Amazon
Anthropic
Avaya
Cisco
CompTIA
CrowdStrike
EC-Council
EXIN
Fortinet
Google
ISC
ISC2
ITIL
Juniper
Microsoft
NVIDIA
Okta
Palo Alto Networks
Salesforce
SAP
All Vendors

Microsoft Implementing End-to-End Security Controls for Cloud and AI Workloads SC-500 Dumps in PDF

Free Microsoft SC-500 Real Questions (page: 1)

SC-500 PDF — 67 Questions

Overview
Contoso, Ltd. is a consulting company that has a main office in San Francisco and a branch office in Dallas.
Contoso has a hybrid environment that contains on-premises servers connected to Azure, a Microsoft 365 E5 subscription, and an Azure subscription named Sub1.
Existing Environment. Microsoft Entra tenant
Contoso has a Microsoft Entra tenant named contoso.com that contains the users shown in the following table.

Existing Environment. On-premises environment
The on-premises network contains an Active Directory Domain Services (AD DS) forest that syncs with contoso.com. The forest contains a server named Server1 that runs Windows Server.
Existing Environment. Azure subscription
Sub1 contains the storage accounts shown in the following table.

Sub1 contains the virtual networks shown in the following table.

Sub1 contains the virtual machines shown in the following table.

The network interface of VM1 is associated with an application security group named ASG1.
Sub1 contains the resources shown in the following table.

Vault1 stores the objects shown in the following table.

Existing Environment. Privileged Identity Management (PIM) configuration
You manage privileged roles by using Privileged Identity Management (PIM). The PIM role settings are configured as shown in the following table.

Existing Environment. Microsoft Sentinel configuration
Contoso has a Microsoft Sentinel workspace that contains the following tables.

Requirements. Planned changes
Contoso plans to implement the following changes:
-Integrate AKS1 with Vault1.
-Enable Microsoft Entra Kerberos authentication for all supported storage.
-Configure auditing for sql1 by using the Azure portal and store audit logs in a centralized location.
Requirements. Technical requirements
Contoso identifies the following technical requirements:
-Protect Server1 by using file integrity monitoring.
-Protect AKS1 by using Microsoft Defender for Cloud.
-Configure Microsoft Sentinel to retain data for the maximum supported duration without changing the tier.
-Store objects used for authentication and encryption in Vault1 and ensure that Vault1 regenerates the objects every 30 days, whenever possible.

HOTSPOT (Drag and Drop is not supported)
User1 has requested to use the AI Administrator role.
Which approvers can approve the request, and how long will User1 be an AI administrator after the role is approved? To answer, select the appropriate options in the answer area.
Note: Each correct selection is worth one point.

Hot Area:

  1. See Explanation section for answer.

Answer(s): A

Explanation:



Eligible approvers: Admin1 and Admin3 only Maximum active duration of the role: 1 day
Approval is required for activation of the AI Administrator role, but no specific approvers are configured. For a Microsoft Entra role, active Global Administrators and Privileged Role Administrators become the default approvers in this situation. Admin1 is a Global Administrator, and Admin3 is a Privileged Role Administrator. The configured activation maximum duration for the AI Administrator role is one day, so User1’s activated access expires after one day.


Reference:

https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-how-to-change-default-settings




Overview
Contoso, Ltd. is a consulting company that has a main office in San Francisco and a branch office in Dallas.
Contoso has a hybrid environment that contains on-premises servers connected to Azure, a Microsoft 365 E5 subscription, and an Azure subscription named Sub1.
Existing Environment. Microsoft Entra tenant
Contoso has a Microsoft Entra tenant named contoso.com that contains the users shown in the following table.

Existing Environment. On-premises environment
The on-premises network contains an Active Directory Domain Services (AD DS) forest that syncs with contoso.com. The forest contains a server named Server1 that runs Windows Server.
Existing Environment. Azure subscription
Sub1 contains the storage accounts shown in the following table.

Sub1 contains the virtual networks shown in the following table.

Sub1 contains the virtual machines shown in the following table.

The network interface of VM1 is associated with an application security group named ASG1.
Sub1 contains the resources shown in the following table.

Vault1 stores the objects shown in the following table.

Existing Environment. Privileged Identity Management (PIM) configuration
You manage privileged roles by using Privileged Identity Management (PIM). The PIM role settings are configured as shown in the following table.

Existing Environment. Microsoft Sentinel configuration
Contoso has a Microsoft Sentinel workspace that contains the following tables.

Requirements. Planned changes
Contoso plans to implement the following changes:
-Integrate AKS1 with Vault1.
-Enable Microsoft Entra Kerberos authentication for all supported storage.
-Configure auditing for sql1 by using the Azure portal and store audit logs in a centralized location.
Requirements. Technical requirements
Contoso identifies the following technical requirements:
-Protect Server1 by using file integrity monitoring.
-Protect AKS1 by using Microsoft Defender for Cloud.
-Configure Microsoft Sentinel to retain data for the maximum supported duration without changing the tier.
-Store objects used for authentication and encryption in Vault1 and ensure that Vault1 regenerates the objects every 30 days, whenever possible.

HOTSPOT (Drag and Drop is not supported)
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
Note: Each correct selection is worth one point.
Hot Area:

  1. See Explanation section for answer.

Answer(s): A

Explanation:




Admin1 must approve requests for the Agent ID Developer role: No Admin2 can approve requests for the AI Administrator role: No Admin3 can assign User1 a two-day active assignment for the Agent ID Developer role: Yes
The Agent ID Developer role does not require approval for activation, so no approval request is generated. The AI Administrator role requires approval, but because no specific approvers are configured, only active Global Administrators and Privileged Role Administrators act as default approvers; an AI Administrator is not a default approver. Admin3 is a Privileged Role Administrator and can assign Microsoft Entra roles in PIM. The one-day activation maximum duration limits eligible-role activations, not administrator-created active assignments; active assignments for the Agent ID Developer role can last up to the configured 15-day period, so a two-day active assignment is allowed.


Reference:

https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-how-to-change-default-settings



You have an Azure SQL Database logical server named Server1 that contains a database named DB1.
You need to configure authentication for Server1 to meet the following requirements:
-SQL authentication cannot be used for any databases on Server1.
-The solution must be enforced centrally at the server level.
What should you do?

  1. Configure a Microsoft Entra administrator for Server1.
  2. Enable a managed identity for Server1.
  3. Enable Microsoft Entra-only authentication for Server1.
  4. Remove SQL logins from DB1.

Answer(s): C

Explanation:

Enabling Microsoft Entra-only authentication on the Azure SQL logical server disables SQL authentication at the server level for every database hosted on Server1. Only Microsoft Entra-authenticated connections are permitted, centrally enforcing the required authentication policy.


Reference:

https://learn.microsoft.com/en-us/azure/azure-sql/database/authentication-azure-ad-only-authentication?view=azuresql&tabs=azure-cli



You have a Microsoft Entra tenant that has the following configurations:
-User consent for applications is disabled.
-Only administrators can grant permissions to applications.
You register an application named App1 that uses delegated Microsoft Graph permissions.
You need to configure App1 to meet the following requirements:
-Enable user sign-ins without interactive consent prompts.
-Enable App1 to access Microsoft Graph on behalf of the signed-in user.
What should you do?

  1. Configure enterprise applications to require user assignment and assign users to App1.
  2. Modify the app registration to use application permissions instead of delegated permissions.
  3. Add the required delegated Microsoft Graph permissions to the app registration and rely on user consent during sign-in.
  4. Grant admin consent to App1 for the required delegated permissions.

Answer(s): D

Explanation:

Admin consent grants the required delegated Microsoft Graph permissions on behalf of the tenant. App1 can then call Microsoft Graph in the context of a signed-in user without requiring individual users to respond to consent prompts, which is necessary because user consent is disabled.


Reference:

https://learn.microsoft.com/en-us/entra/identity/enterprise-apps/grant-admin-consent?pivots=portal https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-configure-app-access-web-apis



You have a Microsoft Entra tenant that uses Privileged Identity Management (PIM).
You need to modify the AI Administrator role settings to meet the following requirements:
-Elevated access must be evaluated by another administrator before it is granted.
-Privileged access must be removed automatically after a fixed period.
Which two settings should you configure? Each correct answer presents part of the solution.
Note: Each correct selection is worth one point.

  1. Expire active assignments after
  2. Require approval to activate
  3. Require justification on activation
  4. Expire eligible assignments after
  5. Activation maximum duration

Answer(s): B,E

Explanation:

Requiring approval to activate ensures that a designated administrator must evaluate and approve an eligible user’s elevation request before privileged access is granted. Setting an activation maximum duration makes each activated role assignment time-bound, automatically removing the elevated access when the configured activation period expires.


Reference:

https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-how-to-change-default-settings https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-how-to-activate-role



You have two management groups named MG1 and MG2 that contain multiple Azure subscriptions. The subscriptions are linked to a Microsoft Entra tenant.
You have a user named User1 and a global administrator named Admin1.
You are informed that User1 created an Azure subscription named Sub1 under the MG2 management group and is the only owner of the subscription.
You need to ensure that Admin1 can remove the Owner role from User1 for Sub1.
What should you do first?

  1. Move Sub1 to MG1.
  2. Assign Admin1 the User Access Administrator role for Sub1.
  3. Instruct Admin1 to use Privileged Identity Management (PIM) to request the Security Administrator role.
  4. Instruct Admin1 to enable Access management for Azure resources.

Answer(s): D

Explanation:

Enabling Access management for Azure resources allows a Microsoft Entra Global Administrator to elevate access and receive the User Access Administrator role at the root scope. This inherited access applies to Sub1 and enables Admin1 to remove User1’s Owner role assignment from the subscription.


Reference:

https://learn.microsoft.com/en-us/azure/role-based-access-control/elevate-access-global-admin? tabs=azure-portal%2Centra-audit-logs https://learn.microsoft.com/en-us/azure/role-based-access-control/rbac-and-directory-admin-roles



You have a management group named MG1 that contains two subscriptions named Sub1 and Sub2.
Sub1 contains a resource group named RG-Exception and a resource group named RG1 that hosts Microsoft Foundry resources.
You need to assign an Azure policy to force new Foundry deployments in MG1 to use private endpoints. The solution must NOT restrict deployments in RG-Exception.
How should you configure the policy?

  1. Assign the policy to MG1 and exclude RG-Exception.
  2. Assign the policy to Sub1 and RG-Exception.
  3. Assign the policy to MG1 and RG-Exception.
  4. Assign the policy to Sub1 and exclude RG-Exception.

Answer(s): A

Explanation:

Assigning the policy at the MG1 scope enforces the private endpoint requirement for new Microsoft Foundry deployments in all subscriptions and resource groups beneath the management group. Configuring RG-Exception as an excluded scope prevents the policy from restricting deployments in that resource group while maintaining centralized enforcement everywhere else in MG1.


Reference:

https://learn.microsoft.com/en-us/azure/governance/policy/overview https://learn.microsoft.com/en-us/azure/governance/policy/tutorials/create-and-manage



You have an Azure key vault named KV1 that uses role-based access control (RBAC) authorization. KV1 stores database connection strings for an Azure App Service web app named App1.
You enable a firewall on KV1 and allow access to KV1 from only the virtual network that contains App1.
You need to ensure that App1 can retrieve secrets from KV1 without using credentials stored in the application configuration.
What should you create?

  1. an access policy for KV1
  2. an app registration for App1
  3. a private endpoint for KV1
  4. a managed identity for App1

Answer(s): D

Explanation:

A managed identity enables App1 to authenticate to Azure Key Vault through Microsoft Entra ID without storing or managing application credentials. Because KV1 uses RBAC authorization, the identity must also be assigned an appropriate Key Vault data-plane role, such as Key Vault Secrets User, to retrieve the stored connection strings.


Reference:

https://learn.microsoft.com/en-us/azure/key-vault/general/authentication https://learn.microsoft.com/en-us/azure/app-service/overview-managed-identity?tabs=portal%2Chttp https://learn.microsoft.com/en-us/azure/key-vault/general/rbac-guide?tabs=azure-cli



PDF
Viewing page 1 of 10

Share your comments for Microsoft SC-500 exam with other users:

S
sushant
6/28/2023 4:38:00 AM

please upoad

EUROPEAN UNION
J
John
8/7/2023 12:09:00 AM

has anyone recently attended safe 6.0 certification? is it the samq question from here.

Anonymous
B
Blessious Phiri
8/14/2023 3:49:00 PM

expository experience

Anonymous
C
concerned citizen
12/29/2023 11:31:00 AM

52 should be b&c. controller failure has nothing to do with this type of issue. degraded state tells us its a raid issue, and if the os is missing then the bootable device isnt found. the only other consideration could be data loss but thats somewhat broad whereas b&c show understanding of the specific issues the question is asking about.

UNITED STATES
D
deedee
12/23/2023 5:10:00 PM

great help!!!

UNITED STATES
S
Samir
8/1/2023 3:07:00 PM

very useful tools

UNITED STATES
S
Saeed
11/7/2023 3:14:00 AM

looks a good platform to prepare az-104

Anonymous
M
Matiullah
6/24/2023 7:37:00 AM

want to pass the exam

Anonymous
S
SN
9/5/2023 2:25:00 PM

good resource

UNITED STATES
Z
Zoubeyr
9/8/2023 5:56:00 AM

question 11 : d

FRANCE
U
User
8/29/2023 3:24:00 AM

only the free dumps will be enough for pass, or have to purchase the premium one. please suggest.

Anonymous
C
CW
7/6/2023 7:37:00 PM

good questions. thanks.

Anonymous
F
Farooqi
11/21/2023 1:37:00 AM

good for practice.

INDIA
I
Isaac
10/28/2023 2:30:00 PM

great case study

UNITED STATES
M
Malviya
2/3/2023 9:10:00 AM

the questions in this exam dumps is valid. i passed my test last monday. i only whish they had their pricing in inr instead of usd. but it is still worth it.

INDIA
R
rsmyth
5/18/2023 12:44:00 PM

q40 the answer is not d, why are you giving incorrect answers? snapshot consolidation is used to merge the snapshot delta disk files to the vm base disk

IRELAND
K
Keny
6/23/2023 9:00:00 PM

thanks, very relevant

PERU
M
Muhammad Rawish Siddiqui
11/29/2023 12:14:00 PM

wrong answer. it is true not false.

SAUDI ARABIA
J
Josh
7/10/2023 1:54:00 PM

please i need the mo-100 questions

Anonymous
V
VINNY
6/2/2023 11:59:00 AM

very good use full

Anonymous
A
Andy
12/6/2023 5:56:00 AM

very valid questions

Anonymous
M
Mamo
8/12/2023 7:46:00 AM

will these question help me to clear pl-300 exam?

UNITED STATES
M
Marial Manyang
7/26/2023 10:13:00 AM

please provide me with these dumps questions. thanks

Anonymous
A
Amel Mhamdi
12/16/2022 10:10:00 AM

in the pdf downloaded is write google cloud database engineer i think that it isnt the correct exam

FRANCE
A
Angel
8/30/2023 10:58:00 PM

i think you have the answers wrong regarding question: "what are three core principles of web content accessibility guidelines (wcag)? answer: robust, operable, understandable

UNITED STATES
S
SH
5/16/2023 1:43:00 PM

these questions are not valid , they dont come for the exam now

UNITED STATES
S
sudhagar
9/6/2023 3:02:00 PM

question looks valid

UNITED STATES
V
Van
11/24/2023 4:02:00 AM

good for practice

Anonymous
D
Divya
8/2/2023 6:54:00 AM

need more q&a to go ahead

Anonymous
R
Rakesh
10/6/2023 3:06:00 AM

question 59 - a newly-created role is not assigned to any user, nor granted to any other role. answer is b https://docs.snowflake.com/en/user-guide/security-access-control-overview

Anonymous
N
Nik
11/10/2023 4:57:00 AM

just passed my exam today. i saw all of these questions in my text today. so i can confirm this is a valid dump.

HONG KONG
D
Deep
6/12/2023 7:22:00 AM

needed dumps

INDIA
T
tumz
1/16/2024 10:30:00 AM

very helpful

UNITED STATES
N
NRI
8/27/2023 10:05:00 AM

will post once the exam is finished

UNITED STATES
AI Tutor 👋 I’m here to help!