SC-500 sample exam questions

Assigning the policy at the MG1 management group scope covers all current and future subscriptions, and an exclusion (notScopes) for RG-Exception exempts that resource group. Assigning to a resource group cannot be done as an inclusion with a subscription, and assigning to Sub1 would miss Sub2.

Microsoft Authenticator offers passwordless phone sign-in from a mobile device. A Temporary Access Pass is a time-limited passcode issued by an administrator or helpdesk, letting new users sign in and register passwordless methods without ever having a password.

A Private Link service in front of VM1 and VM2, behind a Standard Load Balancer, exposes only those machines. A private endpoint in VNet2 connects to it, even across tenants. Peering or a VPN would open wider network reachability into Sub1.

A hunting query is a manual proactive search of data. It cannot assign incidents or set tags when incidents are created. Incident assignment and flagging at creation requires an automation rule.

A Delete lock still allows updates, so it would not prevent changes. A Read-only lock on VNet1 blocks both updates and deletions of that resource only, leaving other resources in RG1 editable. Applying it at the RG1 scope would block changes to storage1 as well.

User2 is excluded from the CA2 block, so only CA1 applies and sign-in succeeds with MFA and a compliant device. User3 is subject to CA2, which blocks access outside HQ-Trusted. User1 is excluded from CA1, and CA2 does not apply on HQ-Trusted, so no MFA is requested.

Create a private endpoint for KV1 so App1 reaches it by a private IP in VNet1 (resolved through the Private DNS zone), and disable public network access so requests from outside are denied. IP rules and access policies are permission or firewall settings that do not provide private connectivity.

A user delegation SAS is signed with Microsoft Entra credentials, can be limited to write/create permission on a container and a short expiry, so it gives time-bound, least-privilege upload access to an external party. Managed identities cannot be used by third-party systems, and Shared Key or anonymous access are broad.

Storage Blob Data Reader scoped to container1 grants read access to its blobs and nothing else. Browsing in the Azure portal also needs a management plane role to navigate to the account, and Reader on storage1 is the least privileged role that allows this.

IP rules for storage firewalls cannot allow Azure VM private IPs in the same region. Enabling the Microsoft.Storage service endpoint on Subnet1 and adding that subnet as a virtual network rule lets VM1 in, while the IP rule keeps the external app allowed. Opening all networks removes protection.

Security Reader lets Group1 view recommendations and security alerts, including multicloud AWS findings, without any change rights. Reader does not include security data access, while Owner and Security Administrator exceed least privilege.

Risk levels for recommendations are a feature of the Defender CSPM plan (risk prioritization). The Foundational CSPM plan leaves them as Not evaluated, so enable Defender CSPM. Arc onboarding, Defender for Servers and compliance standards do not assign risk levels.

Conditional Access supports Microsoft Entra Agent ID identities, so a policy using agent identity risk as a condition can block or restrict access automatically for high-risk agents. PIM, access reviews and role assignment policies are not risk-driven and are not automatic for sign-in risk.

To use Key Vault references for named values, APIM1 needs a managed identity with access to the vault, so enabling a managed identity is the first step. Then the named value is changed to a Key Vault secret reference. Marking it secret alone does not satisfy the recommendation.

Tenant-wide admin consent requires a role such as Application Administrator, Cloud Application Administrator or Privileged Role Administrator. Application Developer, Azure DevOps Administrator and Security Operator lack it, and owning an enterprise application or being assigned to it does not grant that right.