あなたのキャリアでいま挑戦に直面していますか。自分のスキルを向上させ、よりよく他の人に自分の能力を証明したいですか。昇進する機会を得たいですか。そうすると、はやくSC-500認定試験を申し込んで認証資格を取りましょう。Microsoftの認定試験はIT領域における非常に大切な試験です。MicrosoftのSC-500認証資格を取得すると、あなたは大きなヘルプを得ることができます。では、どのようにはやく試験に合格するかを知りたいですか。JapancertのSC-500参考資料はあなたの目標を達成するのに役立ちます。
| Section | Weight | Objectives |
|---|---|---|
| Topic 1: Manage and monitor security posture | 20-25% | - Manage security posture using Microsoft Defender for Cloud - Implement activity and event collection in Microsoft Sentinel - Implement Microsoft Security Copilot configuration |
| Topic 2: Manage identity, access, and governance | 20-25% | - Secure access to resources using Microsoft Entra ID - Implement governance with Azure Policy and Defender for Cloud - Secure secrets and keys using Azure Key Vault |
| Topic 3: Secure compute | 20-25% | - Implement security for application platform services - Implement security for servers and virtual machines (VMs) - Implement security for AI workloads |
| Topic 4: Secure storage, databases, and networking | 25-30% | - Implement security for storage accounts - Implement security for databases - Implement security for Azure network services |
当社JapancertのSC-500試験トレントを購入し、時間を有効に活用し、知識を蓄積することを希望するお客様を支援するために、当社はSC-500試験ツールの改良と更新に最善を尽くしています。 「品質第一、信頼性第一、サービス第一」が当社の目的です。SC-500学習教材がお客様に利益と利益をもたらすことを強く望みます。そのため、SC-500テストトレントの更新を継続し、お客様にSC-500試験に合格して認定を取得できるように、最新のSC-500学習教材を提供するよう最善を尽くしています。
質問 # 70
You have an Azure Functions app named App1 that uses an HTTP trigger, runs on an Elastic Premium plan, and uses virtual network integration.
A partner application sends requests to App1 from a public IP address of xxx.xxx.xxx.xx.
You need to ensure that the requests are accepted from only xxx.xxx.xxx.xx.
What should you do?
正解：C
解説：
To restrict access to your Azure Functions app so that it only accepts requests from the specific public IP address xxx.xxx.xxx.xx, you should configure Access Restrictions (IP filtering) on the Azure Functions app.
Because your app runs on an Elastic Premium plan, it includes native support for networking features like access restrictions. This will block all other public traffic at the Azure App Service platform layer before it even reaches your function code.
Reference:
https://learn.microsoft.com/en-us/azure/azure-functions/functions-networking-options
質問 # 71
Drag and Drop Question
You have two Azure subscriptions named Sub1 and Sub2.
You have two groups named Group1 and Group2. Group1 only has access to Sub1 and Group2 only has access to Sub2.
Sub1 contains a Recovery Services vault named RSVault1 that stores virtual machine backups.
RSVault1 is managed by using Group1.
You need to ensure that modifying the backup settings of RSVault1 requires approval from an approver in Group2.
What should you configure for each subscription? To answer, drag the appropriate features to the correct subscriptions. Each feature may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
正解：
解説：
Explanation:
Box 1: Multi-User Authorization (MUA)
Sub1 (where Group1 and the Vault reside):
Enable Multi-User Authorization (MUA) on the Recovery Services vault.
Associate the vault with the Resource Guard located in Sub2.
Box 2: Resource Guard
Sub2 (where Group2 has access):
Deploy the Azure Resource Guard here.
Assign the Resource Guard Reader and Resource Guard Contributor (or a custom role with authorize actions) roles to Group2 over this Resource Guard.
Reference:
https://learn.microsoft.com/en-us/azure/backup/multi-user-authorization
質問 # 72
You need to configure the AKS1 and ID 1 managed identities to meet the technical requirements. The solution must follow the principle of least privilege.
Which role should you assign to each identity? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
正解：
解説：
Explanation:
AKS1: AcrPull; ID1: Contributor
AKS1 needs to pull images from Azure Container Registry, so AcrPull is the least-privilege registry role for the cluster identity. ID1 requires Contributor in the visible answer area because the referenced technical requirement requires resource changes beyond a read-only or pull-only role. The important distinction is scope: AKS image retrieval should not receive Contributor, while the separate managed identity receives the broader role only for its implementation task. This domain is tested through precise scope control: tenant, subscription, resource, application, and data-plane authorization are not interchangeable. The correct choice applies the smallest identity or governance control that enforces the stated requirement. Options that only add users, create registrations, or provide broad administrator access fail because they do not directly enforce the requested access behavior. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > AKS and managed identities; Microsoft Learn > ACR pull role and Azure RBAC.
Category Breakdown
Category Number of Questions
Manage identity, access, and governance 40
Manage and monitor security posture 30
Secure compute 31
Secure storage, databases, and networking 34
TOTAL 135
Exam Topic Breakdown
Exam Topic Number of Questions
質問 # 73
You have an Azure subscription named Sub1 that contains a resource group named RG1.
RG1 contains a virtual network named VNet1 and a storage account named storage1. Several engineers are assigned the Owner role for Sub1.
You need to prevent updates to and deletions from VNet1. The solution must ensure that engineers can continue updating other resources in RG1.
Which lock should you apply?
正解：A
解説：
Apply a Read-only lock directly to VNet1 . Azure management locks operate independently of Azure RBAC and override permissions such as Owner. A ReadOnly lock prevents authorized users from both updating and deleting the locked resource, which exactly satisfies the protection requirement for VNet1. Microsoft documents that a ReadOnly lock effectively restricts authorized users to read operations for the locked resource.
The lock must be scoped specifically to VNet1 , not RG1. Locks applied at a parent scope are inherited by child resources. Therefore, applying ReadOnly to RG1 would also prevent modifications to storage1 and other resources in RG1, violating the requirement that engineers must remain able to update those resources.
A Delete lock is insufficient because CanNotDelete permits users to modify a resource while preventing only deletion. The question explicitly requires preventing updates and deletions , so ReadOnly is necessary.
This aligns with the SC-500 governance objective covering enforcement of security controls for Azure resources. The current study guide places governance and security-control enforcement under Manage identity, access, and governance .
質問 # 74
A company stores confidential training data used by machine learning models. Administrators need to ensure that encryption keys remain under organizational control rather than being fully managed by Microsoft. Which option should be selected?
正解：A
解説：
Customer-managed keys allow organizations to control key lifecycle management, rotation, and revocation using Azure Key Vault or Managed HSM. This provides additional control over encryption compared to platform-managed keys. Shared Access Signatures govern access permissions and do not manage encryption ownership.
質問 # 75
......
Microsoft試験問題は専門家によって編集され、認定された担当者によって承認され、さまざまな機能を強化するため、SC-500テストトレントを便利かつ効率的に学習できます。購入前に無料ダウンロードと試用を提供しています。 SC-500試験の問題では、学生がシミュレーション問題を提供するプラットフォームで20〜30時間練習する必要があり、Implementing End-to-End Security Controls for Cloud and AI WorkloadsのSC-500試験に合格する自信を持たせることができます。 SC-500試験に合格して目標を達成するための最良のツールでなければなりません。
SC-500試験関連情報: https://www.japancert.com/SC-500.html