在PDFExamDumps的網站上你可以免費下載PDFExamDumps為你提供的關於Microsoft SC-500 認證考試學習指南和部分練習題及答案作為嘗試。
| Section | Weight | Objectives |
|---|---|---|
| Secure compute | 20-25% | - Implement security for servers and virtual machines (VMs) - Implement security for application platform services - Implement security for AI workloads |
| Manage and monitor security posture | 20-25% | - Implement activity and event collection in Microsoft Sentinel - Implement Microsoft Security Copilot configuration - Manage security posture using Microsoft Defender for Cloud |
| Secure storage, databases, and networking | 25-30% | - Implement security for storage accounts - Implement security for Azure network services - Implement security for databases |
| Manage identity, access, and governance | 20-25% | - Implement governance with Azure Policy and Defender for Cloud - Secure secrets and keys using Azure Key Vault - Secure access to resources using Microsoft Entra ID |
PDFExamDumps提供的產品有很高的品質和可靠性。你可以先在網上免費下載部分PDFExamDumps提供的關於Microsoft SC-500 認證考試的練習題和答案作為嘗試。在你使用之後，相信你會很滿意我們的產品的。這麼好的一個能幫助你順利通過考試的產品，你還在猶豫什麼，快將PDFExamDumps的產品加入您的購物車吧。
問題 #185
You have an Azure subscription that has the Microsoft Defender for Cloud Foundational Cloud Security Posture Management (CSPM) plan enabled.
You have an Amazon Web Services (AWS) account connected to Defender for Cloud for posture management.
In Defender for Cloud, security recommendations for the resources in Azure and AWS have a risk level of Not evaluated.
You need to ensure that Defender for Cloud assigns a risk level to the recommendations.
What should you do?
答案：A
解題說明：
To ensure Microsoft Defender for Cloud assigns a risk level to your recommendations, you must enable the enhanced Defender CSPM plan for your Azure subscription and your connected AWS account.
The Foundational CSPM plan only provides basic compliance and baseline assessments, meaning advanced risk prioritization remains Not evaluated.
Reference:
https://learn.microsoft.com/en-us/azure/defender-for-cloud/security-recommendations
問題 #186
Hotspot Question
You have an Azure key vault named KV1 that uses role-based access control (RBAC) for data plane authorization.
You have multiple Azure App Service web apps that retrieve a SQL connection string stored as a secret in KV1.
You need to ensure that the web apps can access KV1. The solution must minimize the number of required identities and follow the principle of least privilege.
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
答案：
解題說明：
Explanation:
Box 1: User-Assigned Managed Identity
The best type of workload identity for this scenario is a User-Assigned Managed Identity.
Minimizes Required Identities: Unlike a system-assigned managed identity (which creates one distinct identity per App Service), a single user-assigned managed identity can be created once and shared across multiple Azure App Service web apps.
Enforces Least Privilege: You can assign this single identity the specific, built-in Azure RBAC role of Key Vault Secrets User. This scope restricts the apps to only reading the secret contents (the SQL connection string) without granting permissions to delete, list, or alter other data plane components like keys or certificates.
Eliminates Credential Management: Because it is an Azure-managed workload identity, there are no client secrets or certificates to rotate, secure, or accidentally expose in your application configurations.
Box 2: Key Vault Secrets User
Assign the Key Vault Secrets User built-in role to the web apps.
Principle of Least Privilege: The Key Vault Secrets User role grants authorization to read secret contents and properties. It completely restricts the web apps from modifying, deleting, or creating secrets. It also denies access to cryptographic keys and certificates stored in the same vault.
Reference:
https://learn.microsoft.com/en-us/azure/app-service/overview-managed-identity
https://learn.microsoft.com/en-us/azure/key-vault/general/rbac-guide
問題 #187
An application run2 on VM1 and VM2. The application is being migrated from storage account key authentication to Microsoft Entra authentication.
You review the current configuration and identify the following:
* VM1 and VM2 each have a system-assigned managed identity.
* Each application instance requests tokens by using only the local system-assigned managed identity.
* Network access to storage 1 from VMI and VM2 is allowed.
* No Azure RBAC data roles are assigned to the managed identities on storage1.
You need to enable the application on VM1 and VM2 to read and write blob data in storage1 by using Microsoft Entra authentication without changing how the application requests tokens.
Solution: You create a private endpoint for the blob service of storage1.
Does this meet the goal?
答案：A
問題 #188
An organization is evaluating the security of AI-generated content before it is presented to end users. The goal is to detect harmful, unsafe, or policy-violating responses automatically. Which capability should be prioritized?
答案：D
問題 #189
A company wants administrators to receive just-in-time access to privileged Azure roles instead of maintaining permanent assignments. Which Microsoft Entra feature should be implemented?
答案：A
解題說明：
Privileged Identity Management enables eligible role assignments that can be activated when needed, often requiring approval, MFA, or justification. This reduces standing privileges and limits exposure. Dynamic groups and Access Packages address different identity governance scenarios, while password reset focuses on account recovery.
問題 #190
......
SC-500認證考試是一個很難的考試。但是即使這個考試很難，報名參加考試的人也很多。如果要說為什麼，那當然是因為SC-500考試是一個非常重要的考試。對IT職員來說，沒有取得這個資格那麼會對工作帶來不好的影響。這個考試的認證資格可以給你的工作帶來很多有益的幫助，也可以幫助你晉升。總之這是一個可以給你的職業生涯帶來重大影響的考試。这么重要的考试，你也想参加吧。
SC-500考試證照綜述: https://www.pdfexamdumps.com/SC-500_valid-braindumps.html