Wir alle wissen, dass die Microsoft SC-500 Zertifizierungsprüfung in der IT-Branche eine zentrale Position darstellt. Aber die Kernfrage ist, dass es schwer ist, ein Microsoft SC-500 Zertifikat zu erhalten. Wir wissen genau, dass im Internet relevanten Prüfungsmaterialien von guter Qualität fehlen. Die Examsfragen und Antworten von ZertSoft können allen an den Zertifizierungsprüfungen teilnehmenden Prüflingen irgendwann die notwendigen Informationen liefern. Wir versprechen Ihnen, dass Sie Ihre Microsoft SC-500 Zertifizierungsprüfung einmalig bestehen können.
| Section | Weight | Objectives |
|---|---|---|
| Manage and monitor security posture | 20–25% | - Secure AI workloads and solutions
|
| Manage identity, access, and governance | 20–25% | - Implement secure authentication and authorization
|
| Secure compute | 20–25% | - Secure application and workload identities
|
| Secure storage, databases, and networking | 25–30% | - Secure network infrastructure
|
Warum versprechen wir, dass wir Ihnen Geld zurückgeben, wenn Sie die Microsoft SC-500 Prüfung nicht bestehen? Denn zahlose Kunden, die unsere Prüfungssofteware benutzt haben, bestehen die Microsoft SC-500 Zertifizierungsprüfung, was uns die Konfidenz bringt. Microsoft SC-500 Prüfung ist eine sehr wichtige Beweis der IT-Fähigkeit für die Angestellte im IT-Gewerbe. Aber die Prüfung ist auch schwierig. Die Arbeiter von ZertSoft haben die Microsoft SC-500 Prüfungsunterlagen mit große Einsätze geforscht. Die Software ist das Geistesprodukt vieler IT-Spezialist.
34. Frage
Case Study 1 - Contoso, Ltd.
Overview
Contoso, Ltd. is a consulting company that has a main office in San Francisco and a branch office in Dallas.
Contoso has a hybrid environment that contains on-premises servers connected to Azure, a Microsoft 365 E5 subscription, and an Azure subscription named Sub1.
Existing Environment. Microsoft Entra tenant
Contoso has a Microsoft Entra tenant named contoso.com that contains the users shown in the following table.
Existing Environment. On-premises environment
The on-premises network contains an Active Directory Domain Services (AD DS) forest that syncs with contoso.com. The forest contains a server named Server1 that runs Windows Server.
Existing Environment. Azure subscription
Sub1 contains the storage accounts shown in the following table.
Sub1 contains the virtual networks shown in the following table.
Sub1 contains the virtual machines shown in the following table.
The network interface of VM1 is associated with an application security group named ASG1.
Sub1 contains the resources shown in the following table.
Vault1 stores the objects shown in the following table.
Existing Environment. Privileged Identity Management (PIM) configuration You manage privileged roles by using Privileged Identity Management (PIM). The PIM role settings are configured as shown in the following table.
Existing Environment. Microsoft Sentinel configuration
Contoso has a Microsoft Sentinel workspace that contains the following tables.
Requirements. Planned changes
Contoso plans to implement the following changes:
- Integrate AKS1 with Vault1.
- Enable Microsoft Entra Kerberos authentication for all supported
storage.
- Configure auditing for sql1 by using the Azure portal and store audit logs in a centralized location.
Requirements. Technical requirements
Contoso identifies the following technical requirements:
- Protect Server1 by using file integrity monitoring.
- Protect AKS1 by using Microsoft Defender for Cloud.
- Configure Microsoft Sentinel to retain data for the maximum supported duration without changing the tier.
- Store objects used for authentication and encryption in Vault1 and
ensure that Vault1 regenerates the objects every 30 days, whenever
possible.
You need to implement the planned change for the AKS1 integration.
What should you configure for AKS1?
Antwort: B
Begründung:
Scenario: Contoso plans to implement the following changes: Integrate AKS1 with Vault1.
Vault1 is an Azure Key vault.
AKS1 is an Azure Kubernetes Service (AKS) cluster.
To integrate an Azure Kubernetes Service (AKS) cluster with an Azure Key Vault, you must configure the Azure Key Vault Provider for Secrets Store CSI Driver add-on along with identity and authorization controls on the cluster.
Reference:
https://docs.azure.cn/en-us/aks/csi-secrets-store-driver
35. Frage
You have an Azure key vault named Vault1 that stores the resources shown in the following table.
Which resources support the creation of a rotation policy?
Antwort: F
36. Frage
You have an Azure subscription named Sub1. Sub1 contains 60 virtual machines that run either Window Server or Linux.
All the Windows Server virtual machines host line-of-business (LOB) applications and all the Linux virtual machines host backend databases.
You need to enable malware protection for the virtual machines.
Which Microsoft Defender for Cloud plan should you enable for each type of virtual machine? To answer, drag the appropriate plans to the correct virtual machine types. Each plan may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Antwort:
Begründung:
Explanation:
Virtual machine type
Plan
Windows Server
Microsoft Defender for Servers
Linux
Microsoft Defender for Servers
Microsoft Defender for Servers is the correct plan for both the Windows Server and Linux virtual machines because the requirement is to provide malware protection at the virtual-machine operating-system level .
Defender for Servers protects both Windows and Linux VMs and integrates with Microsoft Defender for Endpoint to provide endpoint protection, including antimalware capabilities. Microsoft states that Defender for Servers supports Windows and Linux virtual machines across Azure and other supported environments.
For Linux systems, Defender for Servers deploys the Defender for Endpoint component that includes antimalware functionality. For Windows Server, Defender Antivirus is integrated with Defender for Endpoint and provides malware protection. In addition, Defender for Servers Plan 2 supports agentless malware scanning , which scans VM disks for malicious files without installing an additional scanning agent.
The fact that the Linux machines host databases does not make Microsoft Defender for Databases the correct answer. Defender for Databases protects supported database workloads against database-specific threats; it does not replace VM-level malware protection.
The SC-500 study guide places onboarding and configuring VMs with Defender for Servers under the Secure compute objective.
37. Frage
You have three on-premises apps named App1, App2, and App3 that are configured in Microsoft Entra Private Access as shown in the following table.
You have the users shown in the following table.
The Global Secure Access client is deployed to all user devices.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Antwort:
Begründung:
Explanation:
Statement
Answer
User2 can connect to https://10.20.30.40.
No
User3 can connect to https://intranet.corp.contoso.com.
Yes
User1 can connect to https://intranet.corp.contoso.com:8443.
No
Microsoft Entra Private Access applies access at the application-segment level , and an application segment is defined by attributes including the destination FQDN or IP address and the destination port . Users must be assigned to the corresponding enterprise application to access its defined segments. Microsoft specifically documents that Private Access supports precise per-app segmentation using FQDNs, IP addresses, ports, and user/group assignments.
User2 = No. User2 is assigned only to App2, which permits 10.20.30.40 on port 8443 . https://10.20.30.40 without an explicit port uses HTTPS default TCP 443 , so it does not match App2 ' s segment.
User3 = Yes. User3 is assigned to App1, whose wildcard FQDN *.corp.contoso.com on port 443 matches intranet.corp.contoso.com. Microsoft supports wildcard FQDN segments such as *.contoso.com with explicitly configured ports.
User1 = No. Although intranet.corp.contoso.com matches App1 ' s wildcard FQDN, User1 is authorized only for port 443 . Specifying :8443 causes the connection to fall outside App1 ' s configured segment.
38. Frage
You have a Microsoft Defender External Attack Surface Management (Defender EASM) resource for a company named Contoso. Ltd.
You need to update the Defender EASM workflow to meet the following requirements:
*Assets from a business domain that Contoso no longer owns must be removed from inventory.
*Findings that do NOT apply to confirmed inventory must NOT affect reported counts.
What should you do for each requirement? To answer, drag the appropriate actions to the correct requirements. Each action may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Antwort:
Begründung:
Explanation:
Inventory cleanup: Remove the seed and remove the assets discovered by using that seed; Finding suppression: Mark the observations as non-applicable
When a seed domain is no longer owned, the clean inventory action is to remove the seed and remove assets discovered from that seed. Leaving those assets as dependencies or merely labeling them would keep stale assets in the inventory. For findings that do not apply to confirmed inventory, marking the observations as non-applicable prevents them from influencing finding counts while retaining the operational history needed for audit and review. For this domain, least privilege means granting only the required data operation or allowing only the required network flow. The correct response avoids shared keys, broad peering, general contributor roles, or log-only controls when the scenario demands prevention, routing, event triggering, or account-specific configuration. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege.
Official Microsoft source/topic: SC-500 Study Guide > Defender EASM; Microsoft Learn > inventory and observation state management.
39. Frage
......
Unser ZertSoft ist eine fachliche Website, die Prüfungsmaterialien für zahlreiche Microsoft SC-500 Zertifizierungsprüfung bieten. Unser ZertSoft wird vielen IT-Fachleuten zum Berufsaufstieg verhelfen. Die Kraft unserer Eliteteams ist unglaublich. Sie können die Microsoft SC-500 Examensübungen-und antworten teilweise als Probe umsonst herunterladen, so dass Sie die Glaubwürdigkeit vom ZertSoft testen können.
SC-500 Online Test: https://www.zertsoft.com/SC-500-pruefungsfragen.html