Microsoft Implementing End-to-End Security Controls for Cloud and AI Workloads - SC-500 Exam Questions
QUESTION NO: 1
You are configuring a new Microsoft Sentinel workspace named Workspace1.
You have an external IT Service Management (ITSM) system that is NOT supported by any Microsoft Sentinel solutions in Azure Marketplace.
You need to ensure that Workspace1 creates service tickets in the ITSM system for all new security incidents.
What should you create?
You are configuring a new Microsoft Sentinel workspace named Workspace1.
You have an external IT Service Management (ITSM) system that is NOT supported by any Microsoft Sentinel solutions in Azure Marketplace.
You need to ensure that Workspace1 creates service tickets in the ITSM system for all new security incidents.
What should you create?
Correct Answer: B
Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).
QUESTION NO: 2
You have a Microsoft Defender XDR environment.
You have a Microsoft Power Platform environment where makers publish custom Microsoft Copilot Studio agents.
You need to enable real-time protection so that suspicious tool invocations are blocked before an agent runs actions, and related alerts appear in the Microsoft Defender portal.
What should you do? To answer, drag the appropriate actions to the correct services. Each action may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
You have a Microsoft Defender XDR environment.
You have a Microsoft Power Platform environment where makers publish custom Microsoft Copilot Studio agents.
You need to enable real-time protection so that suspicious tool invocations are blocked before an agent runs actions, and related alerts appear in the Microsoft Defender portal.
What should you do? To answer, drag the appropriate actions to the correct services. Each action may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Correct Answer:
Explanation:
In Microsoft Defender XDR: Configure the Microsoft Entra application ID for agent integration; In Power Platform: Configure the Microsoft Entra application ID for agent integration
Real-time protection for Copilot Studio agents depends on linking the agent integration identity across Microsoft Defender XDR and Power Platform. The same Microsoft Entra application ID anchors the integration so Defender can evaluate suspicious tool invocations before the agent performs actions and publish alerts in the Defender portal. Configuring only one side leaves the agent runtime and Defender control plane uncorrelated, which would prevent pre-action blocking. The compute domain tests whether protection is applied before deployment, during runtime, or through posture assessment. The selected answer matches the phase described in the requirement. Detection-only tools are not acceptable when the requirement says prevent, and local installation methods are inferior when Defender for Cloud, Azure Policy, or Azure Machine Configuration can enforce the control centrally. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > real-time protection for Copilot Studio agents; Microsoft Learn > Defender XDR and Power Platform agent integration.
QUESTION NO: 3
You use Azure Virtual Network Manager to manage multiple virtual networks in a network group named Group1 You discover that the virtual machines in Group1 are accessible from the internet by using TCP port 3389.
You need to block inbound TCP 3389 from the internet across all the virtual networks in Group1 The solution must minimize administrative effort.
What should you use?
You use Azure Virtual Network Manager to manage multiple virtual networks in a network group named Group1 You discover that the virtual machines in Group1 are accessible from the internet by using TCP port 3389.
You need to block inbound TCP 3389 from the internet across all the virtual networks in Group1 The solution must minimize administrative effort.
What should you use?
Correct Answer: B
Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).
QUESTION NO: 4
You have an Azure subscription.
You have the following custom role-based access control (RBAC) role definition
You have an Azure subscription.
You have the following custom role-based access control (RBAC) role definition
Correct Answer:
Explanation:
Topic 2, Contoso Ltd,
Overview - Contoso, Ltd. is a consulting company that has a main office in San Francisco and a branch office in Dallas. Contoso has a hybrid environment that contains on-premises servers connected to Azure, a Microsoft 365 E5 subscription, and an Azure subscription named Sub1. Existing Environment. Microsoft Entra tenant Contoso has a Microsoft Entra tenant named contoso.com that contains the users shown in the following table.
Existing Environment. On-premises environment The on-premises network contains an Active Directory Domain Services (AD DS) forest that syncs with contoso.com. The forest contains a server named Server1 that runs Windows Server. Existing Environment. Azure subscription Sub1 contains the storage accounts shown in the following table.
Sub1 contains the virtual networks shown in the following table.
Sub1 contains the virtual machines shown in the following table.
The network interface of VM1 is associated with an application security group named ASG1. Sub1 contains the resources shown in the following table.
Vault1 stores the objects shown in the following table.
Existing Environment. Privileged Identity Management (PIM) configuration You manage privileged roles by using Privileged Identity Management (PIM). The PIM role settings are configured as shown in the following table.
Existing Environment. Microsoft Sentinel configuration Contoso has a Microsoft Sentinel workspace that contains the following tables.
Requirements. Planned changes - Contoso plans to implement the following changes: Integrate AKS1 with Vault1. Enable Microsoft Entra Kerberos authentication for all supported storage. Configure auditing for sql1 by using the Azure portal and store audit logs in a centralized location. Requirements. Technical requirements Contoso identifies the following technical requirements: Protect Server1 by using file integrity monitoring. Protect AKS1 by using Microsoft Defender for Cloud. Configure Microsoft Sentinel to retain data for the maximum supported duration without changing the tier. Store objects used for authentication and encryption in Vault1 and ensure that Vault1 regenerates the objects every 30 days, whenever possible.
QUESTION NO: 5
You have a file named File1.yam1 that contains the following contents.
You create an Azure container instance named container1 by using File1.yam1. You need to identify where you can access the values of Variable1 and Variable2. What should you identify? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
You have a file named File1.yam1 that contains the following contents.
You create an Azure container instance named container1 by using File1.yam1. You need to identify where you can access the values of Variable1 and Variable2. What should you identify? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Correct Answer:
Explanation:
Variable1 is configured with the normal value property. A standard Azure Container Instances environment variable is available to processes running inside the container and its configured value is also exposed through the container resource configuration. Consequently, Variable1 can be accessed from inside container1 and from management interfaces such as the Azure portal . Microsoft Learn Variable2 is configured with secureValue , which Azure Container Instances provides specifically for sensitive values such as passwords, tokens, and application secrets. Microsoft states that environment variables configured using secureValue are not visible in the container ' s properties . When the resource is queried through management interfaces such as Azure CLI or the Azure portal, the secure variable ' s name can be shown, but its value is suppressed. Microsoft Learn The value is nevertheless injected into the container ' s runtime environment, so a process or interactive session inside container1 can access Variable2. Microsoft demonstrates this by entering the running container and reading the secure environment variable from the shell. Microsoft Learn This distinction protects secrets from exposure through the Azure management plane while still making them available to the workload that requires them. SC-500 includes security controls for Azure Container Instances under Secure compute.
QUESTION NO: 6
You have an Azure Storage account named storage1 that contains a file share named share1.
You need to ensure that data access requests to storage1 are accepted only when authorized by Microsoft Entra ID.
What should you do?
You have an Azure Storage account named storage1 that contains a file share named share1.
You need to ensure that data access requests to storage1 are accepted only when authorized by Microsoft Entra ID.
What should you do?
Correct Answer: D
Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).
QUESTION NO: 7
You have an Azure subscription named Subscription1 that contains the resources shown in the following table.
You create a custom RBAC role in Subscription1 by using the following JSON file.
You assign Role1 to User1 on RG1.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
You have an Azure subscription named Subscription1 that contains the resources shown in the following table.
You create a custom RBAC role in Subscription1 by using the following JSON file.
You assign Role1 to User1 on RG1.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Correct Answer:
Explanation:
The role permits read access to all Azure resource providers through */Read, plus all control-plane operations supplied by the Microsoft.Compute resource provider. Microsoft documents that Microsoft.
Compute/* grants all actions for Compute resources, while */Read grants only read operations outside that provider. Microsoft Learn VM1 # VNET1 = No. Although User1 can manage the VM ' s compute resource, attaching network interfaces or changing subnet associations requires permissions from the Microsoft.Network resource provider, including appropriate write/join operations. Role1 provides Microsoft.Network read permissions only.
App1 = No. Azure App Service resources use the Microsoft.Web provider. Starting, stopping, or restarting an App Service app requires Microsoft.Web action permissions; Microsoft even documents microsoft.web
/sites/restart/Action as a separate RBAC permission. Role1 doesn ' t provide it. Microsoft Learn cont1 = No. Azure Container Instances are controlled through the Microsoft.ContainerInstance provider.
Again, Role1 grants only read access to that provider.
Therefore, Microsoft.Compute/* gives broad control of VM compute operations but doesn ' t implicitly grant management rights over networking, App Service, or Azure Container Instances.
QUESTION NO: 8
You have an Azure subscription that contains the virtual machines shown in the following table.
You need to enable file integrity monitoring in Microsoft Defender for Cloud. Which computers will support file integrity monitoring?
You have an Azure subscription that contains the virtual machines shown in the following table.
You need to enable file integrity monitoring in Microsoft Defender for Cloud. Which computers will support file integrity monitoring?
Correct Answer: D
QUESTION NO: 9
You have an Azure subscription named Sub1 that contains a virtual network named VNet1.
VNet1 contains multiple virtual machines, including two virtual machines named VM1 and VM2.
Sub1 is linked to a Microsoft Entra tenant named contoso.com.
A partner company has an Azure subscription named Sub2 that contains a virtual network named VNet2.
VNet2 contains a virtual machine named VM3.
Sub2 is linked to a Microsoft Entra tenant named fabrikam.com.
VM1 and VM2 contain data used by an application that runs on VM3.
You need to ensure that VM3 can access VM1 and VM2. The solution must deny VM3 access to any other resources in Sub1.
What should you configure on each virtual network? To answer, drag the components to the correct virtual networks. Each component may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
You have an Azure subscription named Sub1 that contains a virtual network named VNet1.
VNet1 contains multiple virtual machines, including two virtual machines named VM1 and VM2.
Sub1 is linked to a Microsoft Entra tenant named contoso.com.
A partner company has an Azure subscription named Sub2 that contains a virtual network named VNet2.
VNet2 contains a virtual machine named VM3.
Sub2 is linked to a Microsoft Entra tenant named fabrikam.com.
VM1 and VM2 contain data used by an application that runs on VM3.
You need to ensure that VM3 can access VM1 and VM2. The solution must deny VM3 access to any other resources in Sub1.
What should you configure on each virtual network? To answer, drag the components to the correct virtual networks. Each component may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Correct Answer:
Explanation:
VNet1: An Azure Private Link service; VNet2: A private endpoint
Private Link service and private endpoint provide one-way, explicitly scoped private connectivity. VNet1 hosts the target VMs and should expose only the intended service through an Azure Private Link service.
VNet2, where VM3 runs, consumes that service through a private endpoint. VNet peering or VPN would create broader network reachability between the networks and would not inherently deny VM3 access to other resources in Sub1. Microsoft platform security questions usually hinge on where enforcement occurs: at the resource, server, subnet, firewall policy, private endpoint, or subscription level. The selected answer uses the control plane that owns that enforcement point. Other options are rejected when they only log activity, broaden network access, or protect a different service category. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > Private Link services and private endpoints; Microsoft Learn > Azure Private Link architecture.
QUESTION NO: 10
You have an Azure virtual network named VNet1 that contains three subnets named Subnet1, Subnet2 and Subnet3. A single network security group (NSG) named NSG1 is associated with all the subnets. You have the following virtual machines:
*VM1 on Subnet1
*VM2 on Subnet2
VM3 on Subnet3
You create two application security groups named ASG1 and ASG2. VM2 is a member of ASG1, and VM3 is a member of ASG2.
You need to ensure that only VM2 can connect to VM3. The solution must continue to work if the private IP address of VM2 changes.
How should you configure the inbound rule on NSG1 ? To answer, drag the settings to the correct configurations. Each setting may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
You have an Azure virtual network named VNet1 that contains three subnets named Subnet1, Subnet2 and Subnet3. A single network security group (NSG) named NSG1 is associated with all the subnets. You have the following virtual machines:
*VM1 on Subnet1
*VM2 on Subnet2
VM3 on Subnet3
You create two application security groups named ASG1 and ASG2. VM2 is a member of ASG1, and VM3 is a member of ASG2.
You need to ensure that only VM2 can connect to VM3. The solution must continue to work if the private IP address of VM2 changes.
How should you configure the inbound rule on NSG1 ? To answer, drag the settings to the correct configurations. Each setting may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Correct Answer:
Explanation:
Source: ASG1; Destination: ASG2
The requirement is identity-stable network filtering between virtual machines even if VM2 receives a different private IP address. Application security groups solve exactly that problem: rules refer to VM membership instead of a fixed IP. Because VM2 is a member of ASG1 and VM3 is a member of ASG2, the inbound allow rule on the shared NSG must use ASG1 as source and ASG2 as destination. Choosing IP addresses would fail the change-resilience requirement. The important exam skill is separating data-plane access, management-plane administration, and network reachability. A storage, database, or firewall setting must be selected because it enforces the exact path requested in the scenario. Distractors often look plausible because they improve security generally, but they do not satisfy the protocol, scope, or automation requirement stated in the question. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege.
Official Microsoft source/topic: SC-500 Study Guide > NSGs and ASGs; Microsoft Learn > Application security groups in network security rules.
QUESTION NO: 11
You have an Azure subscription that contains a virtual network named VNet1. The subscription contains an Azure App Service web app named App1.
You have an Azure Front Door profile named AFD1 that has an Azure Web Application Firewall (WAF) policy.
You need to ensure that all inbound traffic to App1 is filtered through AFD1.
What should you do?
You have an Azure subscription that contains a virtual network named VNet1. The subscription contains an Azure App Service web app named App1.
You have an Azure Front Door profile named AFD1 that has an Azure Web Application Firewall (WAF) policy.
You need to ensure that all inbound traffic to App1 is filtered through AFD1.
What should you do?
Correct Answer: A
Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).
QUESTION NO: 12
You plan to deploy Microsoft 365 Copilot.
You discover that Copilot can access sensitive information in your Microsoft SharePoint Online libraries.
You need to automatically identify which SharePoint Online content has been shared between all internal users.
What should you create?
You plan to deploy Microsoft 365 Copilot.
You discover that Copilot can access sensitive information in your Microsoft SharePoint Online libraries.
You need to automatically identify which SharePoint Online content has been shared between all internal users.
What should you create?
Correct Answer: D
Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).
QUESTION NO: 13
You have a hybrid environment that contains the following servers:
*50 Azure virtual machines that run Windows Server 2019
*20 physical, on premises servers that run Windows Server 2019
All the servers use a third-party antivirus solution that must remain active during a phased security rollout You need to onboard all the servers to Microsoft Defender for Endpoint by using a centralized deployment method. The solution must meet the following requirements:
*Endpoint detection and response (EDR) capabilities must be enabled.
*Antivirus conflicts must be prevented during onboarding.
What should you do on the servers?
You have a hybrid environment that contains the following servers:
*50 Azure virtual machines that run Windows Server 2019
*20 physical, on premises servers that run Windows Server 2019
All the servers use a third-party antivirus solution that must remain active during a phased security rollout You need to onboard all the servers to Microsoft Defender for Endpoint by using a centralized deployment method. The solution must meet the following requirements:
*Endpoint detection and response (EDR) capabilities must be enabled.
*Antivirus conflicts must be prevented during onboarding.
What should you do on the servers?
Correct Answer: C
Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).
QUESTION NO: 14
You have an Azure subscription that contains a storage account named storage1.
The storage1 account contains an Azure Blob Storage container named blob1 and an Azure Files share named share1.
You plan to enable Microsoft Defender for Storage on storage 1.
You need to identify which Defender for Storage features can be used for blob1 and share1.
Which Defender for Storage features can be used? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
You have an Azure subscription that contains a storage account named storage1.
The storage1 account contains an Azure Blob Storage container named blob1 and an Azure Files share named share1.
You plan to enable Microsoft Defender for Storage on storage 1.
You need to identify which Defender for Storage features can be used for blob1 and share1.
Which Defender for Storage features can be used? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Correct Answer:
Explanation:
Resource
Defender for Storage features
blob1
Activity monitoring, Malware scanning, and Sensitive data discovery
share1
Activity monitoring only
For blob1 , the appropriate selection is Activity monitoring, Malware scanning, and Sensitive data discovery . Defender for Storage continuously analyzes storage activity for anomalous or malicious behavior, and Blob Storage supports the Defender for Storage malware-scanning capability. Sensitive data discovery can also classify sensitive information stored in supported Blob Storage account types and use that context to prioritize security alerts. Microsoft Learn For share1 , the exam-relevant selection is Activity monitoring only . Defender for Storage activity monitoring analyzes Azure Files data-plane and control-plane activity for suspicious access patterns and threats. The normal on-upload malware scanning capability does not support Azure Files; Microsoft specifically lists Azure Files as unsupported for on-upload malware scanning. Microsoft Learn There is an important current-platform nuance: Microsoft now supports on-demand malware scanning of individual files or file shares, and sensitive data discovery for Azure Files is available in certain configurations when Defender CSPM is also enabled.
