[Aug-2026] SC-500 Exam Questions and Valid SC-500 Dumps PDF
SC-500 Brain Dump: A Study Guide with Tips & Tricks for passing Exam
NEW QUESTION # 53
Hotspot Question
You have an Azure subscription that contains the following resources:
- An Azure SQL Database logical server named Server1 that contains a database named DB1
- An Azure SQL Managed Instance named Instance1 that contains a database named DB2
You need to configure database auditing. The solution must meet the following requirements:
- Ensure that audit data is centrally available in a location that supports for KQL queries.
- Minimize ongoing administrative effort as additional databases are added.
What should you configure? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
NEW QUESTION # 54
You have an Azure subscription that contains the virtual machines shown in the following table.
All the virtual networks are peered.
You deploy Azure Bastion to VNET2.
Which virtual machines can be protected by the bastion host?
- A. VM1, VM2, and VM3 only
- B. VM2 only
- C. VM1, VM2, VM3, and VM4
- D. VM2 and VM4 only
Answer: C
Explanation:
All four virtual machines (VM1, VM2, VM3, and VM4) can be protected by this single Azure Bastion host.
Key Technical Reasons
Virtual Network Peering Support: Azure Bastion natively supports Virtual Network (VNet) Peering.
When VNet peering is configured, an Azure Bastion host deployed in one centralized "hub" VNet can securely connect to virtual machines in any peered "spoke" VNets.
No Regional Restrictions: VNet peering works seamlessly both within the same region and across different Azure regions (known as Global VNet peering). Because Azure Bastion routes your connection over the private Azure backbone network using private IP addresses, the region of the target virtual machine does not restrict access.
Individual Virtual Machine StatusVM1 (East US / VNET1): Accessible because VNET1 is peered with VNET2.
VM2 (West US / VNET2): Accessible because the Azure Bastion host is deployed directly into VNET2.
VM3 (East US / VNET1): Accessible because VNET1 is peered with VNET2.
VM4 (West US / VNET3): Accessible because VNET3 is peered with VNET2.
Reference:
https://learn.microsoft.com/en-us/azure/bastion/vnet-peering
NEW QUESTION # 55
You have a Microsoft Defender XDR environment.
You have a Microsoft Power Platform environment where makers publish custom Microsoft Copilot Studio agents.
You need to enable real-time protection so that suspicious tool invocations are blocked before an agent runs actions, and related alerts appear in the Microsoft Defender portal.
What should you do? To answer, drag the appropriate actions to the correct services. Each action may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Explanation:
In Microsoft Defender XDR: Configure the Microsoft Entra application ID for agent integration; In Power Platform: Configure the Microsoft Entra application ID for agent integration
Real-time protection for Copilot Studio agents depends on linking the agent integration identity across Microsoft Defender XDR and Power Platform. The same Microsoft Entra application ID anchors the integration so Defender can evaluate suspicious tool invocations before the agent performs actions and publish alerts in the Defender portal. Configuring only one side leaves the agent runtime and Defender control plane uncorrelated, which would prevent pre-action blocking. The compute domain tests whether protection is applied before deployment, during runtime, or through posture assessment. The selected answer matches the phase described in the requirement. Detection-only tools are not acceptable when the requirement says prevent, and local installation methods are inferior when Defender for Cloud, Azure Policy, or Azure Machine Configuration can enforce the control centrally. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > real-time protection for Copilot Studio agents; Microsoft Learn > Defender XDR and Power Platform agent integration.
NEW QUESTION # 56
Hotspot Question
You have three on-premises apps named App1, App2, and App3 that are configured in Microsoft Entra Private Access as shown in the following table.
You have the users shown in the following table.
The Global Secure Access client is deployed to all user devices.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Explanation:
Box 1: No
No, User2 cannot connect to https://10.20.30.40.
Port Mismatch: The URL https://10.20.30.40 implicitly targets port 443 (the standard port for HTTPS).App Assignment Restriction: User2 is strictly assigned to App2, which is only configured to allow traffic on port 8443 for that IP address.
Traffic Dropped: Because port 443 traffic to 10.20.30.40 is defined under App3 (which User2 does not have permissions to access), the Microsoft Entra Private Access client will block or drop the connection attempt.
Box 2: Yes
User3 is assigned to App1, which permits access to the FQDN *.corp.contoso.com on port 443.
Because this matches the requested URL and is an active assignment, the Global Secure Access Client successfully tunnels the traffic.
Box 3: No
No, User1 cannot connect to https://contoso.com. User1 is only assigned to App1, which limits their access to FQDN *.corp.contoso.com strictly over port 443. Attempting to access port 8443 will be blocked by the Global Secure Access client.
Reference:
https://learn.microsoft.com/en-us/entra/global-secure-access/how-to-configure-per-app-access
NEW QUESTION # 57
You have an Azure subscription that has the Microsoft Defender for Cloud Foundational Cloud Security Posture Management (CSPM) plan enabled.
You have an Amazon Web Services (AWS) account connected to Defender for Cloud for posture management.
In Defender for Cloud, security recommendations for the resources in Azure and AWS have a risk level of Not evaluated.
You need to ensure that Defender for Cloud assigns a risk level to the recommendations.
What should you do?
- A. Enable Microsoft Defender for Servers Plan 2.
- B. Assign the CIS AWS Foundations v3.0.0 standard to the AWS account.
- C. Enable the Defender CSPM plan.
- D. Onboard all the virtual machines in the AWS account to Azure Arc.
Answer: C
Explanation:
To ensure Microsoft Defender for Cloud assigns a risk level to your recommendations, you must enable the enhanced Defender CSPM plan for your Azure subscription and your connected AWS account.
The Foundational CSPM plan only provides basic compliance and baseline assessments, meaning advanced risk prioritization remains Not evaluated.
Reference:
https://learn.microsoft.com/en-us/azure/defender-for-cloud/security-recommendations
NEW QUESTION # 58
You have an Azure virtual network named VNet1 that contains an Azure Bastion Subnet. VNet1 contains a subnet named Subnet1 Subnet1 contains multiple virtual machines.
You plan to deploy Azure Bastion to provide secure RDP access to the virtual machines on Subnet1. You associate a network security group (NSG) named NSG1 to Azure Bastion Subnet.
You need to configure rules for NSG1. The solution must meet the following requirements:
*Allow required inbound access to Azure Bastion from the internet.
*Allow user access to the virtual machines by using Azure Bastion.
Which TCP ports should you allow for the NSG1 rules? To answer, drag the appropriate ports to the correct rules. Each port may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Explanation:
Inbound from the internet: 443; Outbound to Subnet1: 3389
Azure Bastion requires inbound HTTPS access on TCP 443 from the internet to the AzureBastionSubnet so users can reach the Bastion service. For RDP to Windows virtual machines, Bastion then needs outbound access to the target subnet on TCP 3389. Port 22 would be required for SSH, but the scenario is specifically secure RDP. Other listed ports do not satisfy Bastion RDP access requirements. For this domain, least privilege means granting only the required data operation or allowing only the required network flow. The correct response avoids shared keys, broad peering, general contributor roles, or log-only controls when the scenario demands prevention, routing, event triggering, or account-specific configuration. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > Azure Bastion; Microsoft Learn > Azure Bastion NSG access and port requirements.
NEW QUESTION # 59
You have an Azure subscription named Sub1 that contains a storage account named storage1 Sub1 has Microsoft Defender for Storage enabled. Defender for Storage has on-upload malware scanning enabled.
The security team at your company requires that all malicious files be processed automatically by a serverless workflow for quarantine and notification.
You need to ensure that the malware scan results trigger an automated response. The solution must minimize operational effort.
What should you configure?
- A. Lifecycle management policies
- B. An Azure Event Grid subscription
- C. An Azure Monitor alert rule
- D. Diagnostic settings to send logs to a Log Analytics workspace
Answer: B
Explanation:
The security team wants a serverless workflow to run when scan results are produced. Defender for Storage malware scanning emits events that can be subscribed to through Azure Event Grid, and Event Grid can trigger Azure Functions, Logic Apps, or other serverless handlers. Diagnostic settings and Log Analytics are useful for investigation but are not the lowest-effort event trigger for each malicious upload. Lifecycle policies are storage-management controls, not security remediation workflows. Microsoft platform security questions usually hinge on where enforcement occurs: at the resource, server, subnet, firewall policy, private endpoint, or subscription level. The selected answer uses the control plane that owns that enforcement point.
Other options are rejected when they only log activity, broaden network access, or protect a different service category. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source
/topic: SC-500 Study Guide > Defender for Storage; Microsoft Learn > Event Grid events for malware scanning results.
NEW QUESTION # 60
You have an Azure Container Instances container group named CG1 that has a DNS name of cg1.contoso.
com. CG1 has the following configurations:
*A Linux container named container1 that serves HTTPS over TCP port 443 and hosts an application named App1
*A Linux container named container2 that listens on TCP port 5000 and is accessed only by App1
*A public IP address
A security review finds that external clients can reach TCP port 5000 by using the public IP address of CG1.
You need to meet the following requirements:
*Ensure that the external clients can access container1 only by using TCP port 443.
*Ensure that container1 can continue to access container2
What should you configure? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Explanation:
Exposed ports on the public IP address of CG1: 443 only; Network endpoint for App1: localhost:5000 In an Azure Container Instances group with a public IP address, only the ports exposed on the container group public endpoint are reachable externally. The public exposed port should therefore be limited to 443.
Containers inside the same container group can communicate with one another over localhost, so App1 can continue to reach container2 at localhost:5000 without exposing port 5000 publicly. For this domain, least privilege means granting only the required data operation or allowing only the required network flow. The correct response avoids shared keys, broad peering, general contributor roles, or log-only controls when the scenario demands prevention, routing, event triggering, or account-specific configuration. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > Azure Container Instances security; Microsoft Learn > container group exposed ports and localhost communication.
NEW QUESTION # 61
Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem.
After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.
You have a Microsoft Sentinel workspace.
You have a multi-tier Security Operations Center (SOC) team.
You need to ensure that all new security incidents are assigned immediately to the Tier 1 analysts group and flagged for triage.
Solution: You create an analytics rule.
Does this meet the goal?
- A. No
- B. Yes
Answer: A
Explanation:
An analytics rule detects threats and generates alerts or incidents from matching data. It does not automatically assign all newly created incidents to an analyst group or apply triage tags. An automation rule is required because it can trigger when an incident is created and immediately assign an owner and tag the incident for triage.
Reference:
https://learn.microsoft.com/en-us/azure/sentinel/create-manage-use-automation-rules?tabs=defender-portal%2Conboarded
https://learn.microsoft.com/en-us/azure/sentinel/create-analytics-rules?tabs=defender-portal
NEW QUESTION # 62
You have a Microsoft Sentinel workspace.
You need to collect Windows security events from 200 Azure virtual machines that run Windows Server. The solution must meet the following requirements:
- Use direct agent-based data collection from each virtual machine.
- Use a supported agent for new virtual machine deployments.
Which Microsoft Sentinel connector should you use?
- A. Security Events via Legacy Agent
- B. Windows Security Events via AMA
- C. Azure Resource Graph
- D. Syslog via AMA
- E. Windows Forwarded Events
Answer: B
Explanation:
The Windows Security Events via AMA connector uses the Azure Monitor Agent to collect Windows security events directly from Azure virtual machines and send them to the Microsoft Sentinel SecurityEvent table. Azure Monitor Agent is the supported agent for new guest operating system data collection deployments, replacing legacy agent-based collection.
Reference:
https://learn.microsoft.com/en-us/azure/azure-monitor/vm/data-collection-windows-events
https://learn.microsoft.com/en-us/azure/azure-monitor/agents/azure-monitor-agent-overview
NEW QUESTION # 63
You have an Azure subscription named Sub1 that contains a storage account named storage1.
Sub1 has Microsoft Defender for Storage enabled. Defender for Storage has malware scanning enabled.
You need to configure a solution that automates the remediation of malware detected in storage1.
What should you include in the solution?
- A. Azure Logic Apps
- B. an alert rule
- C. a Log Analytics workspace
- D. Azure Policy
Answer: A
Explanation:
An Azure Logic Apps workflow is needed to automate the remediation of malware detected by Microsoft Defender for Storage.
Microsoft Defender for Storage triggers security alerts when malware is detected. To automatically remediate the threat (such as deleting or moving the malicious file), you need an automation engine that can execute workflows. Azure Logic Apps natively integrates with Microsoft Defender for Cloud to trigger actions based on these alerts.
Reference:
https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-storage-configure-malware-scan
NEW QUESTION # 64
You need to implement the planned change for SQLdb1
Which two actions should you perform? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point
- A. Configure Microsoft Entra authentication for SQLServer1.
- B. Create a compliance policy.
- C. Configure a user-assigned managed identity for SQLdb1.
- D. Create a Conditional Access policy.
- E. Configure federated client identity for SQLdb1.
Answer: A,D
Explanation:
Microsoft Entra authentication must be configured on the SQL server before Microsoft Entra identities and Conditional Access can govern database access. A Conditional Access policy then enforces the planned access control for SQLdb1. A compliance policy does not authenticate SQL connections. Federated client identity and a user-assigned managed identity are used for workload identity scenarios, not for enforcing user sign-in requirements against Azure SQL in this case. The exam objective emphasizes practical identity enforcement rather than cosmetic configuration. A valid answer must identify who authenticates, what permission is granted, where the scope is applied, and whether the method continues to work without passwords or secrets. That is why the selected answer is preferred over broader administrative roles or unrelated access settings. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > Azure SQL authentication and conditional access; Microsoft Learn > Microsoft Entra authentication for Azure SQL.
NEW QUESTION # 65
Hotspot Question
You have an Azure subscription that contains the following resources:
- An Azure SQL Database logical server named Server1 that contains a
database named DB1
- An Azure SQL Managed Instance named Instance1 that contains a
database named DB2
You need to configure database auditing. The solution must meet the following requirements:
- Ensure that audit data is centrally available in a location that
supports for KQL queries.
- Minimize ongoing administrative effort as additional databases are
added.
What should you configure? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
NEW QUESTION # 66
You have a Microsoft Entra tenant that has the following configurations:
- User consent for applications is disabled.
- Only administrators can grant permissions to applications.
You register an application named App1 that uses delegated Microsoft Graph permissions.
You need to configure App1 to meet the following requirements:
- Enable user sign-ins without interactive consent prompts.
- Enable App1 to access Microsoft Graph on behalf of the signed-in
user.
What should you do?
- A. Modify the app registration to use application permissions instead of delegated permissions.
- B. Add the required delegated Microsoft Graph permissions to the app registration and rely on user consent during sign-in.
- C. Grant admin consent to App1 for the required delegated permissions.
- D. Configure enterprise applications to require user assignment and assign users to App1.
Answer: C
Explanation:
Admin consent grants the required delegated Microsoft Graph permissions on behalf of the tenant. App1 can then call Microsoft Graph in the context of a signed-in user without requiring individual users to respond to consent prompts, which is necessary because user consent is disabled.
Reference:
https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/grant-admin-consent?pivots=portal
https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-configure-app-access-web-apis
NEW QUESTION # 67
A company uses Microsoft Entra ID and has enabled Conditional Access. Administrators want to reduce the risk of token theft by requiring users to authenticate with phishing-resistant methods when accessing sensitive AI workloads. Which authentication method best satisfies this requirement?
- A. Temporary Access Pass
- B. FIDO2 security keys
- C. Email one-time passcode
- D. SMS verification
Answer: B
NEW QUESTION # 68
You need to configure Server1 to meet the technical requirements.
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Explanation:
Install on Server1: The Azure Connected Machine agent; Deploy to Sub1: A Log Analytics workspace
The Azure Connected Machine agent is required to onboard a non-Azure server as an Azure Arc-enabled server. Once the server is represented in Azure, telemetry and security data can be directed to a Log Analytics workspace in the subscription. This combination supports Defender for Cloud and Sentinel-style monitoring without treating the server as a native Azure VM. Deploying only a workspace would not onboard Server1; installing only the agent would not provide the analytics destination. This answer also follows operational scalability. Microsoft security architecture favors policy-driven deployment, agentless assessment, managed identities, and Defender workload plans where possible. Those mechanisms reduce manual configuration while keeping enforcement tied to the resource type, which is why the selected choice is stronger than manual or after-the-fact alternatives. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > Azure Arc and Sentinel data collection; Microsoft Learn > Connected Machine agent and Log Analytics workspace.
NEW QUESTION # 69
Case Study 1 - Contoso, Ltd.
Overview
Contoso, Ltd. is a consulting company that has a main office in San Francisco and a branch office in Dallas.
Contoso has a hybrid environment that contains on-premises servers connected to Azure, a Microsoft 365 E5 subscription, and an Azure subscription named Sub1.
Existing Environment. Microsoft Entra tenant
Contoso has a Microsoft Entra tenant named contoso.com that contains the users shown in the following table.
Existing Environment. On-premises environment
The on-premises network contains an Active Directory Domain Services (AD DS) forest that syncs with contoso.com. The forest contains a server named Server1 that runs Windows Server.
Existing Environment. Azure subscription
Sub1 contains the storage accounts shown in the following table.
Sub1 contains the virtual networks shown in the following table.
Sub1 contains the virtual machines shown in the following table.
The network interface of VM1 is associated with an application security group named ASG1.
Sub1 contains the resources shown in the following table.
Vault1 stores the objects shown in the following table.
Existing Environment. Privileged Identity Management (PIM) configuration You manage privileged roles by using Privileged Identity Management (PIM). The PIM role settings are configured as shown in the following table.
Existing Environment. Microsoft Sentinel configuration
Contoso has a Microsoft Sentinel workspace that contains the following tables.
Requirements. Planned changes
Contoso plans to implement the following changes:
- Integrate AKS1 with Vault1.
- Enable Microsoft Entra Kerberos authentication for all supported
storage.
- Configure auditing for sql1 by using the Azure portal and store audit logs in a centralized location.
Requirements. Technical requirements
Contoso identifies the following technical requirements:
- Protect Server1 by using file integrity monitoring.
- Protect AKS1 by using Microsoft Defender for Cloud.
- Configure Microsoft Sentinel to retain data for the maximum supported duration without changing the tier.
- Store objects used for authentication and encryption in Vault1 and
ensure that Vault1 regenerates the objects every 30 days, whenever
possible.
Hotspot Question
You need to configure Server1 to meet the technical requirements.
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
NEW QUESTION # 70
You have an Azure virtual network that contains 100 virtual machines and an Azure Firewall instance named FW1.
All the traffic from the virtual machines is routed through FW1.
You need to ensure that FW1 allows access to only a URL of updates contoso.com and blocks all other outbound traffic.
What should you use?
- A. An inbound NAT rule
- B. An application rule
- C. A network rule
- D. An outbound NAT rule
Answer: B
Explanation:
Azure Firewall application rules inspect HTTP and HTTPS traffic by FQDN or URL-oriented application targets. The scenario says the virtual machines may reach only updates.contoso.com and all other outbound traffic must be blocked. A network rule works at IP address, port, and protocol level, but it is not the best fit for URL/FQDN-based allowlisting. NAT rules translate inbound traffic and do not solve outbound web filtering. The important exam skill is separating data-plane access, management-plane administration, and network reachability. A storage, database, or firewall setting must be selected because it enforces the exact path requested in the scenario. Distractors often look plausible because they improve security generally, but they do not satisfy the protocol, scope, or automation requirement stated in the question. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > Azure Firewall; Microsoft Learn > Azure Firewall application rules and FQDN filtering.
NEW QUESTION # 71
Hotspot Question
You have an Azure subscription named Sub1 that contains 50 virtual machines. Sub1 has Microsoft Defender for Cloud enabled.
Sub1 contains an Azure key vault named KV1 and an Azure policy that enforces storing all secrets in KV1.
Occasionally, the developers at your company store plaintext tokens and SSH private keys on the virtual machines.
You need to configure Defender for Cloud to detect plaintext secrets on the virtual machines. The solution must minimize administrative changes to the virtual machines.
How should you configure Defender for Cloud? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
NEW QUESTION # 72
Your organization is deploying several generative AI applications that use Azure AI services.
Security administrators want to ensure that prompts and responses containing sensitive information are identified and monitored before they leave the organization's environment. Which solution should be implemented first?
- A. Azure Load Balancer
- B. Azure Firewall Premium
- C. Azure Traffic Manager
- D. Microsoft Purview Data Loss Prevention (DLP)
Answer: D
Explanation:
Microsoft Purview DLP is designed to discover, classify, and protect sensitive information across Microsoft services. It can help detect sensitive content in AI-related workflows and enforce policies before data is shared externally. Azure Firewall Premium protects network traffic, but it does not provide content-aware DLP capabilities.
NEW QUESTION # 73
You have an Azure subscription named Sub1 that contains multiple virtual machines. Sub1 has the Microsoft Defender Cloud Security Posture Management (CSPM) plan enabled.
You discover that Defender for Cloud falls to identify plaintext connection strings and SSH keys stored on the virtual machines.
You need to ensure that secrets can be identified on the virtual machines.
What should you do?
- A. Configure the Defender for Cloud data connector in Microsoft Sentinel.
- B. Enable agentless machine scanning.
- C. Enable Microsoft Defender for Key Vault.
- D. Deploy the Azure Monitor Agent to all the virtual machines.
Answer: B
Explanation:
Defender CSPM identifies secrets such as plaintext connection strings and SSH keys on machines through agentless machine scanning. If those secrets are not being identified, the missing capability is the agentless scan feature. The Sentinel data connector only forwards alerts and posture data, the Azure Monitor Agent collects telemetry, and Defender for Key Vault protects vault access; none of those scan VM disks for exposed secrets. The posture and monitoring objective focuses on turning security data into usable operational outcomes. The correct answer either collects the right signal, grants the right security-operations role, or automates incident handling at the correct layer. Distractors often provide dashboards, queries, or broad permissions, but those do not create the requested workflow or least-privilege security capability. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > scan for secrets by Defender CSPM; Microsoft Learn > agentless scanning for machines.
NEW QUESTION # 74
You use Microsoft Security Copilot.
Security Copilot contributors currently create custom plugins for their own sessions and manage organization- wide custom plugins.
You need to prevent the contributors from managing the organization-wide custom plugins. The solution must NOT affect the contributors ' ability to create custom plugins for their own sessions.
What should you select in the Plugin settings?
- A. Owners only at the user scope
- B. Contributors and Owners at the user scope
- C. Contributors and Owners at the tenant scope
- D. Owners only at the tenant scope
Answer: D
Explanation:
Organization-wide custom plugin management is a tenant-scope administrative action. Setting the plugin setting to Owners only at the tenant scope removes that capability from contributors while leaving their user- scope session plugin ability unaffected. Moving ownership to user scope would not govern tenant-wide plugins correctly. Allowing contributors at tenant scope preserves the problem. The selected setting separates personal experimentation from organization-wide plugin governance. For SC-500, the decisive distinction is whether the control authenticates an identity, grants authorization, or merely changes configuration visibility.
The incorrect choices generally either grant excessive privilege, change the application model, or operate at the wrong scope. Microsoft expects the least-privilege identity path that satisfies the scenario without introducing shared secrets or unnecessary tenant-wide rights. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > Security Copilot plugins; Microsoft Learn > manage custom plugins and owner/contributor scope.
NEW QUESTION # 75
You have an Azure Storage account named storage1 that hosts a blob container named container1.
You have an Azure Functions app named app1 that uses a managed identity.
You need to configure app1 to read, write, and delete blobs in container1. The solution must follow the principle of least privilege.
What should you do?
- A. Assign the Storage Blob Data Contributor role to the managed identity of App1 at the scope of container1.
- B. Assign the Owner role to the managed identity of App1 at the scope of container1.
- C. Assign the Storage Blob Delegator role to the managed identity of App1 at the scope of container1.
- D. Assign the Storage Account Contributor role to the managed identity of app1 at the scope of storage1.
Answer: A
Explanation:
The Storage Blob Data Contributor role grants permissions to read, write, and delete blob data.
Assigning it to the managed identity at the scope of container1 limits access to only the required container, satisfying the principle of least privilege.
Reference:
https://learn.microsoft.com/en-us/azure/storage/blobs/assign-azure-role-data-access?tabs=portal
https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles
NEW QUESTION # 76
You need to delegate a user to implement the planned change for Defender for Cloud. The solution must follow the principle of least privilege.
Which user should you choose?
- A. Admin3
- B. Admin1
- C. Admin4
- D. Admin2
Answer: B
Explanation:
Admin1 is the visible least-privilege delegate for the planned Defender for Cloud change. Defender for Cloud administration should be delegated to the user with the specific security or Defender permissions needed for the task, not to broader administrators unless required. Choosing a higher privileged account would violate the least-privilege requirement. The source file's case-study background is not visible, so the answer follows the displayed answer selection and the general Defender for Cloud RBAC model. The SC-500 study guide places these tasks under security posture, event collection, Defender CSPM, EASM, Sentinel, and Security Copilot operations. The exam expects the control that minimizes analyst effort while preserving correct permissions and data flow. The selected answer reflects that service boundary and avoids a broader or merely investigative alternative. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source
/topic: SC-500 Study Guide > Defender for Cloud least-privilege administration; Microsoft Learn > built-in Azure roles for Defender for Cloud.
NEW QUESTION # 77
......
SC-500 Exam Questions: Free PDF Download Recently Updated Questions: https://pass4sure.dumpstorrent.com/SC-500-exam-prep.html