Free demo are available for SC-500 study materials for you to have a try before purchasing, which will help you have a deeper understanding of what you are going to buy. You can find the free demo for SC-500 exam braindumps in our website. If you are quite satisfied with the free demo, and want the complete version, just add it to the cart and pay for it. You will get the downloading link and password for the SC-500 Study Materials within ten minutes, if you don’t receive, you can ask for help from our service stuff.
| Section | Weight | Objectives |
|---|---|---|
| Secure storage, databases, and networking | 25–30% | - Database security
|
| Secure compute | 20–25% | - Servers and virtual machines
|
| Manage and monitor security posture | 20–25% | - Microsoft Sentinel
|
| Manage identity, access, and governance | 20–25% | - Secure secrets and keys using Azure Key Vault
|
All questions in our Microsoft SC-500 pass guide are at here to help you prepare for the certification exam. We have developed our learning materials with accurate Microsoft SC-500 exam answers and detailed explanations to ensure you pass test in your first try. Our PDF files are printable that you can share your Microsoft SC-500 free demo with your friends and classmates.
NEW QUESTION # 126
You plan to create on Azure app service web app named WebApp2 that will have the following configurations:
* Region: East US
* VNet integration: Enabled
* Scale out Autoscale to up to 10 instances
For each of the following statements, select Yes if the statement is true. Otherwise, select No, NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Explanation:
Statement
Answer
WebApp2 can be integrated with Subnet11.
No
WebApp2 can be integrated with Subnet12.
Yes
WebApp2 can be integrated with Subnet21.
No
The uploaded document omits the two subnet-definition tables from this question, so I cross-checked the complete question context before validating the selections. In that full scenario, Subnet11 isn ' t an eligible unused integration subnet, Subnet12 is an available subnet in East US with sufficient address space, and Subnet21 doesn ' t satisfy the integration requirements . ExamTopics Microsoft ' s current App Service documentation confirms the governing rules. Regional VNet integration requires the web app and virtual network to be in the same Azure region . The integration subnet must also be an appropriate dedicated/available IPv4 subnet. Microsoft currently specifies /28 as the smallest supported pre-existing subnet, while recommending larger address spaces-typically /26-to support scale operations and future growth. Microsoft Learn Scaling matters because each App Service instance consumes an address from the integration subnet, and additional addresses can be temporarily required during scale operations. The Subnet12 configuration in the full question satisfies the relevant capacity and regional requirements.
NEW QUESTION # 127
Drag and Drop Question
You have an Azure virtual network named VNet1 that contains three subnets named Subnet1, Subnet2, and Subnet3. A single network security group (NSG) named NSG1 is associated with all the subnets. You have the following virtual machines:
- VM1 on Subnet1
- VM2 on Subnet2
- VM3 on Subnet3
You create two application security groups named ASG1 and ASG2. VM2 is a member of ASG1, and VM3 is a member of ASG2.
You need to ensure that only VM2 can connect to VM3. The solution must continue to work if the private IP address of VM2 changes.
How should you configure the inbound rule on NSG1? To answer, drag the settings to the correct configurations. Each setting may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
NEW QUESTION # 128
Case Study 2 - Fabrikam, Inc.
Overview
Fabrikam, Inc. is a consulting company. The company has a main office in New York City and branch offices in Amsterdam and Singapore.
Existing Environment. Network environment
The on-premises network contains a datacenter in each office.
Existing Environment. Cloud environment
Fabrikam has two Azure subscriptions named Sub1 and Sub2 and a Microsoft 365 subscription that includes Microsoft 365 E5 licenses.
All the subscriptions are linked to a Microsoft Entra tenant named fabrikam.com that contains the identities shown in the following table.
The tenant contains the groups shown in the following table.
All devices are enrolled in Microsoft Intune.
Existing Environment. Sub1 Resources
Sub1 contains a resource group named RG1 that contains the resources shown in the following table.
SQLServer1 uses Microsoft SQL Server authentication.
Sub1 has an Azure Web Application Firewall (WAF) named WAF1 that has the following types of rule sets:
- Bot Manager 1.1
- Azure-managed Default Rule Set (DRS)
Sub1 has the following compliance standards assigned in Microsoft Defender for Cloud:
- NIST SP 800-53 Rev. 4
- Microsoft cloud security benchmark (MCSB)
- System and Organization Controls (SOC) 2 Type 2
Existing Environment. Sub2 Resources
Sub2 contains a resource group named RG2.
Planned Changes and Requirements. Planned Changes
Fabrikam plans to implement the following changes:
- Deploy the following key vaults to RG1:
AKV2 in the West Europe Azure region
AKV3 in the Central US Azure region
AKV4 in the East US Azure region
- Deploy the following key vaults to RG2:
AKV5 in the East US region
- Configure VM1 to read data from storage1.
- Create function apps that have the following hosting plans:
Fa1: Flex Consumption hosting plan
Fa2: Consumption hosting plan
Fa3: Dedicated hosting plan
- For WAF1, implement rate limiting rules based on the request
location.
- Enable the NIST SP 800-53 Rev. 5 compliance standard in Defender for
Cloud.
- Create a new storage account named storage2 that supports Azure Table storage.
- Enforce multifactor authentication (MFA) when database administrators access SQLdb1.
- Implement ExpressRoute circuits to the on-premises network as shown
in the following table.
- For RG1, create a new Privileged Identity Management (PIM) eligible role assignment that assigns the Contributor role to supported groups.
Planned Changes and Requirements. Technical Requirements
Fabrikam has the following technical requirements:
- If VM1 is deleted, the permissions for VM1 must be removed
automatically.
- The AKS1 managed identity must only be able to pull images from
Registry1.
- The ID1 managed identity must be able to push images to and pull
images from Registry1.
- All the data in the storage accounts must be encrypted by using
Fabrikam-managed keys.
- All outbound traffic from the function apps to the on-premises
network must use ExpressRoute circuits.
- ExpressRoute connectivity between the on-premises network and the
Azure environment must be encrypted by using Layer 2 or Layer 3
encryption.
You need to implement the function apps to meet the technical requirements. Which apps should you include in the implementation?
Answer: B
Explanation:
Flex Consumption and Dedicated hosting plans support outbound virtual network integration, which enables function app traffic to reach on-premises resources across ExpressRoute connections. The Consumption hosting plan does not support virtual network integration and therefore cannot meet the outbound routing requirement. For Flex Consumption, all traffic is routed through the integrated virtual network; for Dedicated hosting, outbound routing through the virtual network can be enabled to use the ExpressRoute path.
Reference:
https://learn.microsoft.com/en-us/azure/azure-functions/functions-networking-options?tabs=azure-portal&pivots=flex-consumption-plan
NEW QUESTION # 129
Hotspot Question
You have an Azure subscription that contains an Azure Database for PostgreSQL instance named DB1.
You plan to protect DB1 by using Microsoft Defender for Cloud.
You need to configure Defender for Cloud to detect anomalous activities and database exploitations for DB1. The solution must NOT affect any other databases.
What should you enable? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Explanation:
Box 1: At the individual database level
The database protection must be applied at the individual database level (specifically, at the individual database server level).
The requirement specifies that the configuration must not affect other databases.
Individual Database Level: Microsoft Defender for Cloud allows you to navigate directly to the specific Azure Database for PostgreSQL server, expand its Security menu, and enable Microsoft Defender for Cloud specifically for that single resource. This completely isolates the configuration to this instance.
Box 2: Microsoft Defender for Open-Source Relational Databases
The most appropriate plan is Microsoft Defender for Open-Source Relational Databases (which operates under the broader Microsoft Defender for Databases bundle).
Reference:
https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-sql-introduction
NEW QUESTION # 130
You have a Microsoft Entra tenant that uses Microsoft Entra Agent ID.
You have multiple Microsoft Foundry agents that have agent identities assigned.
You discover that one of the identities is flagged as high risk due to unusual sign-in activity.
You need to ensure that agent access to resources is restricted automatically based on risk.
What should you create?
Answer: D
Explanation:
Create a Conditional Access policy that targets the agent identities and evaluates agent risk. Microsoft Entra Conditional Access now supports agent identities as a dedicated policy target and can use risk signals from Microsoft Entra ID Protection to automatically block high-risk agents from accessing organizational resources. Microsoft explicitly documents a policy pattern for blocking high-risk agent identities by selecting Agents under the identity scope, targeting all relevant resources, and configuring the Agent risk condition to High. Microsoft Learn For agent identities, the available enforcement action is effectively Block access, because autonomous agents cannot satisfy interactive remediation controls such as MFA. Microsoft also recommends dedicated agent- specific Conditional Access policies rather than relying on policies designed for human users. Microsoft Learn A Microsoft Entra role assignment policy controls role governance rather than runtime resource access based on risk. A PIM activation policy governs privileged-role activation and is not designed to react automatically to agent sign-in risk. An Access Review periodically evaluates whether identities should retain access, but it does not provide immediate risk-based enforcement.
Therefore, the correct automated control is:
Correct answer: A. a Conditional Access policy for the identities
NEW QUESTION # 131
......
Are you an aspiring Microsoft professional looking to pass the Implementing End-to-End Security Controls for Cloud and AI Workloads (SC-500) exam? Look no further than our platform for real SC-500 exam dumps. Many candidates struggle to find reliable study materials, leading them to prepare with outdated material and ultimately waste their resources. But with our platform, you can access updated Microsoft SC-500 Practice Questions and pass the certification test on your first try. Don't let a lack of credible study materials hold you back - trust our platform to help you achieve your career goals.
SC-500 Pdf Free: https://www.testpdf.com/SC-500-exam-braindumps.html