The Microsoft SC-500 exam is necessary for you if you want to improve your professional career. Microsoft SC-500 exam questions changes from time to time so, it is important to check for updates regularly otherwise you can miss an important thing in the middle of your Microsoft SC-500 Questions preparation. After the purchase, you will get SC-500 dumps' latest updates for up to 90 days as soon as they are available. If the ExamPrepAway introduces new updates to SC-500 study material within 90 days of your purchase then you will get them free of cost.
| Section | Weight | Objectives |
|---|---|---|
| Secure compute | 20–25% | - Security for AI workloads
|
| Manage and monitor security posture | 20–25% | - Microsoft Defender for Cloud
|
| Secure storage, databases, and networking | 25–30% | - Storage security
|
| Manage identity, access, and governance | 20–25% | - Secure access to resources by using Microsoft Entra ID
|
Usually, the questions of the real exam are almost the same with our SC-500 exam questions. So you just need to memorize our correct questions and answers of the SC-500 study materials. You absolutely can pass the exam. Also, we will offer good service to add you choose the most suitable SC-500 Practice Braindumps since we have three different versions of every exam product. And you can free download the demos of the SC-500 learning quiz.
NEW QUESTION # 216
You have an Azure virtual network named VNet1 that contains a subnet named Subnet! A network security group named NSG1 is associated with Subnet1.
Vou have a storage account named storage1.
You need to ensure that access from Subnet1 to storage! uses a private IP address in Subnet1 and ran be filtered by NSG1 Public network access to storage1 must be disabled.
What should you create?
Answer: B
NEW QUESTION # 217
Case Study 2 - Fabrikam, Inc.
Overview
Fabrikam, Inc. is a consulting company. The company has a main office in New York City and branch offices in Amsterdam and Singapore.
Existing Environment. Network environment
The on-premises network contains a datacenter in each office.
Existing Environment. Cloud environment
Fabrikam has two Azure subscriptions named Sub1 and Sub2 and a Microsoft 365 subscription that includes Microsoft 365 E5 licenses.
All the subscriptions are linked to a Microsoft Entra tenant named fabrikam.com that contains the identities shown in the following table.
The tenant contains the groups shown in the following table.
All devices are enrolled in Microsoft Intune.
Existing Environment. Sub1 Resources
Sub1 contains a resource group named RG1 that contains the resources shown in the following table.
SQLServer1 uses Microsoft SQL Server authentication.
Sub1 has an Azure Web Application Firewall (WAF) named WAF1 that has the following types of rule sets:
- Bot Manager 1.1
- Azure-managed Default Rule Set (DRS)
Sub1 has the following compliance standards assigned in Microsoft Defender for Cloud:
- NIST SP 800-53 Rev. 4
- Microsoft cloud security benchmark (MCSB)
- System and Organization Controls (SOC) 2 Type 2
Existing Environment. Sub2 Resources
Sub2 contains a resource group named RG2.
Planned Changes and Requirements. Planned Changes
Fabrikam plans to implement the following changes:
- Deploy the following key vaults to RG1:
AKV2 in the West Europe Azure region
AKV3 in the Central US Azure region
AKV4 in the East US Azure region
- Deploy the following key vaults to RG2:
AKV5 in the East US region
- Configure VM1 to read data from storage1.
- Create function apps that have the following hosting plans:
Fa1: Flex Consumption hosting plan
Fa2: Consumption hosting plan
Fa3: Dedicated hosting plan
- For WAF1, implement rate limiting rules based on the request
location.
- Enable the NIST SP 800-53 Rev. 5 compliance standard in Defender for
Cloud.
- Create a new storage account named storage2 that supports Azure Table storage.
- Enforce multifactor authentication (MFA) when database administrators access SQLdb1.
- Implement ExpressRoute circuits to the on-premises network as shown
in the following table.
- For RG1, create a new Privileged Identity Management (PIM) eligible role assignment that assigns the Contributor role to supported groups.
Planned Changes and Requirements. Technical Requirements
Fabrikam has the following technical requirements:
- If VM1 is deleted, the permissions for VM1 must be removed
automatically.
- The AKS1 managed identity must only be able to pull images from
Registry1.
- The ID1 managed identity must be able to push images to and pull
images from Registry1.
- All the data in the storage accounts must be encrypted by using
Fabrikam-managed keys.
- All outbound traffic from the function apps to the on-premises
network must use ExpressRoute circuits.
- ExpressRoute connectivity between the on-premises network and the
Azure environment must be encrypted by using Layer 2 or Layer 3
encryption.
You need to delegate a user to implement the planned change for Defender for Cloud. The solution must follow the principle of least privilege. Which user should you choose?
Answer: A
Explanation:
Enabling the NIST SP 800-53 Rev. 5 compliance standard in Microsoft Defender for Cloud requires permissions to add and manage regulatory compliance standards through Azure Policy initiatives. Admin1 already has the Resource Policy Contributor role on Sub1, which provides the least-privilege authorization required to implement this planned compliance change.
Reference:
https://learn.microsoft.com/en-us/azure/defender-for-cloud/assign-regulatory-compliance-standards
https://learn.microsoft.com/en-us/azure/governance/policy/overview
NEW QUESTION # 218
You have an Azure subscription named Sub1 that contains multiple virtual machines. Sub1 has the Microsoft Defender Cloud Security Posture Management (CSPM) plan enabled.
You discover that Defender for Cloud falls to identify plaintext connection strings and SSH keys stored on the virtual machines.
You need to ensure that secrets can be identified on the virtual machines.
What should you do?
Answer: D
Explanation:
Defender CSPM identifies secrets such as plaintext connection strings and SSH keys on machines through agentless machine scanning. If those secrets are not being identified, the missing capability is the agentless scan feature. The Sentinel data connector only forwards alerts and posture data, the Azure Monitor Agent collects telemetry, and Defender for Key Vault protects vault access; none of those scan VM disks for exposed secrets. The posture and monitoring objective focuses on turning security data into usable operational outcomes. The correct answer either collects the right signal, grants the right security-operations role, or automates incident handling at the correct layer. Distractors often provide dashboards, queries, or broad permissions, but those do not create the requested workflow or least-privilege security capability. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > scan for secrets by Defender CSPM; Microsoft Learn > agentless scanning for machines.
NEW QUESTION # 219
You create a new Microsoft Sentinel workspace named Workspace1.
Workspace1 ingests Azure Firewall logs that are used only occasionally during investigations.
You need to retain the logs for seven years at the lowest cost. The solution must ensure that investigators ran search the retained data when needed.
What should you do?
Answer: C
NEW QUESTION # 220
You have an Azure subscription named Sub1 that contains a resource group named RG1. RG1 contains an Azure logic app named App1.
You need to ensure that a user named User1 can add App1 as a playbook in Microsoft Sentinel. The solution must follow the principle of least privilege.
Which role should you assign to User1?
Answer: B
Explanation:
Assign Logic App Contributor to User1 at the RG1 scope. Microsoft Sentinel playbooks are implemented as Azure Logic Apps, and Microsoft documents that the Logic App Contributor role is the role that permits a user to create, edit, and manage logic apps/playbooks. Because App1 already exists in RG1 and User1 needs to add or manage it as a Sentinel playbook, this is the least-privileged role among the available choices.
Microsoft Learn
The scope should be RG1, not the entire subscription. Granting the role at Sub1 would provide unnecessary permissions over logic apps in other resource groups and would violate least privilege.
Logic App Operator is insufficient because it allows a user to read, enable, disable, and run certain logic-app operations, but it does not permit editing or managing the workflow as required for playbook configuration.
Microsoft Learn
Microsoft Sentinel Contributor provides permissions to manage Sentinel resources and can attach playbooks to analytics or automation rules, but it does not provide the underlying permissions required to edit/manage the Logic App resource itself. Microsoft explicitly lists Logic App Contributor for creating or editing playbooks
NEW QUESTION # 221
......
If you always feel that you can't get a good performance when you come to the exam room. There is Software version of our SC-500 exam braindumps, it can simulate the real exam environment. If you take good advantage of this SC-500 practice materials character, you will not feel nervous when you deal with the Real SC-500 Exam. Furthermore, it can be downloaded to all electronic devices so that you can have a rather modern study experience conveniently. Why not have a try?
Exam SC-500 Questions Pdf: https://www.examprepaway.com/Microsoft/braindumps.SC-500.ete.file.html