a restriction
  3. C.Let UI visibility be the only permission check
  4. D.Treat possession of a route URL as permission
Show the answer and explanation

✓ Correct answer

  • Deny access unless the caller is explicitly authorized

Default deny requires explicit authorization. Default permit, URL knowledge, and user-interface visibility do not establish server-side permission.

Read the source reference

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study material. Not affiliated with or endorsed by Microsoft. These are original learning questions, not actual exam questions. Product capabilities and exam objectives can change; verify current Microsoft documentation. Practice scores do not predict or guarantee an exam result.