Your performance and exam skills will be improved with our SC-500 practice test software. The software provides you with a range of SC-500 exam dumps, all of which are based on past Microsoft SC-500 certification. Either way, the SC-500 Practice Exam software will provide you with feedback on your performance. The Implementing End-to-End Security Controls for Cloud and AI Workloads (SC-500) practice test software also includes a built-in timer and score tracker so students can monitor their progress.
| Section | Weight | Objectives |
|---|---|---|
| Topic 1: Secure storage, databases, and networking | 25–30% | - Secure storage and data services
|
| Topic 2: Manage and monitor security posture | 20–25% | - Secure AI workloads and solutions
|
| Topic 3: Manage identity, access, and governance | 20–25% | - Enforce compliance and governance controls
|
| Topic 4: Secure compute | 20–25% | - Secure virtual machines and containers
|
If you choose our SC-500 exam question for related learning and training, the system will automatically record your actions and analyze your learning effects. Many people want to get a SC-500 certification, but they worry about their ability. So please do not hesitate and join our study. Our SC-500 Exam Question will help you to get rid of your worries and help you achieve your wishes. So you will have more opportunities than others and get more confidence. Our SC-500 quiz guide is based on the actual situation of the customer.
NEW QUESTION # 139
You have an Azure subscription that contains a user named User1 and an Azure Container Registry named ContReg1.
You enable content trust for ContReg1.
You need to ensure that User1 can create trusted images in ContReg1. The solution must use the principle of least privilege.
Which two roles should you assign to User1? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.
Answer: A,B
Explanation:
Creating trusted images in a content trust-enabled Azure Container Registry requires permission to push the image content and permission to sign the image by using Docker Content Trust. The two roles together grant only the required publishing and signing capabilities for trusted container images.
Reference:
https://learn.microsoft.com/en-us/azure/container-registry/container-registry-content-trust
https://learn.microsoft.com/en-us/azure/container-registry/container-registry-rbac-built-in-roles-overview?tabs=registries-configured-with-rbac-registry-abac-repository-permissions
NEW QUESTION # 140
You need to delegate a user to implement the planned change for Defender for Cloud. The solution must follow the principle of least privilege.
Which user should you choose?
Answer: C
Explanation:
Admin1 is the visible least-privilege delegate for the planned Defender for Cloud change. Defender for Cloud administration should be delegated to the user with the specific security or Defender permissions needed for the task, not to broader administrators unless required. Choosing a higher privileged account would violate the least-privilege requirement. The source file's case-study background is not visible, so the answer follows the displayed answer selection and the general Defender for Cloud RBAC model. The SC-500 study guide places these tasks under security posture, event collection, Defender CSPM, EASM, Sentinel, and Security Copilot operations. The exam expects the control that minimizes analyst effort while preserving correct permissions and data flow. The selected answer reflects that service boundary and avoids a broader or merely investigative alternative. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source
/topic: SC-500 Study Guide > Defender for Cloud least-privilege administration; Microsoft Learn > built-in Azure roles for Defender for Cloud.
NEW QUESTION # 141
Drag and Drop Question
You have an Azure subscription named Sub1 that contains a storage account named storage1.
storage1 hosts a blob container named container1.
Sub1 is linked to a Microsoft Entra tenant that contains a security group named Group1.
You need to ensure that Group1 can use the Azure portal to view the blobs in container1. The solution must follow the principle of least privilege.
Which roles should you assign to Group1. To answer, drag the appropriate roles to the correct objects. Each role may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Explanation:
Box 1: Storage Blob Data Reader
To allow the security group to view the blobs in the container using the Azure portal while maintaining the principle of least privilege, you must assign the following roles:
For the blob container: Storage Blob Data Reader
The Storage Blob Data Reader role allows the group to read and list the actual blob data inside the container using Microsoft Entra ID authentication. Assigning this at the container scope keeps permissions strictly limited to that specific container.
Box 2: Reader
For the storage account: Reader
The Reader role at the storage account scope is necessary for Azure portal navigation. Without it, users cannot navigate through the Azure portal UI to find and click on the storage account or see the container list. The Reader role only grants visibility into the management plane (resource properties) and does not grant access to the underlying data.
Reference:
https://learn.microsoft.com/en-us/azure/storage/blobs/authorize-data-operations-portal
NEW QUESTION # 142
You need to implement the planned change for storage2. The solution must meet the technical requirements for storage encryption.
What should you do?
Answer: A
Explanation:
Storage2 must be configured to use an account encryption key. The planned storage account must support Azure Table storage , while the technical requirement specifies that all storage data must be encrypted using Fabrikam-managed keys , meaning customer-managed keys (CMKs).
Azure Storage treats Table and Queue encryption differently from Blob Storage and Azure Files. Microsoft states that to encrypt Table Storage or Queue Storage with a customer-managed key , the storage account must be configured at creation time to use an encryption key scoped to the account rather than the default service-scoped key. After creation, this setting cannot be changed. Microsoft Learn An encryption scope does not solve this requirement because encryption scopes apply to Blob Storage containers and individual blobs , not Azure Table data. Microsoft Learn An Azure RBAC assignment may later be required so that the storage account ' s managed identity can access the customer-managed key in Key Vault, but it does not itself configure Table Storage to support account- level CMK encryption. Purge protection applies to Azure Key Vault rather than storage2.
Therefore, when storage2 is created, configure Table Storage to use the account encryption key .
NEW QUESTION # 143
You have an Azure subscription that uses Microsoft Defender for Cloud.
You have accounts for the following cloud services:
* Alibaba Cloud
* Amazon Web Services (AWS)
* Google Cloud Platform (GCP)
What can you add to Defender for Cloud?
Answer: A
Explanation:
Microsoft Defender for Cloud provides native multicloud connectors for Amazon Web Services (AWS) and Google Cloud Platform (GCP) . Therefore, both the AWS account and GCP environment can be connected to Defender for Cloud for cloud security posture management and supported workload-protection functionality. Microsoft ' s current multicloud support matrix explicitly covers Azure, AWS, and GCP and lists Defender CSPM, Defender for Servers, Defender for Containers, and several other capabilities across AWS and GCP. Microsoft Learn For GCP, Defender for Cloud provides a dedicated onboarding workflow under Environment settings > Add environment > Google Cloud Platform , allowing projects or organizations to be connected and assessed.
AWS has an equivalent native cloud connector mechanism. Microsoft Learn Alibaba Cloud is not one of the native cloud environments that can be added through Defender for Cloud ' s multicloud connector model. Microsoft ' s documented supported multicloud environments are AWS and GCP in addition to Azure. Individual servers hosted elsewhere could potentially be onboarded through other mechanisms such as Azure Arc where supported, but that is different from connecting an Alibaba Cloud account as a cloud environment.
Therefore, the supported cloud accounts in the question are:
AWS and GCP only.
NEW QUESTION # 144
......
FreeDumps exam study material is essential for candidates who want to appear for the Microsoft SC-500 certification exams and clear it to validate their skill set. This preparation material comes with Up To 1 year OF Free Updates And Free Demos. Place your order now and get Real SC-500 Exam Questions with these offers.
New SC-500 Test Fee: https://www.freedumps.top/SC-500-real-exam.html