제일 간단한 방법으로 가장 어려운 문제를 해결해드리는것이Pass4Test의 취지입니다.Microsoft인증 SC-500시험은 가장 어려운 문제이고Pass4Test의Microsoft인증 SC-500 덤프는 어려운 문제를 해결할수 있는 제일 간단한 공부방법입니다. Pass4Test의Microsoft인증 SC-500 덤프로 시험준비를 하시면 아무리 어려운Microsoft인증 SC-500시험도 쉬워집니다.
| Section | Weight | Objectives |
|---|---|---|
| Topic 1: Manage and monitor security posture | 20–25% | - Security Copilot
|
| Topic 2: Manage identity, access, and governance | 20–25% | - Secure access to resources by using Microsoft Entra ID
|
| Topic 3: Secure compute | 20–25% | - Application platform security
|
| Topic 4: Secure storage, databases, and networking | 25–30% | - Storage security
|
SC-500인증시험은Microsoft인증시험중의 하나입니다.그리고 또한 비중이 아주 큰 인증시험입니다. 그리고Microsoft SC-500인증시험 패스는 진짜 어렵다고 합니다. 우리Pass4Test에서는 여러분이SC-500인증시험을 편리하게 응시하도록 전문적이 연구팀에서 만들어낸 최고의SC-500덤프를 제공합니다, Pass4Test와 만남으로 여러분은 아주 간편하게 어려운 시험을 패스하실 수 있습니다,
질문 # 157
You have an Azure subscription that contains the custom roles shown in the following table.
In the Azure portal, you plan to create new custom roles by cloning existing roles Ihe new roles will be configured as shown in following table.
정답：
설명：
Explanation:
질문 # 158
You need to configure the AKS1 and ID 1 managed identities to meet the technical requirements. The solution must follow the principle of least privilege.
Which role should you assign to each identity? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
정답：
설명：
Explanation:
AKS1: AcrPull; ID1: Contributor
AKS1 needs to pull images from Azure Container Registry, so AcrPull is the least-privilege registry role for the cluster identity. ID1 requires Contributor in the visible answer area because the referenced technical requirement requires resource changes beyond a read-only or pull-only role. The important distinction is scope: AKS image retrieval should not receive Contributor, while the separate managed identity receives the broader role only for its implementation task. This domain is tested through precise scope control: tenant, subscription, resource, application, and data-plane authorization are not interchangeable. The correct choice applies the smallest identity or governance control that enforces the stated requirement. Options that only add users, create registrations, or provide broad administrator access fail because they do not directly enforce the requested access behavior. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > AKS and managed identities; Microsoft Learn > ACR pull role and Azure RBAC.
Category Breakdown
Category Number of Questions
Manage identity, access, and governance 40
Manage and monitor security posture 30
Secure compute 31
Secure storage, databases, and networking 34
TOTAL 135
Exam Topic Breakdown
Exam Topic Number of Questions
질문 # 159
Hotspot Question
You have an Azure key vault named KV1 that uses role-based access control (RBAC) for data plane authorization.
You have multiple Azure App Service web apps that retrieve a SQL connection string stored as a secret in KV1.
You need to ensure that the web apps can access KV1. The solution must minimize the number of required identities and follow the principle of least privilege.
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
정답：
설명：
Explanation:
Box 1: User-Assigned Managed Identity
The best type of workload identity for this scenario is a User-Assigned Managed Identity.
Minimizes Required Identities: Unlike a system-assigned managed identity (which creates one distinct identity per App Service), a single user-assigned managed identity can be created once and shared across multiple Azure App Service web apps.
Enforces Least Privilege: You can assign this single identity the specific, built-in Azure RBAC role of Key Vault Secrets User. This scope restricts the apps to only reading the secret contents (the SQL connection string) without granting permissions to delete, list, or alter other data plane components like keys or certificates.
Eliminates Credential Management: Because it is an Azure-managed workload identity, there are no client secrets or certificates to rotate, secure, or accidentally expose in your application configurations.
Box 2: Key Vault Secrets User
Assign the Key Vault Secrets User built-in role to the web apps.
Principle of Least Privilege: The Key Vault Secrets User role grants authorization to read secret contents and properties. It completely restricts the web apps from modifying, deleting, or creating secrets. It also denies access to cryptographic keys and certificates stored in the same vault.
Reference:
https://learn.microsoft.com/en-us/azure/app-service/overview-managed-identity
https://learn.microsoft.com/en-us/azure/key-vault/general/rbac-guide
질문 # 160
You have an Azure subscription that contains an Azure app service web app named Appl.
You plan to configure a Conditional Access policy for App1. The solution must meet the following requirements:
* Only allow access to App1 from Windows devices.
* Only allow devices that are marked as compliant to access Appl.
Which Conditional Access policy settings should you configure? To answer, drag the appropriate settings to the correct requirements- Each setting may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
정답：
설명：
Explanation:
Requirement
Conditional Access setting
Only allow access to App1 from Windows devices
Conditions
Only allow devices that are marked as compliant to access App1
Grant
For the operating-system requirement, configure Conditions . Microsoft Entra Conditional Access includes a Device platforms condition that allows a policy to target specific operating systems, including Windows. To restrict the policy to Windows devices, configure Conditions # Device platforms , enable platform targeting, and select Windows as the applicable platform. Microsoft documents device platform as one of the primary Conditional Access signals that administrators can use to scope policy enforcement. Microsoft Learn For the compliance requirement, configure the Grant access control and select Require device to be marked as compliant . Microsoft Entra receives device compliance information from Microsoft Intune and evaluates that state during authentication. If the device isn ' t compliant, Conditional Access denies access when this grant requirement applies. Microsoft explicitly identifies Require device to be marked as compliant as a Conditional Access Grant control. Microsoft Learn Target resources would be used separately to select App1 as the application protected by the policy. Users or agents determines which identities are subject to the policy, while Session manages post-authentication session behavior. Neither implements the two requirements shown in the answer area.
질문 # 161
Lab Task
use the following login credentials as needed:
To enter your username, place your cursor in the Sign in box and click on the username below.
To enter your password. place your cursor in the Enter password box and click on the password below.
Azure Username: Userl -28681041@ExamUsers.com
Azure Password: GpOAe4@lDg
If the Azure portal does not load successfully in the browser, press CTRL-K to reload the portal in a new browser tab.
The following information is for technical support purposes only:
Lab Instance: 28681041
Task 4
You need to ensure that a user named user2-28681041 can manage the properties of the virtual machines in the RG1lod28681041 resource group. The solution must use the principle of least privilege.
정답：
설명：
Check below steps in explanation for Task.
Explanation:
To ensure that a user named user2-28681041 can manage the properties of the virtual machines in the RG1lod28681041 resource group using the principle of least privilege, you can follow these steps:
* In the Azure portal, search for and select the resource group named RG1lod28681041.
* In the left pane, select Access control (IAM).
* Select Add.
* In the Add role assignment pane, enter the following information:
* Role: Select the appropriate role for your scenario. For example, Virtual Machine Contributor.
* Assign access to: Select User, group, or service principal.
* Select: Enter the name of the user you want to assign the role to. For example, user2-28681041.
* Select Save.
https://docs.microsoft.com/en-us/azure/role-based-access-control/role-assignments-portal
질문 # 162
......
Microsoft SC-500 덤프는 Microsoft SC-500 시험의 모든 문제를 커버하고 있어 시험적중율이 아주 높습니다. Pass4Test는 Paypal과 몇년간의 파트너 관계를 유지하여 왔으므로 신뢰가 가는 안전한 지불방법을 제공해드립니다. Microsoft SC-500시험탈락시 제품비용 전액환불조치로 고객님의 이익을 보장해드립니다.
SC-500자격증문제: https://www.pass4test.net/SC-500.html