Microsoft SC-500덤프의 무료샘플을 원하신다면 우의 PDF Version Demo 버튼을 클릭하고 메일주소를 입력하시면 바로 다운받아Microsoft SC-500덤프의 일부분 문제를 체험해 보실수 있습니다. Microsoft SC-500 덤프는 모든 시험문제유형을 포함하고 있어 적중율이 아주 높습니다. Microsoft SC-500덤프로Microsoft SC-500시험패스 GO GO GO !
| Section | Weight | Objectives |
|---|---|---|
| Topic 1: Secure compute | 20-25% | - Implement security for AI workloads - Implement security for application platform services - Implement security for servers and virtual machines (VMs) |
| Topic 2: Manage identity, access, and governance | 20-25% | - Secure secrets and keys using Azure Key Vault - Secure access to resources using Microsoft Entra ID - Implement governance with Azure Policy and Defender for Cloud |
| Topic 3: Secure storage, databases, and networking | 25-30% | - Implement security for Azure network services - Implement security for storage accounts - Implement security for databases |
| Topic 4: Manage and monitor security posture | 20-25% | - Implement Microsoft Security Copilot configuration - Implement activity and event collection in Microsoft Sentinel - Manage security posture using Microsoft Defender for Cloud |
Pass4Test 의 IT전문가들이 자신만의 경험과 끊임없는 노력으로 최고의 Microsoft SC-500학습자료를 작성해 여러분들이Microsoft SC-500시험에서 패스하도록 최선을 다하고 있습니다. 덤프는 최신 시험문제를 커버하고 있어 시험패스율이 높습니다. Microsoft SC-500시험을 보기로 결심한 분은 가장 안전하고 가장 최신인 적중율 100%에 달하는Microsoft SC-500시험대비덤프를 Pass4Test에서 받을 수 있습니다.
질문 # 126
You have a Microsoft Foundry project that contains a model deployment named Deployment1.
Deployment1 contains an agent named Agent1 that uses an existing default guardrail configuration.
You discover that Agent1 generates tool calls that contain harmful language.
You need to ensure that Agent1 responses containing harmful content are prevented from running. The solution must prevent changes to the configuration of Deployment1.
What should you do?
정답：A
설명：
Create a custom guardrail and assign it directly to Agent1 . Microsoft Foundry supports guardrails at both the model-deployment level and the individual-agent level. If an agent has a custom guardrail assigned directly to it, the agent-level guardrail takes precedence over the guardrail inherited from its underlying model deployment . This allows Agent1 to receive stronger runtime protections without modifying Deployment1 or affecting other agents that use the same deployment.
Foundry guardrails can be configured at multiple intervention points , including user input, tool calls , tool responses, and final output. This is critical here because the unsafe content appears in Agent1 ' s tool calls. A custom guardrail can therefore apply the appropriate harmful-content controls before the tool invocation executes, causing content that exceeds the configured safety threshold to be blocked.
An automatic evaluation measures agent behavior but does not provide runtime enforcement. A red teaming run identifies security and safety weaknesses but likewise does not block production tool calls. Fine- tuning changes model behavior and is neither a deterministic content-enforcement mechanism nor necessary for this requirement.
The SC-500 study guide explicitly includes Configure guardrails for agent security in Foundry under the Secure compute domain
질문 # 127
Case Study 2 - Fabrikam, Inc.
Overview
Fabrikam, Inc. is a consulting company. The company has a main office in New York City and branch offices in Amsterdam and Singapore.
Existing Environment. Network environment
The on-premises network contains a datacenter in each office.
Existing Environment. Cloud environment
Fabrikam has two Azure subscriptions named Sub1 and Sub2 and a Microsoft 365 subscription that includes Microsoft 365 E5 licenses.
All the subscriptions are linked to a Microsoft Entra tenant named fabrikam.com that contains the identities shown in the following table.
The tenant contains the groups shown in the following table.
All devices are enrolled in Microsoft Intune.
Existing Environment. Sub1 Resources
Sub1 contains a resource group named RG1 that contains the resources shown in the following table.
SQLServer1 uses Microsoft SQL Server authentication.
Sub1 has an Azure Web Application Firewall (WAF) named WAF1 that has the following types of rule sets:
- Bot Manager 1.1
- Azure-managed Default Rule Set (DRS)
Sub1 has the following compliance standards assigned in Microsoft Defender for Cloud:
- NIST SP 800-53 Rev. 4
- Microsoft cloud security benchmark (MCSB)
- System and Organization Controls (SOC) 2 Type 2
Existing Environment. Sub2 Resources
Sub2 contains a resource group named RG2.
Planned Changes and Requirements. Planned Changes
Fabrikam plans to implement the following changes:
- Deploy the following key vaults to RG1:
AKV2 in the West Europe Azure region
AKV3 in the Central US Azure region
AKV4 in the East US Azure region
- Deploy the following key vaults to RG2:
AKV5 in the East US region
- Configure VM1 to read data from storage1.
- Create function apps that have the following hosting plans:
Fa1: Flex Consumption hosting plan
Fa2: Consumption hosting plan
Fa3: Dedicated hosting plan
- For WAF1, implement rate limiting rules based on the request
location.
- Enable the NIST SP 800-53 Rev. 5 compliance standard in Defender for
Cloud.
- Create a new storage account named storage2 that supports Azure Table storage.
- Enforce multifactor authentication (MFA) when database administrators access SQLdb1.
- Implement ExpressRoute circuits to the on-premises network as shown
in the following table.
- For RG1, create a new Privileged Identity Management (PIM) eligible role assignment that assigns the Contributor role to supported groups.
Planned Changes and Requirements. Technical Requirements
Fabrikam has the following technical requirements:
- If VM1 is deleted, the permissions for VM1 must be removed
automatically.
- The AKS1 managed identity must only be able to pull images from
Registry1.
- The ID1 managed identity must be able to push images to and pull
images from Registry1.
- All the data in the storage accounts must be encrypted by using
Fabrikam-managed keys.
- All outbound traffic from the function apps to the on-premises
network must use ExpressRoute circuits.
- ExpressRoute connectivity between the on-premises network and the
Azure environment must be encrypted by using Layer 2 or Layer 3
encryption.
You need to implement the planned change for VM1 to access storage. The solution must meet the technical requirements. What should you do first?
정답：B
설명：
You should use a system-assigned managed identity.
System-assigned identities are tightly coupled to the lifecycle of the Azure resource they are attached to. When you delete the virtual machine, the system-assigned identity is automatically deleted from Microsoft Entra ID, ensuring that all associated permissions are automatically revoked. In contrast, user-assigned managed identities are independent standalone resources and must be manually deleted.
Scenario:
Fabrikam plans to implement the following changes:
Configure VM1 to read data from storage1.
Fabrikam has the following technical requirements:
If VM1 is deleted, the permissions for VM1 must be removed automatically.
ID1 is a user-assigned managed identity.
Reference:
https://learn.microsoft.com/en-us/azure/container-apps/managed-identity
질문 # 128
Lab Task
use the following login credentials as needed:
To enter your username, place your cursor in the Sign in box and click on the username below.
To enter your password. place your cursor in the Enter password box and click on the password below.
Azure Username: Userl -28681041@ExamUsers.com
Azure Password: GpOAe4@lDg
If the Azure portal does not load successfully in the browser, press CTRL-K to reload the portal in a new browser tab.
The following information is for technical support purposes only:
Lab Instance: 28681041
Task 6
You need to email an alert to a user named adminl@contoso.com if the average CPU usage of a virtual machine named VM1 is greater than 70 percent for a period of 15 minutes.
정답：
설명：
Check below steps in explanation for Task.
Explanation:
To email an alert to a user named adminl@contoso.com if the average CPU usage of a virtual machine named VM1 is greater than 70 percent for a period of 15 minutes, you can follow these steps:
* In the Azure portal, search for and select the virtual machine named VM1.
* In the left pane, select Alerts.
* Select New alert rule.
* In the New alert rule pane, enter the following information:
* Name: Enter a name for the alert rule.
* Description: Enter a description for the alert rule.
* Condition: Select Metric measurement.
* Resource: Select the virtual machine named VM1.
* Metric: Select Percentage CPU.
* Operator: Select Greater than.
* Threshold: Enter 70.
* Aggregation type: Select Average.
* Period: Select 15 minutes.
* In the Actions pane, select Add action group.
* In the Add action group pane, enter the following information:
* Name: Enter a name for the action group.
* Short name: Enter a short name for the action group.
* Email recipient: Enter the email address of the user you want to receive the alert. For example, adminl@contoso.com.
* Select OK.
질문 # 129
You have Microsoft Security Copilot agents that authenticate by using Microsoft Entra service principals.
You receive a Microsoft Defender alert triggered by the anomalous OAuth authentication of an agent ' s Microsoft Entra service principal.
You need to assess the impact of the agent identity and identify which resources are affected if the identity is abused for lateral movement The solution must minimize administrative effort.
What should you do?
정답：A
설명：
The security team needs impact and lateral-movement exposure for an abused service principal. Defender XDR attack paths show the identity blast radius by connecting permissions, exposed resources, and reachable assets. Advanced hunting and audit logs can provide raw evidence, but they require more manual analysis. AI Observability and incident review do not directly answer which resources are affected by identity abuse across the environment. The compute domain tests whether protection is applied before deployment, during runtime, or through posture assessment. The selected answer matches the phase described in the requirement.
Detection-only tools are not acceptable when the requirement says prevent, and local installation methods are inferior when Defender for Cloud, Azure Policy, or Azure Machine Configuration can enforce the control centrally. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source
/topic: SC-500 Study Guide > analyze blast radius by using Defender XDR; Microsoft Learn > attack paths for identity risk.
질문 # 130
You have a Microsoft Entra tenant that contains a user named Admin1 and is linked to an Azure subscription named Sub1.
Admin1 reports that the Custom recommendation option is unavailable in Microsoft Defender for Cloud as shown in the following exhibit.
You need to ensure that Admin1 can create a custom recommendation. The solution must follow the principle of least privilege. What should you do?
정답：C
질문 # 131
......
Pass4Test에서는 IT인증시험에 관한 모든 덤프를 제공해드립니다. 우선 시험센터에서 정확한 시험코드를 확인하시고 그 코드와 동일한 코드로 되어있는 덤프를 구매하셔서 덤프에 있는 문제와 답을 기억하시면 시험을 쉽게 패스하실수 있습니다.SC-500시험은 IT인증시험중에서 많은 인기를 가지고 있는 시험입니다.SC-500시험을 패스하여 자격증을 취득하시면 취업이나 승진에 많은 가산점이 되어드릴것입니다.
SC-500시험대비 최신 공부자료: https://www.pass4test.net/SC-500.html