StudyByteLearn
← SC-100: Microsoft Cybersecurity Architect
SC-100 · Application lifecycle workload identities and APIs

Practice question 424 of 498 · hard

A WAF and API token policy are enabled, yet valid users can request other users' invoices. Which missing control best maps to the requirement?

Choose the single best answer.

  1. A.A second at-rest encryption layer
  2. B.A longer token lifetime
  3. C.A higher API quota
  4. D.Object-level authorization in the application or data layer
Show the answer and explanation

✓ Correct answer

  • Object-level authorization in the application or data layer

Object-level authorization binds access to the correct user's records. WAF and token validation do not replace it; quotas regulate volume, encryption layers protect stored bytes, and token lifetime does not determine invoice ownership.

Read the source reference

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study material. Not affiliated with or endorsed by Microsoft. These are original learning questions, not actual exam questions. Product capabilities and exam objectives can change; verify current Microsoft documentation. Practice scores do not predict or guarantee an exam result.