我々にSC-500参考書を利用したら、大量の時間と精力が必要ではありません。弊社の問題集の的中率が高いので、SC-500参考書の内容を暗記すれば、試験に無事に合格できます。もし試験の中で内容が変更したら、お客様は半年の全額返金または一年の無料更新を選ぶことができます。SC-500試験の合格は我々の保証です。
| Section | Weight | Objectives |
|---|---|---|
| Topic 1: Secure storage, databases, and networking | 25–30% | - Storage security
|
| Topic 2: Secure compute | 20–25% | - Security for AI workloads
|
| Topic 3: Manage identity, access, and governance | 20–25% | - Secure access to resources by using Microsoft Entra ID
|
| Topic 4: Manage and monitor security posture | 20–25% | - Microsoft Defender for Cloud
|
Implementing End-to-End Security Controls for Cloud and AI Workloadsテストの準備は、主に当社のクライアントは、SC-500試験に合格するのを助けると認証を得ることができます。この認証は、クライアントに大きなメリットをもたらします。クライアントは大企業に参入し、高給を稼ぐことができます。 SC-500試験に合格すると、給与を2倍にすることができます。認定資格を所有している場合、SC-500クイズトレントを十分にマスターし、優れた能力を所有していることを証明し、会社または工場で尊敬されます。あなたの仕事を変えたいなら、それはあなたにとっても良いことです。
質問 # 132
You have a Microsoft Entra tenant that uses Privileged Identity Management (PIM).
You need to modify the AI Administrator role settings to meet the following requirements:
*Elevated access must be evaluated by another administrator before it is granted
*Privileged access must be removed automatically after a fixed period.
Which two settings should you configure? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
正解：A、B
解説：
Approval before elevation is implemented by requiring approval to activate the PIM role. Automatic removal after a fixed active period is controlled by the activation maximum duration. Expiring active or eligible assignments governs the assignment lifecycle, not the duration of each activation session. Requiring justification can improve audit quality, but it does not ensure that another administrator evaluates the request or that access ends after the configured active window. This domain is tested through precise scope control:
tenant, subscription, resource, application, and data-plane authorization are not interchangeable. The correct choice applies the smallest identity or governance control that enforces the stated requirement. Options that only add users, create registrations, or provide broad administrator access fail because they do not directly enforce the requested access behavior. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege.
Official Microsoft source/topic: SC-500 Study Guide > Privileged Identity Management; Microsoft Learn > configure role activation settings.
質問 # 133
You need to implement the planned change for WAF1. The solution must minimize administrative effort.
What should you do?
正解：A
解説：
Add a custom WAF rule . The planned change requires WAF1 to implement rate limiting based on the geographic location of incoming requests . Azure Web Application Firewall supports this combination directly through custom rate-limit rules.
Microsoft documents that Application Gateway WAF rate-limit rules can group requests by GeoLocation , where requests are categorized based on the geographic location derived from the client IP address. The rule can then apply the configured rate threshold independently to traffic originating from each geographic location. Microsoft Learn Azure WAF custom rules also support the GeoMatch operator, which evaluates requests according to their country or region of origin. Microsoft Learn This makes a single custom rule the most direct and administratively efficient implementation.
The Azure-managed Default Rule Set (DRS) provides predefined protections against common web application attacks, such as injection and protocol attacks; it is not where custom geographic rate limits are defined. Bot Manager 1.1 identifies and handles automated bot traffic but is not the appropriate mechanism for general location-based rate limiting. Azure Policy can enforce configuration standards across resources but does not itself process web requests or impose per-location request thresholds.
Therefore, configure a custom rate-limit rule with geographic matching/grouping .
質問 # 134
You have a Microsoft Entra tenant.
On January 1, you configure a Multifactor authentication registration policy that has the following settings
* Assignments: All users
* Require Microsoft Entra ID multifactor authentication registration: Enabled
* Enforce policy: On
On January 3, you create two new users named User1 and User2.
On January 5, User1 authenticates to Microsoft Entra ID for the first time. On January 7, User2 authenticates to Microsoft Entra ID for the first time.
On which date will User1 and User2 be forced to register for MFA? To answer, drag the appropriate dates to the correct users. Each date may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
正解：
解説：
Explanation:
質問 # 135
You have a network security group (NSG) bound to an Azure subnet
You run Get-AzNetworkSecurityRuleConf ig and receive the output shown in the following exhibit
Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.
NOTE: Each correct selection is worth one point.
正解：
解説：
Explanation:
Statement
Selection
Traffic destined for an Azure Storage account is
able to connect to East US 2
FTP connections from 1.2.3.4 to 10.0.0.10/32 are
dropped
The first selection is able to connect to East US 2 because NSG rules are evaluated in ascending priority order-the lower numerical value has higher priority. The StorageEA2Allow outbound rule has priority 104 and permits traffic to the Storage.EastUS2 service tag on destination port 443. The broader DenyStorageAccess rule has priority 105 and denies outbound traffic to the general Storage service tag.
Because priority 104 is evaluated first, HTTPS storage traffic to East US 2 is allowed; storage traffic for other regions subsequently matches the priority-105 deny rule. Microsoft confirms that regional service tags such as Storage.EastUS2 restrict the tag to the service ' s IP ranges in that specific region. Microsoft Learn The FTP connection is dropped. The Contoso_FTP inbound rule permits TCP port 21 from 1.2.3.4/32, but only when the destination is 10.0.0.5/32. The question ' s destination is 10.0.0.10/32, so this custom allow rule does not match. The traffic ultimately reaches the NSG ' s default DenyAllInbound rule and is blocked.
Microsoft documents that NSG processing stops on the first matching rule.
質問 # 136
You have an Azure Functions app named App1 that uses an HTTP trigger, runs on an Elastic Premium plan, and uses virtual network integration.
A partner application sends requests to App1 from a public IP address of xxx.xxx.xxx.xx.
You need to ensure that the requests are accepted from only xxx.xxx.xxx.xx.
What should you do?
正解：B
解説：
Configure an inbound access restriction on App1 that explicitly allows the partner ' s public IP address.
Azure Functions running on App Service infrastructure support access restriction rules that operate as an inbound network ACL. Microsoft states that these rules can contain individual IPv4/IPv6 addresses or ranges and that once one or more rules are configured, unmatched traffic can be denied. This directly supports the requirement to accept HTTP requests only from the specified partner IP.
The existing virtual network integration does not control inbound access. Microsoft specifically defines VNet integration as an outbound networking capability. Consequently, an NSG associated with the integration subnet affects traffic originating from the Function App but does not filter requests arriving at the Function App ' s public endpoint.
A private endpoint would eliminate normal public access and therefore would not support a partner that connects from a public Internet IP unless additional private connectivity were implemented. Azure Bastion is for administrative connectivity to VMs, while NAT Gateway controls outbound source addressing.
The SC-500 study guide explicitly includes configuring Azure Functions authentication and network access under Secure compute.
質問 # 137
......
成功の秘Theは目的への不変です。 試験に合格し、認定を取得することが目的の場合。 SC-500試験クラムPDFは、試験の正しいショートカットになります。 目標を達成する可能性や方法を逃さないでください。特に、SC-500試験のクラムPDFには常に100％の合格率があります。 ほとんどの場合、選択は努力よりも重要です。 テストのきちんとした準備は、多くの時間を節約するのに役立ちます。 Microsoft SC-500試験クラムPDFは、間違いなく今後の試験に役立つでしょう。
SC-500合格記: https://www.jpexam.com/SC-500_exam.html