The SC-500 learning materials from our company are very convenient for all people, including the convenient buying process, the download way and the study process and so on. Upon completion of your payment on our SC-500 exam questions, you will receive the email from us in several minutes, and then you will have the right to use the SC-500 Test Guide from our company. In addition, there are three different versions for all people to choose: PDF, Soft and APP versions. According to your actual situation, you can choose the suitable version from our SC-500 study question.
| Section | Weight | Objectives |
|---|---|---|
| Secure storage, databases, and networking | 25-30% | - Implement security for Azure network services - Implement security for databases - Implement security for storage accounts |
| Manage and monitor security posture | 20-25% | - Implement activity and event collection in Microsoft Sentinel - Manage security posture using Microsoft Defender for Cloud - Implement Microsoft Security Copilot configuration |
| Manage identity, access, and governance | 20-25% | - Secure secrets and keys using Azure Key Vault - Secure access to resources using Microsoft Entra ID - Implement governance with Azure Policy and Defender for Cloud |
| Secure compute | 20-25% | - Implement security for AI workloads - Implement security for application platform services - Implement security for servers and virtual machines (VMs) |
With the development of information and communications technology, we are now living in a globalized world. SC-500 information technology learning is correspondingly popular all over the world. Modern technology has changed the way how we live and work. In current situation, enterprises and institutions require their candidates not only to have great education background, but also acquired professional SC-500 Certification. Considering that, it is no doubt that an appropriate certification would help candidates achieve higher salaries and get promotion.
NEW QUESTION # 105
You have an Azure subscription that contains a virtual network named VNet1.
VNet1 contains an Azure VPN gateway named Gateway1 that is configured for Point-to-Site (P2S) connections.
You have a Microsoft 365 E5 subscription.
You need to configure a VPN authentication method for Gateway1. The solution must enforce Conditional Access policies during VPN sign-ins.
Which authentication method should you configure?
Answer: D
Explanation:
To enforce Conditional Access policies during Point-to-Site (P2S) VPN sign-ins, you must configure Microsoft Entra ID authentication as the VPN authentication method.
Native Integration: Microsoft Entra ID is the only authentication method for Azure VPN Gateway that natively integrates with Microsoft Entra Conditional Access policies.
Policy Enforcement: When users log in, Microsoft Entra ID evaluates your Conditional Access rules (such as requiring Multi-Factor Authentication, checking device compliance, or restricting login locations) before granting the VPN connection.
Protocol Support: This method uses the OpenVPN protocol and requires users to sign in using the Azure VPN Client.
Reference:
https://learn.microsoft.com/en-us/azure/vpn-gateway/openvpn-azure-ad-tenant
NEW QUESTION # 106
Drag and Drop Question
You have three internet-facing Azure App Service web apps named App1, App2, and App3. Each app uses built-in authentication. App2 hosts a backend API.
Some corporate users can sign in to App2, even though they should NOT be able to use the API.
You need to restrict App2 access to assigned Microsoft Entra users and groups.
What should you configure for App2? To answer, drag the appropriate configurations to the correct methods. Each configuration may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
NEW QUESTION # 107
Drag and Drop Question
You have an Azure subscription named Sub1 that contains an Azure SQL Database logical server named Server1.
Server1 contains a database named DB1.
Microsoft Defender for Cloud security alerts are being generated for Sub1.
You plan to improve investigation capabilities when Microsoft Defender for SQL raises Advanced Threat Protection alerts.
You need to ensure that the Advanced Threat Protection investigations have the audit records of DB1. The solution must include the recommended audit action groups.
How should you configure database auditing for Server1? To answer, drag the appropriate action groups to the correct requirements. Each action group may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Explanation:
Box 1: SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP
To audit successful logins when configuring database auditing for an Azure SQL Database logical server, you should use the SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP action group.
Box 2: FAILED_DATABASE_AUTHENTICATION_GROUP
To audit failed login attempts for an Azure SQL Database logical server, you must use the FAILED_DATABASE_AUTHENTICATION_GROUP audit action group.
Reference:
https://learn.microsoft.com/en-us/azure/azure-sql/database/auditing-setup
NEW QUESTION # 108
Case Study 2 - Fabrikam, Inc.
Overview
Fabrikam, Inc. is a consulting company. The company has a main office in New York City and branch offices in Amsterdam and Singapore.
Existing Environment. Network environment
The on-premises network contains a datacenter in each office.
Existing Environment. Cloud environment
Fabrikam has two Azure subscriptions named Sub1 and Sub2 and a Microsoft 365 subscription that includes Microsoft 365 E5 licenses.
All the subscriptions are linked to a Microsoft Entra tenant named fabrikam.com that contains the identities shown in the following table.
The tenant contains the groups shown in the following table.
All devices are enrolled in Microsoft Intune.
Existing Environment. Sub1 Resources
Sub1 contains a resource group named RG1 that contains the resources shown in the following table.
SQLServer1 uses Microsoft SQL Server authentication.
Sub1 has an Azure Web Application Firewall (WAF) named WAF1 that has the following types of rule sets:
- Bot Manager 1.1
- Azure-managed Default Rule Set (DRS)
Sub1 has the following compliance standards assigned in Microsoft Defender for Cloud:
- NIST SP 800-53 Rev. 4
- Microsoft cloud security benchmark (MCSB)
- System and Organization Controls (SOC) 2 Type 2
Existing Environment. Sub2 Resources
Sub2 contains a resource group named RG2.
Planned Changes and Requirements. Planned Changes
Fabrikam plans to implement the following changes:
- Deploy the following key vaults to RG1:
AKV2 in the West Europe Azure region
AKV3 in the Central US Azure region
AKV4 in the East US Azure region
- Deploy the following key vaults to RG2:
AKV5 in the East US region
- Configure VM1 to read data from storage1.
- Create function apps that have the following hosting plans:
Fa1: Flex Consumption hosting plan
Fa2: Consumption hosting plan
Fa3: Dedicated hosting plan
- For WAF1, implement rate limiting rules based on the request
location.
- Enable the NIST SP 800-53 Rev. 5 compliance standard in Defender for
Cloud.
- Create a new storage account named storage2 that supports Azure Table storage.
- Enforce multifactor authentication (MFA) when database administrators access SQLdb1.
- Implement ExpressRoute circuits to the on-premises network as shown
in the following table.
- For RG1, create a new Privileged Identity Management (PIM) eligible role assignment that assigns the Contributor role to supported groups.
Planned Changes and Requirements. Technical Requirements
Fabrikam has the following technical requirements:
- If VM1 is deleted, the permissions for VM1 must be removed
automatically.
- The AKS1 managed identity must only be able to pull images from
Registry1.
- The ID1 managed identity must be able to push images to and pull
images from Registry1.
- All the data in the storage accounts must be encrypted by using
Fabrikam-managed keys.
- All outbound traffic from the function apps to the on-premises
network must use ExpressRoute circuits.
- ExpressRoute connectivity between the on-premises network and the
Azure environment must be encrypted by using Layer 2 or Layer 3
encryption.
You implement the planned changes for the key vaults. To which key vaults can you restore AKV1 backups?
Answer: E
Explanation:
You can restore AKV1 backups to AKV4 and AKV5.Azure Key Vault backups are bound to the subscription and the Azure geography of the source. Because both the source (AKV1) and targets (AKV4, AKV5) reside in the same East US region/geography, they share the same security world, making the restoration valid.
Other regions in different geographies (like West Europe) or different security worlds (like Central US) are excluded.
Scenario:
AKV1 is an Azure key vault in east us.
Fabrikam plans to implement the following changes:
Deploy the following key vaults to RG1:
- AKV2 in the West Europe Azure region
- AKV3 in the Central US Azure region
- AKV4 in the East US Azure region
Deploy the following key vaults to RG2:
- AKV5 in the East US region
Reference:
https://learn.microsoft.com/en-us/azure/key-vault/general/overview-security-worlds
NEW QUESTION # 109
You have an Azure subscription named Sub1 that contains a storage account named storage1.
Sub1 has Microsoft Defender for Storage enabled. Defender for Storage has malware scanning enabled.
You need to configure a solution that automates the remediation of malware detected in storage1.
What should you include in the solution?
Answer: D
Explanation:
An Azure Logic Apps workflow is needed to automate the remediation of malware detected by Microsoft Defender for Storage.
Microsoft Defender for Storage triggers security alerts when malware is detected. To automatically remediate the threat (such as deleting or moving the malicious file), you need an automation engine that can execute workflows. Azure Logic Apps natively integrates with Microsoft Defender for Cloud to trigger actions based on these alerts.
Reference:
https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-storage-configure-malware-scan
NEW QUESTION # 110
......
With the increasing marketization, the SC-500 study guide experience marketing has been praised by the consumer market. Attract users interested in product marketing to know just the first step, the most important is to be designed to allow the user to try before buying the SC-500 study training materials, so we provide free pre-sale experience to help users to better understand our SC-500 Exam Questions. The user only needs to submit his E-mail address and apply for free trial online, and our system will soon send free demonstration research materials of SC-500 latest questions to download.
SC-500 Exam Overviews: https://www.validdumps.top/SC-500-exam-torrent.html