Our SC-500 study materials are very popular in the international market and enjoy wide praise by the people in and outside the circle. We have shaped our SC-500 exam questions into a famous and top-ranking brand and we enjoy well-deserved reputation among the clients. Our SC-500 learning guide boosts many outstanding and superior advantages which other same kinds of exam materials don’t have. And we are very reliable in every aspect no matter on the quality or the according service.
| Section | Weight | Objectives |
|---|---|---|
| Manage and monitor security posture | 20–25% | - Security Copilot
|
| Manage identity, access, and governance | 20–25% | - Secure access to resources by using Microsoft Entra ID
|
| Secure storage, databases, and networking | 25–30% | - Database security
|
| Secure compute | 20–25% | - Security for AI workloads
|
Customers always attach great importance to the quality of SC-500 exam torrent. We can guarantee that our study materials deserve your trustee. We have built good reputation in the market now. After about ten years’ development, we have owned a perfect quality control system. All SC-500 exam prep has been inspected strictly before we sell to our customers. Generally, they are very satisfied with our SC-500 Exam Torrent. Also, some people will write good review guidance for reference. Maybe it is useful for your preparation of the SC-500 exam. In addition, you also can think carefully which kind of study materials suit you best. If someone leaves their phone number or email address in the comments area, you can contact them directly to get some useful suggestions.
NEW QUESTION # 46
You need to configure the AKS1 and ID1 managed identities to meet the technical requirements. The solution must follow the principle of least privilege.
Which role should you assign to each identity? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Explanation:
For AKS1, assign the AcrPull role on Registry1. AcrPull provides the permissions required to download container images from an Azure Container Registry without granting permissions to push, modify, or delete images. Microsoft documents that when AKS is integrated with an Azure Container Registry, the appropriate pull-only role is assigned to the AKS identity used for image pulls. This satisfies the explicit requirement that AKS1 must only be able to pull images and follows least privilege. Microsoft Learn For ID1, assign AcrPush. Microsoft defines AcrPush as the built-in Azure RBAC role for identities that require both push and pull permissions on a non-ABAC-enabled Azure Container Registry. It therefore allows ID1 to upload container images and retrieve existing images from Registry1 without granting broad resource- management capabilities such as Contributor or Owner. Microsoft Learn Contributor and Owner would grant substantially more Azure management permissions than required. Reader does not provide container image pull/push data-plane permissions.
NEW QUESTION # 47
Drag and Drop Question
You have an Azure virtual network named VNet1 that contains an AzureBastionSubnet. VNet1 contains a subnet named Subnet1. Subnet1 contains multiple virtual machines.
You plan to deploy Azure Bastion to provide secure RDP access to the virtual machines on Subnet1. You associate a network security group (NSG) named NSG1 to AzureBastionSubnet.
You need to configure rules for NSG1. The solution must meet the following requirements:
- Allow required inbound access to Azure Bastion from the internet.
- Allow user access to the virtual machines by using Azure Bastion.
Which TCP ports should you allow for the NSG1 rules? To answer, drag the appropriate ports to the correct rules. Each port may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
NEW QUESTION # 48
You have a Microsoft Entra tenant that contains a user named User1.
You have an Azure Arc-enabled server named SRV1 that runs Windows Server. SRV1 is configured for Microsoft Entra sign-in.
User1 reports that when they use their Microsoft Entra credentials to sign in to SRV1 over RDP, they receive the following message:
"Your account is configured to prevent you from using this device."
You need to ensure that User1 can sign in to SRV1 over RDP. The solution must follow the principle of least privilege.
What should you do?
Answer: C
Explanation:
Assign Virtual Machine User Login to User1. Microsoft Entra authentication for supported Azure Arc- enabled Windows servers uses Azure RBAC to authorize RDP sign-in. Microsoft specifies two relevant roles:
Virtual Machine Administrator Login , which provides administrator privileges, and Virtual Machine User Login , which provides standard user privileges. Because the requirement is only for User1 to sign in and explicitly requires least privilege , Virtual Machine User Login is the correct role.
Assigning Virtual Machine Administrator Login would also permit access, but it unnecessarily grants local administrative privileges and therefore violates least privilege. Adding User1 manually to the local Remote Desktop Users group is not the correct authorization model for Microsoft Entra-based Arc sign-in. Microsoft specifically requires the appropriate Azure login role and documents that manual local-group elevation is not the supported mechanism for authorizing Microsoft Entra sign-in.
A Conditional Access policy requiring MFA can impose an additional authentication condition, but it does not provide the underlying authorization required to log on to SRV1.
The SC-500 study guide places extending security controls to hybrid servers by using Azure Arc within the Secure compute domain.
NEW QUESTION # 49
You have a Microsoft Copilot Studio agent.
A Microsoft Power Platform administrator configures external threat detection for the agent by using a Microsoft Entra application.
You need to ensure that real-time protection is enabled during agent runtime.
What should you do in the Microsoft Defender portal?
Answer: C
Explanation:
For external threat detection and real-time agent protection to work, Defender must receive app activity through the Microsoft 365 app connector. Session policies in Defender for Cloud Apps govern user sessions, Global Secure Access controls network access, and a Sentinel connector is for log ingestion and investigation.
The Microsoft 365 app connector is the required Defender portal-side integration for this runtime protection scenario. For SC-500, compute controls are evaluated by workload type: VM, Arc server, AKS, container registry, container group, Functions, Logic Apps, App Service, and AI agent runtime. The right answer uses the Microsoft control that is native to that workload. Broad Azure roles or unrelated monitoring services would either overgrant access or fail to enforce the required security state. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > AI workload runtime protection; Microsoft Learn > Microsoft 365 app connector and Copilot agent protection.
NEW QUESTION # 50
You have an Azure subscription that contains the virtual machines shown in the following table.
All the virtual networks are peered. You deploy Azure Bastion Basic SKU to VNET2. Which virtual machines can be protected by the bastion host?
Answer: A
Explanation:
Azure Bastion Basic SKU supports connections to virtual machines in both the Bastion host ' s own virtual network and peered virtual networks . Microsoft specifically lists virtual network peering support for Basic, Standard, and Premium Bastion SKUs. Therefore, a Bastion host deployed in VNET2 can connect directly to VM2 and can also reach machines in VNET1 and VNET3 through the existing peering relationships. Microsoft Learn The fact that VNET1 is located in East US while VNET2 is in West US does not prevent this architecture.
Azure Bastion supports both ordinary VNet peering within a region and global virtual network peering across Azure regions . Microsoft explicitly documents that one Bastion deployment can provide RDP or SSH connectivity to virtual machines located in peered VNets, including globally peered networks. Microsoft Learn Consequently:
* VM2 is reachable because it resides directly in VNET2.
* VM1 and VM3 are reachable through the peering between VNET2 and VNET1.
* VM4 is reachable through the peering between VNET2 and VNET3.
The VMs do not need individual public IP addresses because Bastion connects to them through their private network interfaces.
Therefore, the Bastion host can protect all four virtual machines .
NEW QUESTION # 51
......
As we all know, sometimes the right choice can avoid the waste of time, getting twice the result with half the effort. Especially for SC-500 preparation materials, only by finding the right ones can you reduce the pressure and help yourself to succeed. If you haven't found the right materials yet, please don't worry. Maybe our SC-500 Practice Engine can give you a leg up which is our company's flagship product designed for the SC-500 exam.
Latest Test SC-500 Discount: https://www.examboosts.com/Microsoft/SC-500-practice-exam-dumps.html