我々のSC-500問題集はPDF版、ソフト版とオンライン版を含めて、認証試験のすべての問題を全面的に含めています。このSC-500問題集の正確率は100％になっています。SC-500試験を準備しているあなたは無料のサンプルをダウンロードして利用して、あなたはこのふさわしいSC-500問題集を発見することができます。
| Section | Weight | Objectives |
|---|---|---|
| Topic 1: Secure compute | 20-25% | - Implement security for servers and virtual machines (VMs) - Implement security for application platform services - Implement security for AI workloads |
| Topic 2: Secure storage, databases, and networking | 25-30% | - Implement security for Azure network services - Implement security for databases - Implement security for storage accounts |
| Topic 3: Manage identity, access, and governance | 20-25% | - Secure secrets and keys using Azure Key Vault - Secure access to resources using Microsoft Entra ID - Implement governance with Azure Policy and Defender for Cloud |
| Topic 4: Manage and monitor security posture | 20-25% | - Manage security posture using Microsoft Defender for Cloud - Implement Microsoft Security Copilot configuration - Implement activity and event collection in Microsoft Sentinel |
高収入をもたらす良い仕事を見つけたいですか？あなたは優秀な才能になりたいですか？ SC-500認定は、あなたが望む夢を実現するのに役立ちます。なぜなら、MicrosoftのSC-500テスト準備は、仕事を探しているときに明らかな利点があることを証明でき、仕事を非常にうまく処理できるからです。そのため、SC-500試験の準備は、SC-500試験に合格して良い仕事を見つけるのに役立ちます。何を待っていますか？ SC-500試験問題を購入してください。
質問 # 38
You have an Azure subscription that contains the virtual machines shown in the following table.
You need to enable file integrity monitoring in Microsoft Defender for Cloud. Which computers will support file integrity monitoring?
正解：D
質問 # 39
You have an Azure subscription.
You need to create and deploy an Azure policy that meets the following requirements:
*When a new virtual machine is deployed, automatically install a custom security extension.
*Trigger an autogenerated remediation task for non-compliant virtual machines to install the extension.
What should you include in the policy? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
正解：
解説：
Explanation:
Definition effect: DeployIfNotExists; For remediation: a managed identity that has the Contributor role DeployIfNotExists is the Azure Policy effect used when a noncompliant resource should trigger deployment of a related configuration, such as a VM extension. Remediation tasks require a managed identity that has the role permissions needed to deploy the extension. Audit or Deny would only report or block resources. The managed identity is essential because Azure Policy performs the deployment on behalf of the assignment.
This answer also follows operational scalability. Microsoft security architecture favors policy-driven deployment, agentless assessment, managed identities, and Defender workload plans where possible. Those mechanisms reduce manual configuration while keeping enforcement tied to the resource type, which is why the selected choice is stronger than manual or after-the-fact alternatives. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > Azure Policy built-in and custom definitions; Microsoft Learn > deployIfNotExists and remediation.
質問 # 40
You need to configure the AKS1 and ID 1 managed identities to meet the technical requirements. The solution must follow the principle of least privilege.
Which role should you assign to each identity? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
正解：
解説：
Explanation:
AKS1: AcrPull; ID1: Contributor
AKS1 needs to pull images from Azure Container Registry, so AcrPull is the least-privilege registry role for the cluster identity. ID1 requires Contributor in the visible answer area because the referenced technical requirement requires resource changes beyond a read-only or pull-only role. The important distinction is scope: AKS image retrieval should not receive Contributor, while the separate managed identity receives the broader role only for its implementation task. This domain is tested through precise scope control: tenant, subscription, resource, application, and data-plane authorization are not interchangeable. The correct choice applies the smallest identity or governance control that enforces the stated requirement. Options that only add users, create registrations, or provide broad administrator access fail because they do not directly enforce the requested access behavior. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > AKS and managed identities; Microsoft Learn > ACR pull role and Azure RBAC.
質問 # 41
Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem.
After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.
You have a Microsoft Sentinel workspace.
You have a multi-tier Security Operations Center (SOC) team.
You need to ensure that all new security incidents are assigned immediately to the Tier 1 analysts group and flagged for triage.
Solution: You create a hunting query.
Does this meet the goal?
正解：A
解説：
A hunting query is used to investigate threats and identify suspicious activity; it does not automatically assign newly created incidents or flag them for triage. An automation rule triggered when an incident is created is required to assign incidents to the Tier 1 analysts group and apply a triage tag or task automatically.
Reference:
https://learn.microsoft.com/en-us/azure/sentinel/create-manage-use-automation-rules?tabs=defender-portal%2Conboarded
質問 # 42
You have a Microsoft Entra tenant that has user consent for applications disabled.
You register an application named App1 that requests the following Microsoft Graph delegated permissions:
*user.Read
*Mail.Read
You need to configure tenant permissions to meet the following requirements:
*Enable users to grant consent for low-risk permissions without administrator interaction.
*Ensure that applications requesting higher-privilege permissions require administrator approval.
What should you do?
正解：C
解説：
An app consent policy allows the tenant to define which delegated permissions are considered low risk and may be consented to by users. Higher-privilege permissions can remain subject to admin consent. Tenant- wide admin consent would approve App1 broadly rather than creating an ongoing policy boundary.
Application assignments and PIM role assignments control user access or privileged roles, not delegated permission consent behavior. This domain is tested through precise scope control: tenant, subscription, resource, application, and data-plane authorization are not interchangeable. The correct choice applies the smallest identity or governance control that enforces the stated requirement. Options that only add users, create registrations, or provide broad administrator access fail because they do not directly enforce the requested access behavior. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > app consent settings; Microsoft Learn > app consent policies.
質問 # 43
......
より良い生活を送るには、自分の能力を向上する必要があります。SC-500試験に参加することはひとつの方法です。SC-500学習教材を買うと、その教材の高品質に驚いています。SC-500学習教材の的中率が高いですので、多くの人はSC-500試験に合格しました。従って、より良い生活のために、早くSC-500学習教材を入手します。
SC-500日本語版トレーリング: https://www.certjuken.com/SC-500-exam.html