The clients at home and abroad can both purchase our SC-500 study materials online. Our brand enjoys world-wide fame and influences so many clients at home and abroad choose to buy our SC-500 study materials. Our company provides convenient service to the clients all around the world so that the clients all around the world can use our SC-500 Study Materials efficiently. Our company boosts an entire sale system which provides the links to the clients all around the world so that the clients can receive our products timely.
| Section | Weight | Objectives |
|---|---|---|
| Secure compute | 20โ25% | - Secure virtual machines and containers
|
| Manage identity, access, and governance | 20โ25% | - Enforce compliance and governance controls
|
| Manage and monitor security posture | 20โ25% | - Monitor, assess, and improve security posture
|
| Secure storage, databases, and networking | 25โ30% | - Secure network infrastructure
|
Our SC-500 practice materials comprise of a number of academic questions for your practice, which are interlinked and helpful for your exam. So their perfection is unquestionable. As a result, SC-500 real exam win worldwide praise and acceptance. Our SC-500 practice materials are determinant factors giving you assurance of smooth exam. The sooner you make up your mind, the more efficient you will win.
NEW QUESTION # 163
You have an Azure SQL Database logical server named Server1 that contains multiple databases.
The databases contain legacy SQL authentication logins that must no longer be usable for sign-in but must NOT be removed from the databases.
You need to ensure that SQL authentication is denied for connections.
What should you do?
Answer: A
Explanation:
Microsoft Entra-only authentication at the logical server level disables SQL authentication for all databases on that server while leaving existing SQL principals in place. That matches the requirement to deny SQL authentication without removing legacy logins. Creating external-provider users adds Entra users; it does not block SQL logins. Conditional Access can govern Entra sign-ins but cannot disable SQL authentication. SQL Server Contributor is an Azure management role, not an authentication mode. The exam objective emphasizes practical identity enforcement rather than cosmetic configuration. A valid answer must identify who authenticates, what permission is granted, where the scope is applied, and whether the method continues to work without passwords or secrets. That is why the selected answer is preferred over broader administrative roles or unrelated access settings. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege.
Official Microsoft source/topic: SC-500 Study Guide > Azure SQL platform security; Microsoft Learn > Microsoft Entra-only authentication.
NEW QUESTION # 164
You have an Azure subscription named Sub1 that contains the following resources:
You need to ensure that you can provide VM1 with secure access to a database on SQL1 by using a Microsoft Entra ID.
What should you do?
Answer: C
Explanation:
Enable a managed identity on VM1. Microsoft Entra managed identities allow Azure workloads such as virtual machines to authenticate to supported Azure services without storing passwords, client secrets, or certificates in application code or configuration.
Microsoft specifically documents the pattern of using a system-assigned managed identity on an Azure VM to access Azure SQL Database. The VM obtains a Microsoft Entra access token from its managed identity endpoint, and Azure SQL accepts that token for authentication. The database must then contain a Microsoft Entra principal representing the VM ' s managed identity and grant it the required database permissions.
Microsoft Learn
A secret in KV1 would reintroduce credential storage and isn ' t required for managed-identity authentication.
A Key Vault key is used for cryptographic operations and does not establish VM-to-SQL authentication. A service endpoint provides a network access path to Azure SQL but does not provide Microsoft Entra identity authentication.
The fact that VM1 and SQL1 are in different Azure regions does not prevent Microsoft Entra authentication; the identity mechanism is independent of their regional placement.
NEW QUESTION # 165
Case Study 2 - Fabrikam, Inc.
Overview
Fabrikam, Inc. is a consulting company. The company has a main office in New York City and branch offices in Amsterdam and Singapore.
Existing Environment. Network environment
The on-premises network contains a datacenter in each office.
Existing Environment. Cloud environment
Fabrikam has two Azure subscriptions named Sub1 and Sub2 and a Microsoft 365 subscription that includes Microsoft 365 E5 licenses.
All the subscriptions are linked to a Microsoft Entra tenant named fabrikam.com that contains the identities shown in the following table.
The tenant contains the groups shown in the following table.
All devices are enrolled in Microsoft Intune.
Existing Environment. Sub1 Resources
Sub1 contains a resource group named RG1 that contains the resources shown in the following table.
SQLServer1 uses Microsoft SQL Server authentication.
Sub1 has an Azure Web Application Firewall (WAF) named WAF1 that has the following types of rule sets:
- Bot Manager 1.1
- Azure-managed Default Rule Set (DRS)
Sub1 has the following compliance standards assigned in Microsoft Defender for Cloud:
- NIST SP 800-53 Rev. 4
- Microsoft cloud security benchmark (MCSB)
- System and Organization Controls (SOC) 2 Type 2
Existing Environment. Sub2 Resources
Sub2 contains a resource group named RG2.
Planned Changes and Requirements. Planned Changes
Fabrikam plans to implement the following changes:
- Deploy the following key vaults to RG1:
AKV2 in the West Europe Azure region
AKV3 in the Central US Azure region
AKV4 in the East US Azure region
- Deploy the following key vaults to RG2:
AKV5 in the East US region
- Configure VM1 to read data from storage1.
- Create function apps that have the following hosting plans:
Fa1: Flex Consumption hosting plan
Fa2: Consumption hosting plan
Fa3: Dedicated hosting plan
- For WAF1, implement rate limiting rules based on the request
location.
- Enable the NIST SP 800-53 Rev. 5 compliance standard in Defender for
Cloud.
- Create a new storage account named storage2 that supports Azure Table storage.
- Enforce multifactor authentication (MFA) when database administrators access SQLdb1.
- Implement ExpressRoute circuits to the on-premises network as shown
in the following table.
- For RG1, create a new Privileged Identity Management (PIM) eligible role assignment that assigns the Contributor role to supported groups.
Planned Changes and Requirements. Technical Requirements
Fabrikam has the following technical requirements:
- If VM1 is deleted, the permissions for VM1 must be removed
automatically.
- The AKS1 managed identity must only be able to pull images from
Registry1.
- The ID1 managed identity must be able to push images to and pull
images from Registry1.
- All the data in the storage accounts must be encrypted by using
Fabrikam-managed keys.
- All outbound traffic from the function apps to the on-premises
network must use ExpressRoute circuits.
- ExpressRoute connectivity between the on-premises network and the
Azure environment must be encrypted by using Layer 2 or Layer 3
encryption.
Hotspot Question
You need to configure the AKS1 and ID1 managed identities to meet the technical requirements.
The solution must follow the principle of least privilege.
Which role should you assign to each identity? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Explanation:
Box 1: AcrPull
Scenario:
AKS1 is an Azure Kubernetes Service (AKS) cluster in East US.
The AKS1 managed identity must only be able to pull images from Registry1.
Registry1 is an Azure container registry in East US.
To allow the Azure Kubernetes Service (AKS) managed identity (specifically the kubelet identity) to only pull images from an Azure Container Registry (ACR), you must assign the AcrPull role.
Box 2: AcrPush
The ID1 managed identity must be able to push images to and pull images from Registry1.
To allow a managed identity to both push images to and pull images from an Azure Container Registry (ACR), you must assign it the AcrPush built-in role.
Reference:
https://learn.microsoft.com/en-us/azure/aks/pre-created-kubelet-managed-identity?pivots=azure-cli
NEW QUESTION # 166
You have an Azure Logic Apps Consumption workflow that uses a Request trigger. All supported authentication methods are enabled on the Request trigger You need to ensure that the endpoint accepts only OAuth-based requests. The solution must minimize costs.
What should you do?
Answer: B
Explanation:
A Logic Apps Request trigger can be invoked through different authorization mechanisms. If all supported methods are enabled but only OAuth-based requests should be accepted, disabling shared access signature authentication removes the non-OAuth shared-secret URL model. Secure Inputs and Secure Outputs protect run-history data but do not control request authentication. API Management could enforce auth but adds cost and complexity, which the requirement says to minimize. The exam objective emphasizes practical identity enforcement rather than cosmetic configuration. A valid answer must identify who authenticates, what permission is granted, where the scope is applied, and whether the method continues to work without passwords or secrets. That is why the selected answer is preferred over broader administrative roles or unrelated access settings. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > Logic Apps security; Microsoft Learn > Request trigger SAS and OAuth authentication.
NEW QUESTION # 167
You have an Azure key vault named Vault1 that stores the resources shown in the following table.
Which resources support the creation of a rotation policy?
Answer: C
NEW QUESTION # 168
......
Our company, with a history of ten years, has been committed to making efforts on developing SC-500 exam guides in this field. Since the establishment, we have won wonderful feedback from customers and ceaseless business and continuously worked on developing our SC-500 exam prepare to make it more received by the public. Moreover, our understanding of the importance of information technology has reached a new level. Efforts have been made in our experts to help our candidates successfully Pass SC-500 Exam. Seldom dose the e-market have an authorized study materials for reference.
SC-500 Official Study Guide: https://www.actualtests4sure.com/SC-500-test-questions.html