Amazon
Anthropic
Avaya
Cisco
CompTIA
CrowdStrike
EC-Council
EXIN
Fortinet
Google
ISC
ISC2
ITIL
Juniper
Microsoft
NVIDIA
Palo Alto Networks
Salesforce
SAP
VMware
All Vendors

Microsoft Implementing End-to-End Security Controls for Cloud and AI Workloads SC-500 Dumps in PDF

Free Microsoft SC-500 Real Questions (page: 6)

SC-500 PDF — 207 Questions

Overview
Fabrikam, Inc. is a consulting company. The company has a main office in New York City and branch offices in Amsterdam and Singapore.
Existing Environment. Network environment
The on-premises network contains a datacenter in each office.
Existing Environment. Cloud environment
Fabrikam has two Azure subscriptions named Sub1 and Sub2 and a Microsoft 365 subscription that includes Microsoft 365 E5 licenses.
All the subscriptions are linked to a Microsoft Entra tenant named fabrikam.com that contains the identities shown in the following table.

The tenant contains the groups shown in the following table.

All devices are enrolled in Microsoft Intune.
Existing Environment. Sub1 Resources
Sub1 contains a resource group named RG1 that contains the resources shown in the following table.

SQLServer1 uses Microsoft SQL Server authentication.
Sub1 has an Azure Web Application Firewall (WAF) named WAF1 that has the following types of rule sets:
• Bot Manager 1.1
• Azure-managed Default Rule Set (DRS)
Sub1 has the following compliance standards assigned in Microsoft Defender for Cloud:
• NIST SP 800-53 Rev. 4
• Microsoft cloud security benchmark (MCSB)
• System and Organization Controls (SOC) 2 Type 2
Existing Environment. Sub2 Resources
Sub2 contains a resource group named RG2.
Planned Changes and Requirements. Planned Changes
Fabrikam plans to implement the following changes:
• Deploy the following key vaults to RG1:
o AKV2 in the West Europe Azure region o AKV3 in the Central US Azure region o AKV4 in the East US Azure region
• Deploy the following key vaults to RG2:
o AKV5 in the East US region
• Configure VM1 to read data from storage1.
• Create function apps that have the following hosting plans:
o Fa1: Flex Consumption hosting plan o Fa2: Consumption hosting plan o Fa3: Dedicated hosting plan
• For WAF1, implement rate limiting rules based on the request location.
• Enable the NIST SP 800-53 Rev. 5 compliance standard in Defender for Cloud.
• Create a new storage account named storage2 that supports Azure Table storage.
• Enforce multifactor authentication (MFA) when database administrators access SQLdb1.
• Implement ExpressRoute circuits to the on-premises network as shown in the following table.

• For RG1, create a new Privileged Identity Management (PIM) eligible role assignment that assigns the Contributor role to supported groups.
Planned Changes and Requirements. Technical Requirements
Fabrikam has the following technical requirements:
• If VM1 is deleted, the permissions for VM1 must be removed automatically.
• The AKS1 managed identity must only be able to pull images from Registry1.
• The ID1 managed identity must be able to push images to and pull images from Registry1.
• All the data in the storage accounts must be encrypted by using Fabrikam-managed keys.
• All outbound traffic from the function apps to the on-premises network must use ExpressRoute circuits.
• ExpressRoute connectivity between the on-premises network and the Azure environment must be encrypted by using Layer 2 or Layer 3 encryption.

HOTSPOT (Drag and Drop is not supported)
You have an Azure subscription that contains an Azure key vault. The role assignments for the key vault are shown in the following exhibit.

Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.
Note: Each correct selection is worth one point.
Hot Area:

  1. See Explanation section for answer.

Answer(s): A

Explanation:




Only User2
Only User3
User2 has the Key Vault Crypto Officer role at the vault scope, which grants permission to create and manage keys.
User3 has the Key Vault Secrets Officer role at the vault scope, which grants permission to create and manage secrets.


Reference:

https://microsoftlearning.github.io/mslearn-sec-identity/Instructions/Labs/Lab-1C-Secure-KeyVault.html




Overview
Fabrikam, Inc. is a consulting company. The company has a main office in New York City and branch offices in Amsterdam and Singapore.
Existing Environment. Network environment
The on-premises network contains a datacenter in each office.
Existing Environment. Cloud environment
Fabrikam has two Azure subscriptions named Sub1 and Sub2 and a Microsoft 365 subscription that includes Microsoft 365 E5 licenses.
All the subscriptions are linked to a Microsoft Entra tenant named fabrikam.com that contains the identities shown in the following table.

The tenant contains the groups shown in the following table.

All devices are enrolled in Microsoft Intune.
Existing Environment. Sub1 Resources
Sub1 contains a resource group named RG1 that contains the resources shown in the following table.

SQLServer1 uses Microsoft SQL Server authentication.
Sub1 has an Azure Web Application Firewall (WAF) named WAF1 that has the following types of rule sets:
• Bot Manager 1.1
• Azure-managed Default Rule Set (DRS)
Sub1 has the following compliance standards assigned in Microsoft Defender for Cloud:
• NIST SP 800-53 Rev. 4
• Microsoft cloud security benchmark (MCSB)
• System and Organization Controls (SOC) 2 Type 2
Existing Environment. Sub2 Resources
Sub2 contains a resource group named RG2.
Planned Changes and Requirements. Planned Changes
Fabrikam plans to implement the following changes:
• Deploy the following key vaults to RG1:
o AKV2 in the West Europe Azure region o AKV3 in the Central US Azure region o AKV4 in the East US Azure region
• Deploy the following key vaults to RG2:
o AKV5 in the East US region
• Configure VM1 to read data from storage1.
• Create function apps that have the following hosting plans:
o Fa1: Flex Consumption hosting plan o Fa2: Consumption hosting plan o Fa3: Dedicated hosting plan
• For WAF1, implement rate limiting rules based on the request location.
• Enable the NIST SP 800-53 Rev. 5 compliance standard in Defender for Cloud.
• Create a new storage account named storage2 that supports Azure Table storage.
• Enforce multifactor authentication (MFA) when database administrators access SQLdb1.
• Implement ExpressRoute circuits to the on-premises network as shown in the following table.

• For RG1, create a new Privileged Identity Management (PIM) eligible role assignment that assigns the Contributor role to supported groups.
Planned Changes and Requirements. Technical Requirements
Fabrikam has the following technical requirements:
• If VM1 is deleted, the permissions for VM1 must be removed automatically.
• The AKS1 managed identity must only be able to pull images from Registry1.
• The ID1 managed identity must be able to push images to and pull images from Registry1.
• All the data in the storage accounts must be encrypted by using Fabrikam-managed keys.
• All outbound traffic from the function apps to the on-premises network must use ExpressRoute circuits.
• ExpressRoute connectivity between the on-premises network and the Azure environment must be encrypted by using Layer 2 or Layer 3 encryption.

You have an Azure key vault named KV1 that uses role-based access control (RBAC) authorization. KV1 stores database connection strings for an Azure App Service web app named App1.
You enable a firewall on KV1 and allow access to KV1 from only the virtual network that contains App1.
You need to ensure that App1 can retrieve secrets from KV1 without using credentials stored in the application configuration.
What should you create?

  1. an access policy for KV1
  2. an app registration for App1
  3. a private endpoint for KV1
  4. a managed identity for App1

Answer(s): D

Explanation:

A managed identity enables App1 to authenticate to Azure Key Vault through Microsoft Entra ID without storing or managing application credentials. Because KV1 uses RBAC authorization, the identity must also be assigned an appropriate Key Vault data-plane role, such as Key Vault Secrets User, to retrieve the stored connection strings.


Reference:

https://learn.microsoft.com/en-us/azure/key-vault/general/authentication https://learn.microsoft.com/en-us/azure/app-service/overview-managed-identity?tabs=portal%2Chttp https://learn.microsoft.com/en-us/azure/key-vault/general/rbac-guide?tabs=azure-cli




Overview
Fabrikam, Inc. is a consulting company. The company has a main office in New York City and branch offices in Amsterdam and Singapore.
Existing Environment. Network environment
The on-premises network contains a datacenter in each office.
Existing Environment. Cloud environment
Fabrikam has two Azure subscriptions named Sub1 and Sub2 and a Microsoft 365 subscription that includes Microsoft 365 E5 licenses.
All the subscriptions are linked to a Microsoft Entra tenant named fabrikam.com that contains the identities shown in the following table.

The tenant contains the groups shown in the following table.

All devices are enrolled in Microsoft Intune.
Existing Environment. Sub1 Resources
Sub1 contains a resource group named RG1 that contains the resources shown in the following table.

SQLServer1 uses Microsoft SQL Server authentication.
Sub1 has an Azure Web Application Firewall (WAF) named WAF1 that has the following types of rule sets:
• Bot Manager 1.1
• Azure-managed Default Rule Set (DRS)
Sub1 has the following compliance standards assigned in Microsoft Defender for Cloud:
• NIST SP 800-53 Rev. 4
• Microsoft cloud security benchmark (MCSB)
• System and Organization Controls (SOC) 2 Type 2
Existing Environment. Sub2 Resources
Sub2 contains a resource group named RG2.
Planned Changes and Requirements. Planned Changes
Fabrikam plans to implement the following changes:
• Deploy the following key vaults to RG1:
o AKV2 in the West Europe Azure region o AKV3 in the Central US Azure region o AKV4 in the East US Azure region
• Deploy the following key vaults to RG2:
o AKV5 in the East US region
• Configure VM1 to read data from storage1.
• Create function apps that have the following hosting plans:
o Fa1: Flex Consumption hosting plan o Fa2: Consumption hosting plan o Fa3: Dedicated hosting plan
• For WAF1, implement rate limiting rules based on the request location.
• Enable the NIST SP 800-53 Rev. 5 compliance standard in Defender for Cloud.
• Create a new storage account named storage2 that supports Azure Table storage.
• Enforce multifactor authentication (MFA) when database administrators access SQLdb1.
• Implement ExpressRoute circuits to the on-premises network as shown in the following table.

• For RG1, create a new Privileged Identity Management (PIM) eligible role assignment that assigns the Contributor role to supported groups.
Planned Changes and Requirements. Technical Requirements
Fabrikam has the following technical requirements:
• If VM1 is deleted, the permissions for VM1 must be removed automatically.
• The AKS1 managed identity must only be able to pull images from Registry1.
• The ID1 managed identity must be able to push images to and pull images from Registry1.
• All the data in the storage accounts must be encrypted by using Fabrikam-managed keys.
• All outbound traffic from the function apps to the on-premises network must use ExpressRoute circuits.
• ExpressRoute connectivity between the on-premises network and the Azure environment must be encrypted by using Layer 2 or Layer 3 encryption.

You have an Azure subscription that is linked to a Microsoft Entra tenant.
From the Azure portal, you register an enterprise application.
Which additional resource will be created in Microsoft Entra ID?

  1. a managed identity
  2. a user account
  3. a service principal
  4. an X.509 certificate

Answer(s): C

Explanation:

When an application is registered in Microsoft Entra ID, an application object is created, and a corresponding service principal is created in the tenant to represent that application for authentication, authorization, and access assignments.




Overview
Fabrikam, Inc. is a consulting company. The company has a main office in New York City and branch offices in Amsterdam and Singapore.
Existing Environment. Network environment
The on-premises network contains a datacenter in each office.
Existing Environment. Cloud environment
Fabrikam has two Azure subscriptions named Sub1 and Sub2 and a Microsoft 365 subscription that includes Microsoft 365 E5 licenses.
All the subscriptions are linked to a Microsoft Entra tenant named fabrikam.com that contains the identities shown in the following table.

The tenant contains the groups shown in the following table.

All devices are enrolled in Microsoft Intune.
Existing Environment. Sub1 Resources
Sub1 contains a resource group named RG1 that contains the resources shown in the following table.

SQLServer1 uses Microsoft SQL Server authentication.
Sub1 has an Azure Web Application Firewall (WAF) named WAF1 that has the following types of rule sets:
• Bot Manager 1.1
• Azure-managed Default Rule Set (DRS)
Sub1 has the following compliance standards assigned in Microsoft Defender for Cloud:
• NIST SP 800-53 Rev. 4
• Microsoft cloud security benchmark (MCSB)
• System and Organization Controls (SOC) 2 Type 2
Existing Environment. Sub2 Resources
Sub2 contains a resource group named RG2.
Planned Changes and Requirements. Planned Changes
Fabrikam plans to implement the following changes:
• Deploy the following key vaults to RG1:
o AKV2 in the West Europe Azure region o AKV3 in the Central US Azure region o AKV4 in the East US Azure region
• Deploy the following key vaults to RG2:
o AKV5 in the East US region
• Configure VM1 to read data from storage1.
• Create function apps that have the following hosting plans:
o Fa1: Flex Consumption hosting plan o Fa2: Consumption hosting plan o Fa3: Dedicated hosting plan
• For WAF1, implement rate limiting rules based on the request location.
• Enable the NIST SP 800-53 Rev. 5 compliance standard in Defender for Cloud.
• Create a new storage account named storage2 that supports Azure Table storage.
• Enforce multifactor authentication (MFA) when database administrators access SQLdb1.
• Implement ExpressRoute circuits to the on-premises network as shown in the following table.

• For RG1, create a new Privileged Identity Management (PIM) eligible role assignment that assigns the Contributor role to supported groups.
Planned Changes and Requirements. Technical Requirements
Fabrikam has the following technical requirements:
• If VM1 is deleted, the permissions for VM1 must be removed automatically.
• The AKS1 managed identity must only be able to pull images from Registry1.
• The ID1 managed identity must be able to push images to and pull images from Registry1.
• All the data in the storage accounts must be encrypted by using Fabrikam-managed keys.
• All outbound traffic from the function apps to the on-premises network must use ExpressRoute circuits.
• ExpressRoute connectivity between the on-premises network and the Azure environment must be encrypted by using Layer 2 or Layer 3 encryption.

You have an Azure key vault named KV1.
You have an Azure App Service web app named App1. App1 is integrated with a virtual network named VNet1 that is linked to an Azure Private DNS zone. App1 accesses secrets stored in KV1.
You need to configure KV1 to meet the following requirements:
-App1 must access the secrets by using a private IP address on VNet1.
-Requests from outside VNet1 must be denied.
Which two actions should you perform for KV1? Each correct answer presents part of the solution.
Note: Each correct selection is worth one point.

  1. Create a private endpoint.
  2. Add the IP addresses of App1.
  3. Disable public access.
  4. Create an access policy.

Answer(s): A,C

Explanation:

To meet your requirements, you must create a Private Endpoint for the Azure Key Vault, configure its firewall to deny public access, and link the Key Vault's private DNS zone to your virtual network (VNet). Because your Azure App Service is already VNet-integrated, these steps ensure all traffic to the Key Vault routes securely over your private IP space.


Reference:

https://learn.microsoft.com/en-us/azure/key-vault/general/private-link-service




Overview
Fabrikam, Inc. is a consulting company. The company has a main office in New York City and branch offices in Amsterdam and Singapore.
Existing Environment. Network environment
The on-premises network contains a datacenter in each office.
Existing Environment. Cloud environment
Fabrikam has two Azure subscriptions named Sub1 and Sub2 and a Microsoft 365 subscription that includes Microsoft 365 E5 licenses.
All the subscriptions are linked to a Microsoft Entra tenant named fabrikam.com that contains the identities shown in the following table.

The tenant contains the groups shown in the following table.

All devices are enrolled in Microsoft Intune.
Existing Environment. Sub1 Resources
Sub1 contains a resource group named RG1 that contains the resources shown in the following table.

SQLServer1 uses Microsoft SQL Server authentication.
Sub1 has an Azure Web Application Firewall (WAF) named WAF1 that has the following types of rule sets:
• Bot Manager 1.1
• Azure-managed Default Rule Set (DRS)
Sub1 has the following compliance standards assigned in Microsoft Defender for Cloud:
• NIST SP 800-53 Rev. 4
• Microsoft cloud security benchmark (MCSB)
• System and Organization Controls (SOC) 2 Type 2
Existing Environment. Sub2 Resources
Sub2 contains a resource group named RG2.
Planned Changes and Requirements. Planned Changes
Fabrikam plans to implement the following changes:
• Deploy the following key vaults to RG1:
o AKV2 in the West Europe Azure region o AKV3 in the Central US Azure region o AKV4 in the East US Azure region
• Deploy the following key vaults to RG2:
o AKV5 in the East US region
• Configure VM1 to read data from storage1.
• Create function apps that have the following hosting plans:
o Fa1: Flex Consumption hosting plan o Fa2: Consumption hosting plan o Fa3: Dedicated hosting plan
• For WAF1, implement rate limiting rules based on the request location.
• Enable the NIST SP 800-53 Rev. 5 compliance standard in Defender for Cloud.
• Create a new storage account named storage2 that supports Azure Table storage.
• Enforce multifactor authentication (MFA) when database administrators access SQLdb1.
• Implement ExpressRoute circuits to the on-premises network as shown in the following table.

• For RG1, create a new Privileged Identity Management (PIM) eligible role assignment that assigns the Contributor role to supported groups.
Planned Changes and Requirements. Technical Requirements
Fabrikam has the following technical requirements:
• If VM1 is deleted, the permissions for VM1 must be removed automatically.
• The AKS1 managed identity must only be able to pull images from Registry1.
• The ID1 managed identity must be able to push images to and pull images from Registry1.
• All the data in the storage accounts must be encrypted by using Fabrikam-managed keys.
• All outbound traffic from the function apps to the on-premises network must use ExpressRoute circuits.
• ExpressRoute connectivity between the on-premises network and the Azure environment must be encrypted by using Layer 2 or Layer 3 encryption.

HOTSPOT (Drag and Drop is not supported)
You have an Azure key vault named KV1 that uses role-based access control (RBAC) for data plane authorization.
You have a user named User1 and an Azure App Service web app named App1 that has a system-assigned managed identity.
You need to configure authorization to meet the following requirements:
-App1 must be able to retrieve secrets from KV1.
-User1 must manage the KV1 settings without accessing secret values.
The solution must follow the principle of least privilege.
Which role should you assign to each identity for KV1? To answer, drag the appropriate roles to the correct identities. Each role may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
Note: Each correct selection is worth one point.
Select and Place:

  1. See Explanation section for answer.

Answer(s): A

Explanation:




User1: Key Vault Contributor
App1: Key Vault Secrets User
The Key Vault Contributor role allows User1 to manage the key vault resource and its configuration but does not grant access to secret values. The Key Vault Secrets User role grants App1’s managed identity permission to read secret contents from KV1 without allowing it to manage secrets or the vault, satisfying least privilege.


Reference:

https://learn.microsoft.com/en-us/azure/key-vault/general/rbac-guide?tabs=azure-cli




Overview
Fabrikam, Inc. is a consulting company. The company has a main office in New York City and branch offices in Amsterdam and Singapore.
Existing Environment. Network environment
The on-premises network contains a datacenter in each office.
Existing Environment. Cloud environment
Fabrikam has two Azure subscriptions named Sub1 and Sub2 and a Microsoft 365 subscription that includes Microsoft 365 E5 licenses.
All the subscriptions are linked to a Microsoft Entra tenant named fabrikam.com that contains the identities shown in the following table.

The tenant contains the groups shown in the following table.

All devices are enrolled in Microsoft Intune.
Existing Environment. Sub1 Resources
Sub1 contains a resource group named RG1 that contains the resources shown in the following table.

SQLServer1 uses Microsoft SQL Server authentication.
Sub1 has an Azure Web Application Firewall (WAF) named WAF1 that has the following types of rule sets:
• Bot Manager 1.1
• Azure-managed Default Rule Set (DRS)
Sub1 has the following compliance standards assigned in Microsoft Defender for Cloud:
• NIST SP 800-53 Rev. 4
• Microsoft cloud security benchmark (MCSB)
• System and Organization Controls (SOC) 2 Type 2
Existing Environment. Sub2 Resources
Sub2 contains a resource group named RG2.
Planned Changes and Requirements. Planned Changes
Fabrikam plans to implement the following changes:
• Deploy the following key vaults to RG1:
o AKV2 in the West Europe Azure region o AKV3 in the Central US Azure region o AKV4 in the East US Azure region
• Deploy the following key vaults to RG2:
o AKV5 in the East US region
• Configure VM1 to read data from storage1.
• Create function apps that have the following hosting plans:
o Fa1: Flex Consumption hosting plan o Fa2: Consumption hosting plan o Fa3: Dedicated hosting plan
• For WAF1, implement rate limiting rules based on the request location.
• Enable the NIST SP 800-53 Rev. 5 compliance standard in Defender for Cloud.
• Create a new storage account named storage2 that supports Azure Table storage.
• Enforce multifactor authentication (MFA) when database administrators access SQLdb1.
• Implement ExpressRoute circuits to the on-premises network as shown in the following table.

• For RG1, create a new Privileged Identity Management (PIM) eligible role assignment that assigns the Contributor role to supported groups.
Planned Changes and Requirements. Technical Requirements
Fabrikam has the following technical requirements:
• If VM1 is deleted, the permissions for VM1 must be removed automatically.
• The AKS1 managed identity must only be able to pull images from Registry1.
• The ID1 managed identity must be able to push images to and pull images from Registry1.
• All the data in the storage accounts must be encrypted by using Fabrikam-managed keys.
• All outbound traffic from the function apps to the on-premises network must use ExpressRoute circuits.
• ExpressRoute connectivity between the on-premises network and the Azure environment must be encrypted by using Layer 2 or Layer 3 encryption.

HOTSPOT (Drag and Drop is not supported)
You have the Azure key vaults shown in the following table.

KV1 stores a secret named Secret1 and a key named Key1.
You back up Secret1 and Key1.
To which key vaults can you restore each backup. To answer, select the appropriate options in the answer area.
Note: Each correct selection is worth one point.
Hot Area:

  1. See Explanation section for answer.

Answer(s): A

Explanation:




KV1, KV2, and KV3 only
KV1, KV2, and KV3 only
Backups of both secrets and keys can be restored to vaults within the same Azure subscription and geography. KV1, KV2, and KV3 belong to Subscription1, and West US and East US are both within the United States geography.


Reference:

https://learn.microsoft.com/en-us/azure/key-vault/general/backup?tabs=azure-cli https://learn.microsoft.com/en-us/azure/key-vault/general/overview-security-worlds




Overview
Fabrikam, Inc. is a consulting company. The company has a main office in New York City and branch offices in Amsterdam and Singapore.
Existing Environment. Network environment
The on-premises network contains a datacenter in each office.
Existing Environment. Cloud environment
Fabrikam has two Azure subscriptions named Sub1 and Sub2 and a Microsoft 365 subscription that includes Microsoft 365 E5 licenses.
All the subscriptions are linked to a Microsoft Entra tenant named fabrikam.com that contains the identities shown in the following table.

The tenant contains the groups shown in the following table.

All devices are enrolled in Microsoft Intune.
Existing Environment. Sub1 Resources
Sub1 contains a resource group named RG1 that contains the resources shown in the following table.

SQLServer1 uses Microsoft SQL Server authentication.
Sub1 has an Azure Web Application Firewall (WAF) named WAF1 that has the following types of rule sets:
• Bot Manager 1.1
• Azure-managed Default Rule Set (DRS)
Sub1 has the following compliance standards assigned in Microsoft Defender for Cloud:
• NIST SP 800-53 Rev. 4
• Microsoft cloud security benchmark (MCSB)
• System and Organization Controls (SOC) 2 Type 2
Existing Environment. Sub2 Resources
Sub2 contains a resource group named RG2.
Planned Changes and Requirements. Planned Changes
Fabrikam plans to implement the following changes:
• Deploy the following key vaults to RG1:
o AKV2 in the West Europe Azure region o AKV3 in the Central US Azure region o AKV4 in the East US Azure region
• Deploy the following key vaults to RG2:
o AKV5 in the East US region
• Configure VM1 to read data from storage1.
• Create function apps that have the following hosting plans:
o Fa1: Flex Consumption hosting plan o Fa2: Consumption hosting plan o Fa3: Dedicated hosting plan
• For WAF1, implement rate limiting rules based on the request location.
• Enable the NIST SP 800-53 Rev. 5 compliance standard in Defender for Cloud.
• Create a new storage account named storage2 that supports Azure Table storage.
• Enforce multifactor authentication (MFA) when database administrators access SQLdb1.
• Implement ExpressRoute circuits to the on-premises network as shown in the following table.

• For RG1, create a new Privileged Identity Management (PIM) eligible role assignment that assigns the Contributor role to supported groups.
Planned Changes and Requirements. Technical Requirements
Fabrikam has the following technical requirements:
• If VM1 is deleted, the permissions for VM1 must be removed automatically.
• The AKS1 managed identity must only be able to pull images from Registry1.
• The ID1 managed identity must be able to push images to and pull images from Registry1.
• All the data in the storage accounts must be encrypted by using Fabrikam-managed keys.
• All outbound traffic from the function apps to the on-premises network must use ExpressRoute circuits.
• ExpressRoute connectivity between the on-premises network and the Azure environment must be encrypted by using Layer 2 or Layer 3 encryption.

You have an Azure subscription named Sub1 that is linked to a Microsoft Entra tenant named contoso.com.
Sub1 contains a Recovery Services vault named RSVault1 that stores virtual machines backups.
Your company’s security team maintains a dedicated Microsoft Entra tenant named security.contoso.com.
You need to ensure that modifying the backup settings of RSVault1 requires approval from an approver in security.contoso.com.
What should you do in contoso.com?

  1. Enable immutability for RSVault1 and lock the immutability setting.
  2. Create a private endpoint for RSVault1 on the virtual network.
  3. Configure Privileged Identity Management (PIM) activation for the Backup Operator role.
  4. Enable Multi-user authorization (MUA) for RSVault1.

Answer(s): D

Explanation:

To ensure that modifying the backup settings of the Recovery Services vault requires approval, you must configure Multi-user authorization (MUA) using Azure Resource Manager (ARM) Resource Guard.


Reference:

https://learn.microsoft.com/en-us/azure/backup/multi-user-authorization




Overview
Fabrikam, Inc. is a consulting company. The company has a main office in New York City and branch offices in Amsterdam and Singapore.
Existing Environment. Network environment
The on-premises network contains a datacenter in each office.
Existing Environment. Cloud environment
Fabrikam has two Azure subscriptions named Sub1 and Sub2 and a Microsoft 365 subscription that includes Microsoft 365 E5 licenses.
All the subscriptions are linked to a Microsoft Entra tenant named fabrikam.com that contains the identities shown in the following table.

The tenant contains the groups shown in the following table.

All devices are enrolled in Microsoft Intune.
Existing Environment. Sub1 Resources
Sub1 contains a resource group named RG1 that contains the resources shown in the following table.

SQLServer1 uses Microsoft SQL Server authentication.
Sub1 has an Azure Web Application Firewall (WAF) named WAF1 that has the following types of rule sets:
• Bot Manager 1.1
• Azure-managed Default Rule Set (DRS)
Sub1 has the following compliance standards assigned in Microsoft Defender for Cloud:
• NIST SP 800-53 Rev. 4
• Microsoft cloud security benchmark (MCSB)
• System and Organization Controls (SOC) 2 Type 2
Existing Environment. Sub2 Resources
Sub2 contains a resource group named RG2.
Planned Changes and Requirements. Planned Changes
Fabrikam plans to implement the following changes:
• Deploy the following key vaults to RG1:
o AKV2 in the West Europe Azure region o AKV3 in the Central US Azure region o AKV4 in the East US Azure region
• Deploy the following key vaults to RG2:
o AKV5 in the East US region
• Configure VM1 to read data from storage1.
• Create function apps that have the following hosting plans:
o Fa1: Flex Consumption hosting plan o Fa2: Consumption hosting plan o Fa3: Dedicated hosting plan
• For WAF1, implement rate limiting rules based on the request location.
• Enable the NIST SP 800-53 Rev. 5 compliance standard in Defender for Cloud.
• Create a new storage account named storage2 that supports Azure Table storage.
• Enforce multifactor authentication (MFA) when database administrators access SQLdb1.
• Implement ExpressRoute circuits to the on-premises network as shown in the following table.

• For RG1, create a new Privileged Identity Management (PIM) eligible role assignment that assigns the Contributor role to supported groups.
Planned Changes and Requirements. Technical Requirements
Fabrikam has the following technical requirements:
• If VM1 is deleted, the permissions for VM1 must be removed automatically.
• The AKS1 managed identity must only be able to pull images from Registry1.
• The ID1 managed identity must be able to push images to and pull images from Registry1.
• All the data in the storage accounts must be encrypted by using Fabrikam-managed keys.
• All outbound traffic from the function apps to the on-premises network must use ExpressRoute circuits.
• ExpressRoute connectivity between the on-premises network and the Azure environment must be encrypted by using Layer 2 or Layer 3 encryption.

You have a Microsoft Entra tenant that uses Microsoft Entra Agent ID.
You have multiple Microsoft Foundry agents that have agent identities assigned.
You discover that one of the identities is flagged as high risk due to unusual sign-in activity.
You need to ensure that agent access to resources is restricted automatically based on risk.
What should you create?

  1. a Privileged Identity Management (PIM) activation policy
  2. an Access review for the identities
  3. a Conditional Access policy for the identities
  4. a Microsoft Entra role assignment policy

Answer(s): C

Explanation:

To automatically restrict agent access to resources based on risk, you should create a Conditional Access policy for agent identities integrated with Microsoft Entra ID Protection. This monitors and revokes or blocks token issuance when an agent's sign-in is flagged at a high risk level.


Reference:

https://learn.microsoft.com/en-us/entra/id-protection/concept-workload-identity-risk



PDF
Viewing page 6 of 27

Share your comments for Microsoft SC-500 exam with other users:

G
gayathiri
7/6/2023 12:10:00 AM

i need dump

UNITED STATES
D
Deb
8/15/2023 8:28:00 PM

love the site.

UNITED STATES
M
Michelle
6/23/2023 4:08:00 AM

can you please upload it back?

Anonymous
A
Ajay
10/3/2023 12:17:00 PM

could you please re-upload this exam? thanks a lot!

Anonymous
H
him
9/30/2023 2:38:00 AM

great about shared quiz

Anonymous
S
San
11/14/2023 12:46:00 AM

goood helping

Anonymous
W
Wang
6/9/2022 10:05:00 PM

pay attention to questions. they are very tricky. i waould say about 80 to 85% of the questions are in this exam dump.

UNITED STATES
M
Mary
5/16/2023 4:50:00 AM

wish you would allow more free questions

Anonymous
T
thomas
9/12/2023 4:28:00 AM

great simulation

Anonymous
S
Sandhya
12/9/2023 12:57:00 AM

very g inood

Anonymous
A
Agathenta
12/16/2023 1:36:00 PM

q35 should be a

Anonymous
M
MD. SAIFUL ISLAM
6/22/2023 5:21:00 AM

sap c_ts450_2021

Anonymous
S
Satya
7/24/2023 3:18:00 AM

nice questions

UNITED STATES
S
sk
5/13/2023 2:10:00 AM

ecellent materil for unserstanding

INDIA
G
Gerard
6/29/2023 11:14:00 AM

good so far

Anonymous
L
Limbo
10/9/2023 3:08:00 AM

this is way too informative

BOTSWANA
T
Tejasree
8/26/2023 1:46:00 AM

very helpfull

UNITED STATES
Y
Yolostar Again
10/12/2023 3:02:00 PM

q.189 - answers are incorrect.

Anonymous
S
Shikha Bakra
9/10/2023 5:16:00 PM

awesome job in getting these questions

AUSTRALIA
K
Kevin
10/20/2023 2:01:00 AM

i cant find aws certified practitioner clf-c01 exam in aws website but i found aws certified practitioner clf-c02 exam. can everyone please verify the difference between the two clf-c01 and clf-c02? thank you

UNITED STATES
D
D Mario
6/19/2023 10:38:00 PM

grazie mille. i got a satisfactory mark in my exam test today because of this exam dumps. sorry for my english.

ITALY
B
Bharat Kumar Saraf
10/31/2023 4:36:00 AM

some of the answers are incorrect. need to be reviewed.

HONG KONG
J
JP
7/13/2023 12:21:00 PM

so far so good

Anonymous
K
Kiky V
8/8/2023 6:32:00 PM

i am really liking it

Anonymous
T
trying
7/28/2023 12:37:00 PM

thanks good stuff

UNITED STATES
E
exampei
10/4/2023 2:40:00 PM

need dump c_tadm_23

Anonymous
E
Eman Sawalha
6/10/2023 6:18:00 AM

next time i will write a full review

GREECE
J
johnpaul
11/15/2023 7:55:00 AM

first time using this site

ROMANIA
O
omiornil@gmail.com
7/25/2023 9:36:00 AM

please sent me oracle 1z0-1105-22 pdf

BANGLADESH
J
John
8/29/2023 8:59:00 PM

very helpful

Anonymous
K
Kvana
9/28/2023 12:08:00 PM

good info about oml

UNITED STATES
C
Checo Lee
7/3/2023 5:45:00 PM

very useful to practice

UNITED STATES
D
dixitdnoh@gmail.com
8/27/2023 2:58:00 PM

this website is very helpful.

UNITED STATES
S
Sanjay
8/14/2023 8:07:00 AM

good content

INDIA
AI Tutor 👋 I’m here to help!