Free Microsoft SC-500 Full-Length Practice Exam: 60 Questions

This free full-length Microsoft SC-500 practice exam includes 60 original IT Mastery questions across the exam domains.

These questions are for self-assessment. They are not official exam questions and do not imply affiliation with the exam sponsor.

Count note: this page uses the full-length practice count maintained in the Mastery exam catalog. Some certification vendors publish total questions, scored questions, duration, or unscored/pretest-item rules differently; always confirm exam-day rules with the sponsor.

Need concept review first? Read the Microsoft SC-500 cheat sheet for cloud security, AI security, Entra, Defender, Sentinel, governance, threat protection, and secure-design cues before starting another diagnostic.

Exam snapshot

• Exam route: Microsoft SC-500
• Practice-set question count: 60
• Time limit: 120 minutes
• Practice style: mixed-domain diagnostic run with answer explanations

Full-length exam mix

Use this as one diagnostic run. IT Mastery gives you timed mocks, topic drills, analytics, code-reading practice where relevant, and full practice.

Practice questions

Questions 1-25

Question 1

Topic: Manage Identity, Access, and Governance

A security team suspects developers copied production secrets from Azure Key Vault into VM configuration files and container images. You must create a remediation queue that shows which cloud resources contain exposed secret values, without deploying agents or relying on Key Vault access logs. What should you implement?

Options:

• A. Enable Defender CSPM and review secret scanning findings in Defender for Cloud.

• B. Enable Defender for Key Vault and review vault access alerts.

• C. Audit Key Vault configuration with Azure Policy only.

• D. Collect Key Vault diagnostic logs in Microsoft Sentinel.

Best answer: A

Explanation: Defender Cloud Security Posture Management (Defender CSPM) secret scanning is used to identify exposed secrets found in cloud resources, such as files on compute assets or container images. Those signals help security teams create a remediation queue because they point to the affected resource and the type of exposed secret so the team can remove the copy and rotate the credential in its authoritative store, such as Azure Key Vault.

Defender for Key Vault and diagnostic logs help monitor vault operations, but they do not prove that a copied secret value exists elsewhere. Azure Policy can enforce configuration standards, but it does not discover plaintext secrets already exposed in workloads.

• Key Vault alerts detect suspicious vault activity, not exposed secret copies on compute resources.
• Policy-only auditing can find configuration drift but cannot scan workloads for secret values.
• Sentinel log collection centralizes events, but logs alone do not provide Defender CSPM secret exposure signals.

Question 2

Topic: Manage and Monitor Security Posture

A security engineer reviews a Microsoft Defender External Attack Surface Management (EASM) result for Contoso. The web service is externally reachable as designed, but all approved public assets must appear in the CMDB with an owner. Which classification best fits the primary issue?

Options:

• A. Unmanaged asset needing ownership assignment

• B. Exposed asset needing exposure reduction

• C. False positive requiring no action

• D. Vulnerability needing patch remediation

Best answer: A

Explanation: In Defender EASM, the classification should follow the strongest evidence in the discovery result. Here, DNS and TLS signals indicate the host belongs to Contoso, but the asset is absent from the approved inventory and has no assigned owner. That is an unmanaged asset: it likely belongs to the organization, but it is not governed, owned, or tracked. An exposed asset would be driven by an unintended or risky public exposure, such as an unexpected service or open administrative port. A vulnerability remediation item would require evidence such as a CVE, weak TLS configuration, or vulnerable software. The key takeaway is to separate ownership gaps from exposure and vulnerability findings.

• Exposure reduction fails because HTTPS is an approved pattern and the stem says the service is reachable as designed.
• Patch remediation fails because the result shows no CVE, weak TLS, or vulnerable software signal.
• No-action false positive fails because DNS and TLS ownership signals tie the host to Contoso.

Question 3

Topic: Manage Identity, Access, and Governance

During a quarterly access validation, you review Azure subscription role assignments. A database administrator has the Owner role assigned directly on the production subscription with no expiration. The organization requires privileged Azure RBAC access to be just-in-time, approved, and MFA-enforced through Microsoft Entra Privileged Identity Management (PIM). What is the best next step?

Options:

• A. Apply a resource lock to the subscription

• B. Require MFA with a Conditional Access policy

• C. Create an access review for all Owners

• D. Replace the direct assignment with a PIM eligible assignment

Best answer: D

Explanation: Privileged Azure RBAC access should not remain as an unmanaged, permanent direct assignment when the standard requires PIM governance. A PIM eligible assignment lets the administrator request activation only when needed, and PIM role settings can enforce approval, MFA, justification, and activation duration. Because the validation already found a standing Owner assignment, the logical remediation is to move that access into PIM and remove the direct active assignment. Controls such as MFA or access reviews can support governance, but they do not by themselves eliminate standing privileged access outside PIM.

• MFA only improves sign-in assurance but leaves the permanent Owner assignment unmanaged.
• Access review can help validate access later, but it does not immediately govern activation through PIM.
• Resource lock protects resources from changes or deletion, not privileged identity assignment governance.

Question 4

Topic: Manage Identity, Access, and Governance

A security engineer creates a custom Microsoft Entra role for a role-assignable regional helpdesk group. The role contains only the directory permission needed to update user profile attributes and is assigned at the Sales administrative unit scope. Which validation evidence best confirms that the tailored directory-level scope is working?

Options:

• A. Graph test: update succeeds for Sales and is denied outside Sales.

• B. PIM history: a helpdesk member activated the role during testing.

• C. Audit log: custom role definition and group assignment were created.

• D. Azure Activity log: the group has no subscription role assignments.

Best answer: A

Explanation: A Microsoft Entra custom role controls directory-level permissions, and an administrative unit assignment limits where those permissions apply. The strongest validation is an effective authorization result at the intended boundary: the permitted profile update works for a user inside the Sales administrative unit and fails for a comparable user outside it. That proves the custom role is not just assigned, but enforced with the expected scope. Configuration and activation records are useful audit evidence, but they do not prove the protection outcome.

• Creation audit only shows the role and assignment were configured, not that scoped authorization is enforced.
• Azure Activity logs validate Azure RBAC activity, not Microsoft Entra directory role scope.
• PIM activation shows temporary use of a role, but not whether the custom permissions are constrained to Sales.

Question 5

Topic: Secure Storage, Databases, and Networking

An application running on VMs in prod-vnet must connect to an Azure SQL logical server by using sql-prod.database.windows.net. Security policy requires private IP connectivity and prohibits opening the SQL server to public networks. Public network access on the SQL server is disabled. Which TWO actions should you implement? Select TWO.

Options:

• A. Create a private endpoint for the SQL server.

• B. Enable the Microsoft.Sql service endpoint on app-subnet.

• C. Allow Azure services through the SQL firewall.

• D. Link the privatelink.database.windows.net private DNS zone to prod-vnet.

• E. Add an outbound NSG rule for the AzureSql service tag.

• F. Set SQL public network access to All networks.

Correct answers: A and D

Explanation: Azure Private Endpoint uses Azure Private Link to expose a PaaS resource through a private IP address in a virtual network. For Azure SQL, the private endpoint provides the private network path, and the linked private DNS zone ensures that clients using sql-prod.database.windows.net resolve to the private endpoint instead of the public endpoint. This matches the requirement because public network access remains disabled. Firewall exceptions, service tags, and service endpoints can be useful in other designs, but they do not provide the same private endpoint behavior when the stated requirement is private access without broad public exposure.

• All networks violates the requirement by broadly opening the public endpoint.
• Service endpoint does not create a private endpoint IP for the SQL server.
• Service tag NSG only permits outbound traffic to Azure SQL ranges; it does not configure Private Link.
• Azure services exception is a broad firewall allowance, not private connectivity.

Question 6

Topic: Secure Storage, Databases, and Networking

An Azure Storage account contains multiple blob containers. A vendor must download files from only the monthly-exports container for 7 days by using a SAS URL; the vendor cannot use Microsoft Entra authentication. The draft plan uses an account SAS generated from an account key. Security rejects the plan because access must be revocable and must not expose other containers. What should you implement next?

Options:

• A. A stored access policy-backed service SAS

• B. Storage Blob Data Reader at account scope

• C. An account SAS limited to Blob service

• D. Anonymous read access on the container

Best answer: A

Explanation: For a vendor that must use a SAS URL and access only one blob container, use a service SAS scoped to that container. Associating the service SAS with a stored access policy lets you manage expiry and permissions centrally after the SAS is issued, including revoking access by changing or deleting the policy. An account SAS is broader because it is scoped at the storage account service/resource-type level rather than a single container. Public access and account-scope RBAC do not meet the stated constraints.

• Account SAS scope is still too broad because it is not limited to only the monthly-exports container.
• Anonymous access exposes the container publicly instead of creating controlled, revocable vendor access.
• Account-scope RBAC requires Microsoft Entra authentication and can grant access beyond the one required container.

Question 7

Topic: Secure Storage, Databases, and Networking

A subnet in an Azure virtual network hosts web, API, and batch VMs. The subnet has an NSG with only default rules. The VMs scale frequently, so the security team must avoid IP-based rule updates. You need to allow only web VMs to reach API VMs on TCP 8443. Which implementation should you use?

Options:

• A. Tag VMs as web or API; reference the tags in NSG source and destination fields.

• B. Associate NICs to Web-ASG and API-ASG; add only an allow Web-ASG to API-ASG rule.

• C. Create ASGs for each subnet; associate the ASGs with subnet route tables.

• D. Associate NICs to Web-ASG and API-ASG; allow Web-ASG to API-ASG, then deny Any to API-ASG on TCP 8443.

Best answer: D

Explanation: Application security groups group VM network interfaces so NSG rules can target workload roles instead of IP prefixes. Because the web, API, and batch VMs share the same subnet and the NSG still has default rules, an allow rule alone is not enough: the default AllowVNetInBound rule can still permit other VNet sources. The implementation should associate the relevant NICs with Web-ASG and API-ASG, then create an allow rule for Web-ASG to API-ASG on TCP 8443 and a later explicit deny for other sources to API-ASG on that port. This keeps rules stable as VMs scale while enforcing workload-level segmentation.

• Resource tags fail because NSG rules cannot use VM tags as source or destination selectors.
• Subnet ASGs fail because ASGs are associated with network interfaces, not route tables or subnets.
• Allow-only targeting fails because default NSG rules can still allow other VNet traffic to the API VMs.

Question 8

Topic: Manage Identity, Access, and Governance

A company is deploying an internal claims workload on Azure App Service and Azure Functions. The workload must use a database connection string, a TLS certificate, and a customer-managed key. Security requires centralized lifecycle control, private network access, and identity-based access without storing credentials in code. Which design is the best fit?

Options:

• A. Use App Service settings and uploaded certificates per workload.

• B. Deploy Azure Key Vault with private endpoint and managed identity access.

• C. Store secrets in Azure Storage with firewall rules.

• D. Use Azure Managed HSM for all secrets and certificates.

Best answer: B

Explanation: Azure Key Vault is the right design when a workload needs centralized protection and lifecycle management for keys, secrets, and certificates. In this scenario, the workload needs all three object types, must avoid credentials in code, and must be reachable only through private networking. Key Vault supports storing secrets and certificates, using keys such as customer-managed keys, authorizing workloads through managed identities, and restricting network access with private endpoints and firewall controls. The key takeaway is that Key Vault is the centralized security boundary for these sensitive objects; other services may store configuration or keys in narrower cases, but they do not satisfy all stated requirements together.

• App settings can hold configuration but do not provide centralized vault lifecycle control for keys, secrets, and certificates.
• Managed HSM is focused on dedicated HSM-backed key management and does not store Key Vault secrets or certificates.
• Azure Storage firewall rules can restrict network access, but storage is not the correct vault for secrets, certificates, and customer-managed keys.

Question 9

Topic: Manage and Monitor Security Posture

A security engineering team uses Microsoft Defender for Cloud for Azure subscriptions and connected AWS accounts. They need to prioritize remediation by exploitable risk paths and exposed identities across cloud assets, and they must provide auditors with control-by-control status against a named compliance framework. They do not want to build a SIEM correlation pipeline for this requirement. Which design is the best fit?

Options:

• A. Use regulatory compliance for risk paths and Defender CSPM for audit status.

• B. Use Defender CSPM for risk paths and regulatory compliance for framework status.

• C. Use Microsoft Sentinel analytics for both posture risk and audit framework status.

• D. Enable Defender for Servers plans to replace posture and compliance evaluation.

Best answer: B

Explanation: Defender for Cloud separates posture-risk identification from compliance evaluation. Defender CSPM is the posture management capability used to identify and prioritize risk, such as attack paths, exposed resources, permissions issues, and other contextual findings across cloud assets. Regulatory compliance in Defender for Cloud evaluates resource configuration against assigned standards and presents control-level compliance status for frameworks such as CIS, NIST, or similar benchmarks. In this scenario, the engineering team needs both views: risk-based prioritization for remediation and framework-mapped evidence for auditors. Microsoft Sentinel and workload protection plans can be valuable, but they do not replace these Defender for Cloud posture and compliance experiences.

• Swapped capability mapping fails because compliance views report framework status, not exploitable attack-path prioritization.
• SIEM analytics overbuilds the requirement and does not provide native Defender for Cloud regulatory compliance scoring.
• Workload protection plans detect and protect specific workload types, but they do not replace CSPM posture analysis or compliance evaluation.

Question 10

Topic: Manage Identity, Access, and Governance

Your organization must provide auditors with Azure subscription evidence against NIST SP 800-53 R5. The auditors need control-level pass/fail status and related remediation recommendations from Microsoft Defender for Cloud. The standard is not currently visible for the in-scope management group. Which two actions should you perform? Select TWO.

Options:

• A. Enable the Microsoft Sentinel Azure Activity connector

• B. Add resource locks to all in-scope subscriptions

• C. Enable Defender for Servers Plan 2 for every subscription

• D. Export the standard’s compliance report from Regulatory compliance

• E. Assign the NIST SP 800-53 R5 standard to the scope

• F. Query Microsoft Purview Audit for Azure control mappings

Correct answers: D and E

Explanation: Microsoft Defender for Cloud evaluates regulatory compliance by assessing resources against assigned security standards, which are policy-based initiatives mapped to framework controls. If the required framework is not visible for the in-scope management group or subscription, you first assign that regulatory standard to the scope. After assessment data is available, the Regulatory compliance page shows control-level status, affected resources, and related recommendations, and it can be used to export evidence for auditors. Workload protection plans or log collection tools can add useful security coverage, but they do not replace assigning the framework and using Defender for Cloud’s compliance view for framework evidence.

• Sentinel connector collects Azure activity logs but does not evaluate resources against NIST control mappings.
• Purview Audit searches audit records; it is not the Defender for Cloud regulatory compliance evidence source.
• Resource locks prevent accidental changes but do not create framework pass/fail evidence.
• Defender for Servers may add server assessments, but it is not the required step to assign or report on the standard.

Question 11

Topic: Manage and Monitor Security Posture

An organization uses Microsoft Defender for Cloud. Security operations needs to identify exploitable risk chains across subscriptions, such as a public endpoint combined with an overprivileged identity. Compliance needs pass/fail status against a specific framework such as CIS or PCI DSS. Which statement correctly distinguishes these capabilities?

Options:

• A. Regulatory compliance identifies risk paths; Defender CSPM evaluates framework controls.

• B. Defender CSPM is limited to assigned standards; regulatory compliance prioritizes toxic combinations.

• C. Workload protection plans calculate compliance; Defender CSPM stores audit evidence.

• D. Defender CSPM identifies risk paths; regulatory compliance evaluates framework controls.

Best answer: D

Explanation: Defender Cloud Security Posture Management is used to identify and prioritize posture risk, including attack paths, toxic combinations, internet exposure, and identity-related exposure across cloud resources. Regulatory compliance in Defender for Cloud evaluates resources against selected standards and controls, then reports compliance state, failed controls, and compliance score for audit and governance purposes. The same resource can appear in both contexts, but the purpose differs: CSPM explains risk and remediation priority, while regulatory compliance explains control alignment against a framework.

• Reversed roles fails because compliance dashboards do not replace CSPM attack path and contextual risk analysis.
• Standards-only CSPM fails because Defender CSPM is not limited to assigned compliance frameworks.
• Workload plan confusion fails because workload protection plans enable threat protection capabilities, not the compliance scoring boundary described here.

Question 12

Topic: Manage and Monitor Security Posture

A company wants Microsoft Sentinel to ingest Windows Security events from 200 on-premises Windows servers. The collection design requires Windows Event Forwarding (WEF), and only the collector server can run an Azure monitoring agent. Which configuration should you implement?

Options:

• A. Configure the Syslog connector on a Linux forwarder.

• B. Export EVTX files to a custom log table on a schedule.

• C. Install Azure Monitor Agent on each Windows server and skip WEF.

• D. Configure WEF to a Windows Event Collector and install Azure Monitor Agent on the collector.

Best answer: D

Explanation: When WEF is part of the design, Windows source computers forward events to a Windows Event Collector (WEC). The Azure Monitor Agent should be installed on the WEC, not on every source computer, and the Microsoft Sentinel Windows Security Events collection rule should target that collector. This keeps the design aligned with the agent-placement requirement while still sending Windows Security event data into Sentinel. Installing agents on every server ignores the stated WEF design, and Syslog or scheduled EVTX upload does not implement Windows Security event collection through WEF.

• Per-server agents fail because the stem allows the Azure monitoring agent only on the collector server.
• Syslog forwarding is for Linux/syslog-style sources, not native Windows Security event collection through WEF.
• Scheduled EVTX upload is not the normal Sentinel WEF collection path and would not provide the intended event-forwarding design.

Question 13

Topic: Manage Identity, Access, and Governance

A company has production and development Azure subscriptions under the same tenant. Auditors require only production resources to be assessed against the Microsoft cloud security benchmark and ISO 27001 in Microsoft Defender for Cloud. Development must retain its existing benchmark assessment, and application teams need read-only compliance visibility. Which design best fits these requirements?

Options:

• A. Grant application teams Owner to manage standards

• B. Create Microsoft Sentinel analytics for ISO controls

• C. Enable Defender CSPM on all subscriptions only

• D. Assign required standards to production scopes; grant Security Reader

Best answer: D

Explanation: Defender for Cloud security standards map resources to benchmark or regulatory expectations by using policy-backed compliance assessments at the selected scope. Because only production must be assessed against ISO 27001, the standards should be assigned only to the production subscription or production management-group scope. Development can keep its existing benchmark configuration without inheriting the production-only standard. Application teams can view compliance posture with a read-only role such as Security Reader instead of receiving permissions to change policy assignments or standards. The key design point is scope control plus least-privilege visibility.

• CSPM only improves posture-management capabilities, but it does not by itself select the required compliance standards for the production scope.
• Sentinel analytics can monitor security data, but it is not the control used to configure Defender for Cloud compliance standards.
• Owner access would let app teams change standards and other resources, which weakens least privilege for a read-only visibility requirement.

Question 14

Topic: Manage and Monitor Security Posture

A security team is configuring a Microsoft Security Copilot workspace for an alert-triage workflow. Analysts must be able to correlate Microsoft Sentinel incidents with Microsoft Defender XDR device evidence. The workspace must not use Microsoft Purview or Microsoft Intune capabilities for this workflow, even if a prompt mentions them. What should you configure?

Options:

• A. Enable only the Sentinel and Defender XDR plugins.

• B. Enable all Microsoft plugins and add prompt instructions.

• C. Assign analysts Security Copilot Owner permissions only.

• D. Disable all plugins and use only the base model.

Best answer: A

Explanation: Microsoft Security Copilot plugins determine which product capabilities and data sources Copilot can call during a workflow. To align enabled capabilities with a specific triage workflow, enable the plugins that support the required tasks and keep unrelated plugins disabled. In this case, Microsoft Sentinel and Microsoft Defender XDR are needed for incident and device-evidence correlation. Microsoft Purview and Microsoft Intune should remain disabled for the workspace because they are outside the stated workflow. Underlying product permissions still control what data users can access, but permissions do not replace plugin scoping. The key takeaway is to scope plugins to the intended security workflow instead of relying on broad enablement or prompt wording.

• Prompt-only control fails because instructions do not remove available plugin capabilities from the workspace.
• No-plugin approach fails because Copilot would lack the required Sentinel and Defender XDR capabilities.
• Role-only change fails because Copilot roles do not select which plugins match the workflow.

Question 15

Topic: Secure Compute

A security engineer enabled Defender for Servers Plan 2 for a subscription and configured Microsoft Defender Vulnerability Management for protected Azure VMs and Azure Arc-enabled servers. The engineer must validate that vulnerability scanning is working for a specific Arc-enabled Windows server, not only that onboarding occurred. Which evidence best validates the control?

Options:

• A. Recent vulnerability assessment results for the server

• B. Activity log shows Defender for Servers enabled

• C. Azure Arc machine status shows Connected

• D. Defender for Endpoint sensor health shows Active

Best answer: A

Explanation: For Defender for Servers vulnerability scanning, validation should come from vulnerability assessment output for the protected workload. A recent result in Defender for Cloud or Microsoft Defender Vulnerability Management that identifies assessed software, CVEs, or a clean assessment state confirms the scanner is operating against that server. Plan enablement, Arc connectivity, and endpoint sensor health are useful prerequisites or related signals, but they do not prove that vulnerability assessment ran and produced results for the workload. The strongest evidence is workload-specific vulnerability assessment data with a recent timestamp or status.

• Arc connectivity only proves the server is managed through Azure Arc; it does not confirm vulnerability assessment results.
• Plan enablement records configuration activity at the subscription level, not scan execution for the server.
• Sensor health supports endpoint detection and response, but it is not itself vulnerability assessment output.

Question 16

Topic: Secure Storage, Databases, and Networking

A spoke VNet subnet hosts Azure VM build agents with no public IP addresses. A route table sends 0.0.0.0/0 to Azure Firewall in the hub, and policy allows only required HTTPS egress. The agents cannot reach packages.contoso.com. Network Watcher shows the NSG allows the flow and the next hop is Azure Firewall; Azure Firewall logs show Deny for TCP 443 to packages.contoso.com. Which remediation is the best fit?

Options:

• A. Remove the default route from the build-agent subnet

• B. Create an Azure Firewall DNAT rule for the FQDN

• C. Add a broad NSG outbound Internet rule for TCP 443

• D. Add a scoped Firewall Policy application rule for the FQDN

Best answer: D

Explanation: The validation evidence isolates the problem to Azure Firewall, not the subnet NSG or routing. Network Watcher confirms that the flow is allowed by the NSG and is correctly forced through the firewall. The firewall log then shows the actual deny decision. The least-privilege remediation is to update Azure Firewall Policy with an application rule scoped to the build-agent source and the required destination FQDN over HTTPS. This fixes the required egress path without bypassing inspection or opening unrelated destinations.

• NSG allow rule misses the evidence because the NSG already allows the flow and a broad Internet rule weakens egress control.
• Route removal bypasses the required firewall inspection path and changes unrelated network protections.
• DNAT rule applies to inbound translation scenarios, not outbound HTTPS access to an external FQDN.

Question 17

Topic: Manage Identity, Access, and Governance

A security engineer reviews Microsoft Defender for Cloud and sees the recommendation: “Azure Key Vault should have purge protection enabled” for kv-payroll-prod. The vault already has soft delete enabled and meets the required network firewall and Azure RBAC settings. The team must remediate only the finding that generated the recommendation. What should you do next?

Options:

• A. Create an exemption for the recommendation.

• B. Switch the vault to access policy authorization.

• C. Enable purge protection on kv-payroll-prod.

• D. Disable public network access on kv-payroll-prod.

Best answer: C

Explanation: Defender for Cloud recommendations should be remediated by addressing the exact configuration gap identified in the finding. In this case, the recommendation is about Key Vault purge protection, and the stem states that soft delete is already enabled and the network and RBAC settings are already compliant. The next implementation step is to enable purge protection on the affected vault. Creating an exemption or changing network and authorization settings would either hide the recommendation or alter controls that are not related to the finding.

• Network hardening fails because public network access is not the reported issue.
• Policy exemption fails because it suppresses the finding instead of remediating it.
• Authorization model change fails because switching access models changes unrelated access controls.

Question 18

Topic: Secure Compute

Your organization protects Azure VMs with Microsoft Defender for Cloud. A production change freeze prevents installing or updating VM agents, but the security team must collect vulnerability and secret exposure findings from VM disks. The requirement must be met through Defender for Servers for the subscription. Which configuration should you apply?

Options:

• A. Enable a Microsoft Sentinel data connector for Azure Activity.

• B. Enable Defender for Servers Plan 1 and install the MDE extension.

• C. Assign Azure Policy to deploy the Azure Monitor Agent.

• D. Enable Defender for Servers Plan 2 with agentless scanning.

Best answer: D

Explanation: Agentless VM scanning in Microsoft Defender for Cloud is implemented by enabling the appropriate Defender for Servers capability, specifically Plan 2 with agentless scanning for machines. This scans VM disk snapshots to surface findings such as vulnerabilities and exposed secrets without requiring an agent to be installed on the VM. That matches the change-freeze constraint because the scanning path is outside the guest operating system. Agent-based options can still be useful for other protection scenarios, but they do not meet a requirement that explicitly avoids agent deployment.

• MDE extension fails because it requires installing an agent on each VM.
• Azure Monitor Agent fails because it is an agent-deployment approach, not agentless scanning.
• Sentinel connector fails because Azure Activity ingestion collects control-plane logs, not VM disk vulnerability findings.

Question 19

Topic: Secure Storage, Databases, and Networking

A company has an Azure Storage account that receives blob uploads from several external partners. The partners use SAS tokens, and their source IP ranges change frequently. Security requires storage workload threat detection for malicious uploads and suspicious access attempts, but partner uploads must continue without new network dependencies. What should you configure?

Options:

• A. Send only storage diagnostic logs to Sentinel

• B. Enable Defender for Storage with malware scanning

• C. Restrict the storage firewall to partner IP ranges

• D. Enable customer-managed keys for the account

Best answer: B

Explanation: Microsoft Defender for Storage is the workload protection control for storage threat detection. In this scenario, the requirement is not just to harden access; it is to detect malicious uploads and suspicious access while preserving the existing partner upload flow. Enabling Defender for Storage for the storage account and configuring malware scanning addresses that risk directly. It can generate security alerts and scan uploaded blobs without depending on stable partner IP ranges. Network firewall rules, encryption settings, and raw diagnostic logs may support broader security goals, but they do not replace Defender for Storage threat protection.

• Firewall restriction may reduce exposure, but changing IP-based access would likely disrupt partners with changing source ranges.
• Customer-managed keys protect data at rest, but they do not detect malicious uploads or suspicious storage activity.
• Diagnostic logs only provide telemetry, but they do not enable Defender for Storage detections or malware scanning.

Question 20

Topic: Manage and Monitor Security Posture

A company has a Microsoft Sentinel workspace and is onboarding a new firewall product. The security team wants Microsoft-maintained packaged content that includes the data connector, analytics rule templates, workbooks, and hunting queries so the set can be deployed and updated together. Which action should you take?

Options:

• A. Import a workbook from the Workbooks gallery.

• B. Create analytics rules from rule templates.

• C. Configure the firewall data connector only.

• D. Install the relevant solution from Content hub.

Best answer: D

Explanation: Microsoft Sentinel Content hub is used when the requirement is to deploy packaged content for a product, service, or scenario. A solution can include multiple content types, such as data connectors, analytics rule templates, hunting queries, workbooks, parsers, and automation components. After installing the solution, the engineer can configure the included connector and enable or customize the included rules as needed. A data connector by itself focuses on log ingestion, while analytics rules and workbooks address only detection or visualization content. The key distinction is that Content hub manages the packaged solution boundary, not just one individual Sentinel content item.

• Rule templates only misses the packaged deployment requirement because analytics rules cover detections, not the full content set.
• Connector only handles ingestion but does not deploy workbooks, hunting queries, or rule templates as a solution.
• Workbook import addresses visualization only and does not manage the firewall content package.

Question 21

Topic: Secure Storage, Databases, and Networking

A security engineer investigates 403 errors when an Azure Function uses its system-assigned managed identity to read blobs from storage account stfin01. The identity has Storage Blob Data Reader on the storage account.

What is the most likely root cause?

Options:

• A. The managed identity lacks a data-plane RBAC role.

• B. The storage firewall blocks the Function outbound source.

• C. A stored access policy for the container was revoked.

• D. Defender for Storage blocked the blob read.

Best answer: B

Explanation: Azure Storage authorization depends on both identity authorization and network access rules. The managed identity already has a blob data-plane role, and the request uses OAuth, so the visible evidence does not point first to a missing RBAC permission or SAS policy issue. The storage account allows only a specific IP range and subnet, while the Function is using a different outbound IP and is not integrated with the allowed subnet. That makes the storage firewall the likely source of the 403. Defender for Storage can detect suspicious storage activity and raise alerts, but it is not the control that blocks this read request.

• Missing RBAC role is not supported because the stem states the managed identity already has Storage Blob Data Reader.
• Revoked access policy does not fit because stored access policies apply to SAS-based access, not OAuth managed identity access.
• Defender blocking is a trap because Defender for Storage provides threat detection and alerts, not data-plane allow/deny enforcement.

Question 22

Topic: Manage Identity, Access, and Governance

A security engineer configures an Azure Key Vault to deny public network access and allow traffic only through a private endpoint in the VNet used by an App Service app. The app uses a managed identity and must continue reading secrets. Which evidence best validates that the intended control is working?

Options:

• A. Defender for Key Vault shows no active alerts for the vault.

• B. The app’s managed identity has Key Vault Secrets User assigned.

• C. An NSG flow log shows outbound HTTPS from the app subnet.

• D. Key Vault logs show app SecretGet success and public test-client denial.

Best answer: D

Explanation: The control has two required outcomes: the authorized application path still works, and other network paths are blocked by the Key Vault firewall. The strongest validation is operational evidence from the protected resource showing a successful secret read by the app’s managed identity through the allowed path and a denied request from a public test source. Identity role assignments are necessary, but they do not prove the network restriction is enforced. Network logs outside Key Vault can show traffic movement, but not whether the vault accepted or rejected the request.

• Identity permission only fails because RBAC validates authorization, not the Key Vault firewall path.
• No alerts fails because absence of Defender alerts is not proof that public access is blocked.
• NSG traffic evidence fails because subnet egress does not prove Key Vault accepted only private endpoint traffic.

Question 23

Topic: Manage Identity, Access, and Governance

A security engineer reviews an Azure Policy result for Key Vault resources deployed by Bicep. The requirement is to stop any future deployment that creates a key vault with public network access enabled.

Exhibit: Policy result

What is the best next step?

Options:

• A. Create a remediation task for the current Audit assignment.

• B. Add a resource lock to kv-app01.

• C. Update only the Bicep template and redeploy.

• D. Assign a Deny policy for that condition with enforcement enabled.

Best answer: D

Explanation: Azure Policy compliance results must be interpreted by both compliance state and policy effect. The resource is non-compliant, but the assigned effect is Audit, so Azure Policy reports the issue without blocking deployments. To enforce the desired control for future infrastructure-as-code deployments, assign or update the policy to use a Deny effect at the required scope and keep enforcement mode enabled. Existing noncompliant resources may still need separate correction, but the missing control is preventive enforcement.

• Remediation task trap fails because an Audit assignment reports noncompliance but does not automatically modify resources or block future deployments.
• Resource lock trap fails because locks protect against deletion or updates, not configuration compliance for new key vaults.
• Template-only fix fails because correcting one Bicep template does not enforce the rule across all future deployment paths.

Question 24

Topic: Secure Compute

A team is preparing a Microsoft Foundry agent for production. Red-team testing shows the agent sometimes follows jailbreak-style instructions and returns unsafe responses. The agent already uses least-privilege identity permissions. Which security control should you configure to make the agent behavior safer before release?

Options:

• A. AI Gateway rate-limit policies

• B. Microsoft Entra Agent ID analysis

• C. Defender for AI Service alerts

• D. Microsoft Foundry guardrails

Best answer: D

Explanation: Microsoft Foundry guardrails are used when the requirement is to make an agent behave more safely, such as reducing jailbreak success, unsafe outputs, or policy-violating interactions. The stem says identity permissions are already least privileged, so the main gap is not access scope. It also asks for a pre-release behavior control, not only monitoring or API traffic governance. Configure guardrails in Foundry so the agent is evaluated and constrained according to the required safety policy. The closest distractors address adjacent concerns, but they do not directly configure safer agent behavior inside Foundry.

• Agent ID analysis helps understand identity access scope or blast radius, but it does not filter unsafe prompts or responses.
• Gateway rate limits control API traffic usage patterns, but they do not directly configure Foundry agent safety behavior.
• Defender alerts support workload threat detection and monitoring, but the requirement is preventive guardrail configuration before release.

Question 25

Topic: Secure Compute

After Microsoft 365 Copilot is enabled, employees outside Legal receive Copilot answers that cite contract files from a Legal SharePoint site. The same employees can open the cited files directly in SharePoint.

Finding summary

What is the most likely root cause?

Options:

• A. Broad SharePoint permissions expose the Legal content.

• B. Microsoft Sentinel is missing SharePoint audit logs.

• C. The files are public Azure Blob objects.

• D. Copilot is bypassing SharePoint permissions.

Best answer: A

Explanation: Microsoft 365 Copilot grounds responses in content the signed-in user is allowed to access. When Copilot exposes sensitive SharePoint content to unexpected users, the first diagnostic step is to verify whether the underlying SharePoint permissions are too broad. In this case, the users can open the cited files directly, and the access scope includes Everyone except external users, which indicates tenant-wide internal exposure. Copilot increased the impact and visibility of the excessive access, but it did not create access by itself. The key takeaway is to diagnose and remediate the SharePoint permission overexposure, such as broad site, library, folder, or item permissions.

• Permission bypass fails because the users can open the files directly, which points to allowed access rather than Copilot ignoring permissions.
• Audit ingestion gap may affect investigation visibility, but it does not explain why users can read the documents.
• Blob public access is off-scope because the finding identifies SharePoint Online as the source.

Questions 26-50

Question 26

Topic: Secure Storage, Databases, and Networking

A security team manages Azure virtual networks across several subscriptions. They need one service to centrally define baseline security admin rules for selected groups of VNets, and those rules must take precedence over local NSG rules. They do not need branch WAN transit, VPN tunnels, or user-to-app private access. Which service should they use?

Options:

• A. Microsoft Entra Private Access

• B. Azure Virtual Network Manager

• C. Azure VPN Gateway

• D. Azure Virtual WAN

Best answer: B

Explanation: Azure Virtual Network Manager is used to centrally manage network connectivity and security admin rules across Azure virtual networks, including VNets organized into network groups. In this scenario, the deciding requirement is centralized baseline network security policy that applies across subscriptions and takes precedence over local NSG configuration. Azure Virtual WAN, VPN Gateway, and Microsoft Entra Private Access address connectivity or access patterns, not centralized VNet security administration. The key distinction is policy control across Azure VNets rather than WAN transit, encrypted tunneling, or identity-based private app access.

• Virtual WAN focuses on large-scale branch, user, and VNet transit connectivity, not baseline security admin rules for VNet groups.
• VPN Gateway provides site-to-site or point-to-site encrypted tunnels, not centralized VNet security policy management.
• Entra Private Access provides identity-centric access to private applications, not Azure VNet security admin rule enforcement.

Question 27

Topic: Secure Storage, Databases, and Networking

You configure Azure SQL Database auditing for sqldb-prod. The policy sends audit records to Log Analytics workspace law-sec and is scoped to:

• FAILED_DATABASE_AUTHENTICATION_GROUP
• DATABASE_PERMISSION_CHANGE_GROUP

You need to prove that the auditing policy captures the intended activity instead of relying on unrelated security or performance signals. Which TWO validation checks should you perform? Select TWO.

Options:

• A. Grant a database-level permission and query law-sec audit events.

• B. Attempt a failed login and query law-sec audit events.

• C. Review Azure Monitor CPU and connection metrics during the test.

• D. Confirm Defender for Cloud shows SQL auditing as healthy.

• E. Review Defender for Databases alerts for anomalous SQL activity.

• F. Check Query Store for the failed login and GRANT statement.

Correct answers: A and B

Explanation: Azure SQL Database auditing should be validated by generating controlled activity that matches the configured audit action groups and then checking for the resulting audit records in the configured destination. In this scenario, the intended activities are failed database authentication and database-level permission changes, so the validation evidence must come from the audit event stream in law-sec. Defender alerts, compliance posture, Query Store, and resource metrics can be useful for other purposes, but they do not prove that the selected auditing policy captured the required activity.

• Posture status can show that auditing is enabled, but it does not prove the selected action groups recorded test events.
• Defender alerts are threat-protection signals, not a substitute for database audit records.
• Query Store supports performance analysis and does not validate failed authentication or permission-change audit capture.
• Resource metrics show platform telemetry, not the principal, action, and result details required for audit validation.

Question 28

Topic: Secure Storage, Databases, and Networking

A storage account hosts internal application files. Users and services access the data through Microsoft Entra authentication and private endpoints. The security baseline must prevent an administrator from accidentally exposing a container for anonymous public read access. Which storage account setting should you configure?

Options:

• A. Allow public network access

• B. Enable cross-tenant replication

• C. Enable shared key access

• D. Disable blob anonymous access

Best answer: D

Explanation: The relevant control is the storage account setting that governs whether blob containers can allow anonymous public access. If blob anonymous access is enabled, a container-level public access setting can expose blob data without authentication. Disabling it at the storage account level blocks that path, which matches the requirement to prevent accidental public read exposure while continuing to use Microsoft Entra authentication and private endpoints. Network isolation and identity-based access can still be used for normal application access, but they do not replace the account-level control for anonymous blob exposure.

• Shared key access can broaden access through account keys and does not prevent anonymous container exposure.
• Public network access would weaken the private endpoint design by allowing access over public endpoints.
• Cross-tenant replication affects replication behavior and does not block public blob container access.

Question 29

Topic: Secure Storage, Databases, and Networking

An Azure application has web01 in ASG asg-web and api01 in ASG asg-api. web01 must connect to api01 on TCP port 8443. Effective security rules for api01 show a custom inbound deny rule at priority 200 for source VirtualNetwork, destination Any, and port Any. Which NSG rule change best permits the required traffic without broadening unrelated access?

Options:

• A. Remove the custom inbound deny rule at priority 200

• B. Add outbound allow: asg-web to asg-api, TCP 8443, priority 150

• C. Add inbound allow: asg-web to asg-api, TCP 8443, priority 150

• D. Add inbound allow: VirtualNetwork to asg-api, TCP 8443, priority 150

Best answer: C

Explanation: NSG effective rules are evaluated by priority, with lower numbers processed first. Because the deny rule at priority 200 blocks inbound traffic to api01, the least-privilege change is a higher-priority inbound allow rule on the NSG affecting the API workload. Using ASGs for both source and destination keeps the rule tied to workload membership instead of opening the port to the entire virtual network. The rule also scopes the protocol and port to TCP 8443, matching the business requirement. An outbound-only change does not fix a destination-side inbound deny, and removing the deny would reopen unrelated east-west traffic.

• VirtualNetwork source allows every resource in the virtual network to reach the API port, which is broader than the stated requirement.
• Outbound-only allow does not override the inbound deny shown in the effective rules for api01.
• Removing the deny permits unrelated inbound virtual network traffic instead of carving out only the required flow.

Question 30

Topic: Secure Compute

A company publishes a Microsoft Copilot Studio agent that answers HR policy questions and can call an internal benefits API. Security requires malicious prompt-injection attempts to be evaluated during the conversation and blocked before the agent calls tools or returns a response. Normal user access to the agent must remain unchanged. Which implementation should you configure?

Options:

• A. Enable Defender XDR real-time protection for the agent.

• B. Assign a Microsoft Entra Agent ID with API permissions.

• C. Create an Azure Policy audit assignment for the agent.

• D. Ingest Copilot Studio audit events into Microsoft Sentinel.

Best answer: A

Explanation: Real-time protection for Microsoft Copilot Studio agents is a runtime AI security control in Microsoft Defender XDR. It evaluates agent interactions as they occur and can block unsafe prompt-injection or tool-abuse behavior before the agent completes a risky action, while leaving the agent’s normal authentication path intact. Identity controls such as Microsoft Entra Agent ID are still important for least-privilege access and blast-radius management, but they do not inspect conversation content in real time. Sentinel collection and Azure Policy are monitoring or governance controls, not the runtime blocking point.

• Agent ID only reduces access scope, but it does not inspect and block malicious prompts during a conversation.
• Sentinel ingestion supports detection and response after events are collected, not pre-response blocking.
• Azure Policy audit can evaluate configuration compliance, but it is not a runtime guard for Copilot Studio interactions.

Question 31

Topic: Manage and Monitor Security Posture

A security engineer enabled Microsoft Defender for Storage after a Defender for Cloud recommendation appeared. After the next Defender for Cloud assessment, the recommendation still appears for storage account stapptelemetry.

Exhibit:

What is the most likely root cause?

Options:

• A. The storage firewall is blocking plan assignment.

• B. The Sentinel connector is missing for Defender for Cloud.

• C. Defender CSPM is required before storage protection works.

• D. The plan is enabled outside the storage account’s scope.

Best answer: D

Explanation: Defender for Cloud workload protection plans apply only to resources within the enabled scope. The exhibit shows Defender for Storage is on for prod-core, but stapptelemetry is in prod-data, where the plan is off. The recommendation persists because the affected storage account is not covered by the enabled Defender for Storage scope. The diagnostic next step is to enable the plan for prod-data or at the storage account scope if resource-level enablement is being used.

Sentinel ingestion and storage firewall settings do not determine whether a Defender for Cloud workload protection plan is enabled for a resource.

• CSPM confusion fails because Defender CSPM posture management is separate from enabling Defender for Storage workload protection.
• Sentinel connector fails because Sentinel affects log ingestion and detection workflows, not plan coverage in Defender for Cloud.
• Storage firewall fails because firewall rules do not assign or remove Defender for Cloud workload protection plans.

Question 32

Topic: Manage Identity, Access, and Governance

A platform team uses Bicep to deploy a subscription-level Azure Policy assignment with a Deny effect requiring purge protection on every Azure Key Vault. After the pipeline completes, the team runs a validation deployment that attempts to create a vault without purge protection. Which evidence best validates that the intended control is working?

Options:

• A. The Bicep output includes the policy assignment ID.

• B. The validation deployment is denied by the policy assignment.

• C. The deployment service principal created a Key Vault.

• D. Key Vault diagnostic logs are sent to Log Analytics.

Best answer: B

Explanation: For an IaC-deployed security guardrail, the strongest validation is enforcement evidence tied to the intended control. A Deny Azure Policy assignment should block resources that do not meet the required configuration. If a test deployment that omits purge protection is denied and the denial references the policy assignment, the control is working at the resource boundary before a noncompliant vault can exist. Deployment outputs and activity records can show that something was created, but they do not prove that noncompliant resources are prevented.

• Assignment ID only shows the policy resource was deployed, not that it evaluates or blocks Key Vault deployments.
• Diagnostic logging validates audit collection, which is a different control from purge protection enforcement.
• Service principal activity proves deployment activity occurred, not that required security settings are enforced.

Question 33

Topic: Secure Compute

A security engineer reviews a production Azure VM after a Defender for Cloud recommendation. The standard requires Trusted launch, Secure Boot, vTPM, and boot integrity monitoring before adding OS baseline checks. The VM is Generation 2, uses a supported image and size, and has an approved maintenance window.

Exhibit: VM evidence

What is the best next hardening step?

Options:

• A. Install the Guest Attestation extension.

• B. Set the security type to Trusted launch.

• C. Enable Secure Boot directly on the VM.

• D. Assign an Azure Machine Configuration baseline.

Best answer: B

Explanation: The evidence shows the blocking gap is the VM security type. A Standard security type VM does not expose the Trusted launch controls needed for Secure Boot and vTPM, so those settings show as not available. Because the VM is Generation 2 and uses a supported image and size, the logical next remediation is to enable Trusted launch first. After that, Secure Boot, vTPM, and boot integrity monitoring can be configured and validated. Machine Configuration is useful for OS baseline compliance, but it does not establish the measured boot foundation required here.

• Direct Secure Boot skips the missing security type because the setting is unavailable while the VM remains Standard.
• Guest attestation first is premature because integrity monitoring depends on the Trusted launch and vTPM foundation.
• Machine Configuration checks OS configuration compliance, but it does not enable boot protection controls.

Question 34

Topic: Secure Compute

An Azure VM named vm-payroll-01 must meet a compute security baseline: Trusted launch, Secure Boot, vTPM, integrity monitoring, and Azure Machine Configuration compliance. The VM is Generation 2 and supports Trusted launch. You need to apply only the missing control with the least operational change.

Evidence:

What should you implement?

Options:

• A. Convert the VM security type to Confidential VM

• B. Assign a Machine Configuration baseline policy

• C. Enable the Guest Attestation extension for integrity monitoring

• D. Recreate the VM as Generation 2 with Trusted launch

Best answer: C

Explanation: The evidence shows that the VM already has the required security type, Secure Boot, vTPM, and Machine Configuration compliance. The only missing baseline control is integrity monitoring. For a Trusted launch VM, integrity monitoring is surfaced through guest attestation, which verifies boot integrity signals from the vTPM and reports them for monitoring. Because the VM is already Generation 2 and Trusted launch-enabled, the least disruptive implementation is to enable the Guest Attestation extension rather than change the VM security type or redeploy the VM.

• Confidential VM conversion fails because the requirement is Trusted launch, which is already configured.
• Machine Configuration assignment fails because the baseline assignment is already compliant and does not enable boot integrity attestation.
• VM recreation fails because the VM already meets the generation and Trusted launch prerequisites, so redeployment is unnecessary.

Question 35

Topic: Secure Compute

A security review finds that a Microsoft Copilot Studio agent uses its Microsoft Entra Agent ID at runtime. The agent only needs to call one approved internal API, but its identity has broad Microsoft Graph application permissions. Which control best limits the agent’s access without blocking the approved operation?

Options:

• A. Run Defender XDR blast-radius analysis for the agent

• B. Scope the Agent ID to only the required API permission

• C. Require the agent owner to use PIM activation

• D. Disable all connectors used by the agent

Best answer: B

Explanation: Microsoft Entra Agent ID is the relevant control boundary for an agent’s runtime identity and permissions. To reduce agent reach while preserving the intended API call, remove broad permissions and grant only the permission needed for the approved resource or action. This limits what access tokens can be used successfully by the agent without disabling the business workflow. Defender XDR blast-radius analysis is useful for understanding exposure, but it is not the enforcement control. Disabling connectors or changing the owner’s privileged access affects operation or administration rather than the agent’s runtime access scope.

• Blast-radius analysis helps assess potential exposure, but it does not enforce least-privilege access.
• Disabling connectors may reduce risk, but it also blocks the legitimate agent operation.
• PIM for the owner governs human privileged access, not the agent identity’s runtime permissions.

Question 36

Topic: Manage and Monitor Security Posture

A security team has enabled Microsoft Sentinel in a Log Analytics workspace. The workspace keeps data for 90 days, but incident response policy requires analysts to run Sentinel investigations against SigninLogs and SecurityEvent for 180 days. Other tables should not have extended retention. What is the best next implementation step?

Options:

• A. Enable archive retention only for the workspace

• B. Set table-level interactive retention to 180 days

• C. Create an analytics rule with a 180-day query period

• D. Export all workspace logs to a storage account

Best answer: B

Explanation: Microsoft Sentinel data retention is configured through the underlying Log Analytics workspace. When only specific Sentinel tables need a longer investigation window, table-level retention is the most targeted control. In this scenario, SigninLogs and SecurityEvent must remain interactively queryable for 180 days, while other tables should stay at the existing retention period. Workspace-wide retention would over-retain unrelated data, and archive-only retention is better suited for lower-frequency compliance lookup rather than normal interactive investigation workflows. The key is to match the retention scope and mode to the required access pattern.

• Archive-only retention may support long-term storage, but it does not meet the stated need for routine interactive Sentinel investigations.
• Analytics rule window changes detection logic timing; it does not preserve older ingested data.
• Storage export can keep a copy of logs, but it does not make those tables directly available for Sentinel investigation queries.

Question 37

Topic: Secure Compute

A company publishes several Microsoft Copilot Studio agents for employees. Security requires protection of agent runtime activity, including detecting risky interactions as they occur, without rebuilding the agents or moving them to Microsoft Foundry. Which design is the best fit?

Options:

• A. Route the agents through Azure API Management AI Gateway

• B. Use Microsoft Entra Agent ID blast-radius analysis

• C. Use Microsoft Purview DSPM for AI exposure discovery

• D. Enable Defender XDR real-time protection for Copilot Studio agents

Best answer: D

Explanation: Microsoft Copilot Studio agent runtime protection is handled through Defender XDR real-time protection for agents. This fits the requirement to protect activity as the agents are used, without changing the agent hosting model or shifting the workload to Microsoft Foundry. Microsoft Entra Agent ID is important for agent identity and access scope, but it does not replace runtime protection. Purview DSPM for AI helps discover data exposure risks, while AI Gateway in API Management is for controlling Microsoft Foundry traffic. The key distinction is runtime protection for Copilot Studio agents versus adjacent posture, identity, or API-control capabilities.

• Agent ID only fails because blast-radius analysis addresses access scope, not live runtime protection.
• AI Gateway routing fails because it targets Microsoft Foundry API traffic, not native Copilot Studio agent runtime protection.
• DSPM discovery fails because it identifies data exposure risks rather than protecting agent interactions in real time.

Question 38

Topic: Manage Identity, Access, and Governance

A production Azure Key Vault stores customer-managed keys for regulated workloads. The operations team has Contributor access for routine maintenance, but security requires the vault resource itself to be protected from accidental deletion and configuration changes. Data-plane access to keys should continue according to existing Key Vault permissions. Which configuration should you implement?

Options:

• A. Create an Azure Policy assignment with audit effect

• B. Apply a ReadOnly resource lock to the Key Vault

• C. Apply a CanNotDelete resource lock to the Key Vault

• D. Assign the Reader role to the operations team

Best answer: B

Explanation: Azure resource locks protect resources at the Azure Resource Manager management plane. A ReadOnly lock prevents authorized users from deleting the resource and from changing its configuration, which matches the requirement to protect the Key Vault from accidental deletion and modification. Key Vault data-plane access, such as using keys or secrets, is controlled separately by Key Vault permissions or Azure RBAC data-plane roles. A CanNotDelete lock is narrower because it allows configuration changes.

• CanNotDelete only fails because it prevents deletion but still allows management-plane configuration updates.
• Reader role is not a durable protection control because other inherited permissions or role changes could still allow modification.
• Audit policy can report noncompliance but does not directly block accidental changes or deletion.

Question 39

Topic: Manage and Monitor Security Posture

A security team deploys Microsoft Sentinel for a new Azure landing zone. They must ingest security-relevant Azure resource management events, such as role assignments, policy changes, and network rule updates, from several subscriptions into the Sentinel workspace. The solution should scale to new subscriptions and avoid installing agents where they are not needed. Which control should they implement?

Options:

• A. Enable only the Microsoft Defender XDR connector.

• B. Export Activity logs to a storage account.

• C. Install Azure Monitor Agent on every VM.

• D. Enable the Azure Activity connector with policy-based streaming.

Best answer: D

Explanation: For Azure resource management events, Microsoft Sentinel should use the Azure Activity data connector. Azure Activity logs capture subscription-level control-plane operations, including role assignment changes, policy operations, and resource configuration updates. Using Azure Policy or policy-based configuration to stream Activity logs to the Sentinel Log Analytics workspace scales across subscriptions and supports consistent onboarding. VM agents are used for host-level logs, not subscription management-plane events. Storage export can support archival, but it does not by itself provide Sentinel analytics-ready ingestion.

• VM agent collection misses the requirement because Azure Monitor Agent collects guest or host logs, not subscription Activity logs.
• Defender XDR only is too narrow because it does not replace Azure Activity ingestion for Azure resource operations.
• Storage export supports retention or archive scenarios but does not directly provide Sentinel detection and analytics ingestion.

Question 40

Topic: Secure Storage, Databases, and Networking

A spoke-subnet VM cannot reach a partner API on TCP 443 after recent NSG and Azure Firewall rule changes. The subnet uses a route table that sends internet-bound traffic to Azure Firewall, and the business requires traffic to remain inspected. Which action best determines whether the outage is caused by effective network rules or firewall behavior without weakening controls?

Options:

• A. Allow the partner API from all Azure services

• B. Add a temporary allow-any outbound NSG rule

• C. Run Network Watcher rule diagnostics and correlate firewall deny logs

• D. Remove the route table to bypass Azure Firewall

Best answer: C

Explanation: The safest diagnostic approach is to observe the existing control path instead of relaxing it. Network Watcher IP flow verify can test the specific source, destination, protocol, and port against the effective NSG rules applied to the VM NIC. Effective security rules show which NSG rules are actually in force after subnet and NIC associations are combined. If the NSG path is allowed and the route still sends traffic to Azure Firewall, Azure Firewall diagnostic logs can show whether a network or application rule denied the connection. This separates NSG, route, and firewall causes while preserving required inspection.

• Allow-any NSG testing may restore connectivity, but it weakens segmentation and can hide the actual effective rule causing the issue.
• Bypassing Azure Firewall violates the requirement that internet-bound traffic remain inspected.
• Broad service allowance expands exposure and does not prove whether the NSG or firewall rule set caused the timeout.

Question 41

Topic: Secure Compute

An AKS cluster should pull images from an Azure Container Registry only over Private Link. After public network access was disabled on the registry, new pods fail with image pull errors. What is the most likely root cause?

Registry: contosoacr
Public network access: Disabled
Private endpoint: Approved in vnet-hub
AKS node VNet: vnet-prod, peered to vnet-hub
DNS lookup from AKS node:
  contosoacr.azurecr.io -> 20.45.10.7
Error: connect to 20.45.10.7 timed out
Private DNS zone privatelink.azurecr.io:
  linked VNets: vnet-hub only

Options:

• A. The private endpoint must be recreated in the AKS subnet.

• B. The AKS VNet lacks private DNS resolution for the registry.

• C. Defender for Containers is not scanning the registry images.

• D. The kubelet identity is missing the AcrPull role.

Best answer: B

Explanation: For Azure Container Registry access over Private Link, clients must resolve the registry login server to the private endpoint address. The exhibit shows that the AKS node resolves contosoacr.azurecr.io to a public IP while public network access is disabled. Because the privatelink.azurecr.io private DNS zone is linked only to vnet-hub, the peered AKS VNet does not have the required private name resolution unless DNS forwarding is configured. Peering enables network reachability, but it does not automatically provide private DNS resolution across VNets.

• AcrPull role would address authorization failures, typically seen as unauthorized errors, not a timeout to a public IP.
• Recreating the endpoint is unnecessary because a private endpoint can be reached from a peered VNet when routing and DNS are correct.
• Image scanning affects vulnerability visibility, not whether AKS can resolve and connect to the registry endpoint.

Question 42

Topic: Secure Storage, Databases, and Networking

A company has 50 Azure virtual networks across multiple subscriptions. The security team needs one control plane to group the VNets and enforce a baseline rule that blocks inbound SSH and RDP from the Internet. Application teams must still manage their own NSGs for app-specific traffic. The solution must not replace the existing WAN or user remote-access design. Which service should you use?

Options:

• A. Microsoft Entra Private Access

• B. Azure Virtual WAN

• C. Azure Virtual Network Manager

• D. Azure VPN Gateway

Best answer: C

Explanation: Azure Virtual Network Manager is the best fit for centralized network policy across many Azure virtual networks. It lets you create network groups and apply security admin rules, such as organization-wide deny rules for inbound management ports, across subscriptions and regions. Those baseline controls are evaluated separately from workload NSGs, so application teams can still use NSGs for their app-specific traffic decisions. The requirement is not to redesign transit, connect branches, or change how users reach private applications; it is to centrally govern VNet-level security policy.

• WAN transit focus fails because Azure Virtual WAN is mainly for large-scale branch, hub, and VNet connectivity rather than VNet-wide security admin rules.
• VPN access path fails because Azure VPN Gateway provides VPN connectivity and would change access paths instead of applying centralized VNet policy.
• Private app access fails because Microsoft Entra Private Access secures user access to private apps, not baseline rules across Azure VNets.

Question 43

Topic: Manage and Monitor Security Posture

An organization enabled Defender CSPM and is reviewing recommendations. The public web app on vm-web01 must stay reachable over HTTPS, and the VM uses its managed identity to retrieve required Key Vault secrets. Administrators can use Azure Bastion.

Which remediation should the security engineer prioritize to reduce the greatest current risk without disrupting required access?

Options:

• A. Disable the VM managed identity immediately.

• B. Close Internet RDP and require Azure Bastion administration.

• C. Block all public inbound access to vm-web01.

• D. Enable Defender for Databases on sql-dev01 first.

Best answer: B

Explanation: Defender CSPM risk prioritization uses context such as attack paths, exposure, resource sensitivity, and identity permissions, not just a flat list of findings. Here, the highest-risk finding is the VM attack path: an internet-exposed management port on a workload whose identity can reach production Key Vault secrets. Closing public RDP removes the entry point while keeping HTTPS available and preserving required secret access. Azure Bastion lets administrators manage the VM without exposing RDP to the Internet. The dev database and diagnostic-log storage findings may still need remediation, but they do not represent the same immediate path to production secrets.

• Disabling the identity may reduce impact, but it breaks required Key Vault secret retrieval and leaves the RDP exposure unresolved.
• Blocking all inbound access removes exposure, but it also breaks the public HTTPS workload.
• Database plan first improves protection for a dev database, but it does not address the active attack path to production secrets.

Question 44

Topic: Manage and Monitor Security Posture

A security engineer configured Microsoft Sentinel to collect security-related syslog events from Linux servers by using Azure Monitor Agent and a data collection rule that includes the auth and authpriv facilities. Which evidence best validates that syslog event collection is working end-to-end?

Options:

• A. A Defender for Cloud recommendation marked resolved for the servers

• B. A healthy Heartbeat record from each Linux host

• C. An Azure Activity entry showing the data collection rule was updated

• D. Recent Syslog records from the Linux hosts with auth or authpriv facilities

Best answer: D

Explanation: For Microsoft Sentinel syslog collection, the strongest validation is data arrival in the expected log table. With Azure Monitor Agent and a data collection rule, the control is working only when the intended Linux or syslog-capable sources produce recent records in the Syslog table for the configured facilities and severities. A healthy agent heartbeat confirms the machine is connected to Azure Monitor, but it does not prove syslog events are being parsed, filtered, and ingested into Sentinel. Configuration changes and posture findings can support troubleshooting, but they do not validate event collection by themselves. The key takeaway is to validate ingestion with query results that match the intended source and syslog scope.

• Agent health only fails because Heartbeat shows connectivity, not syslog event ingestion.
• Configuration activity fails because a DCR update proves a change occurred, not that events arrived.
• Posture status fails because Defender for Cloud recommendations do not validate Sentinel syslog collection.

Question 45

Topic: Manage and Monitor Security Posture

A company is onboarding Azure Firewall logs to a Microsoft Sentinel workspace. The security team needs Microsoft-maintained packaged content, including connector guidance, analytics rules, hunting queries, and workbooks, and wants to avoid building each item manually. What should the team do?

Options:

• A. Create custom analytics rules and workbooks manually.

• B. Install the Azure Firewall solution from Content hub.

• C. Grant analysts workspace Contributor to import queries.

• D. Upload firewall logs to a custom table only.

Best answer: B

Explanation: Microsoft Sentinel Content hub is used when a scenario needs packaged content for a product, service, or workload. A solution can include connector setup guidance, analytics rules, workbooks, hunting queries, parsers, and other artifacts that are installed into the selected workspace and then configured as needed. This reduces implementation risk because the team starts from maintained content rather than recreating every detection and workbook manually. Custom content can still be added later, but it is not the best first control when packaged content is explicitly required.

• Manual builds add avoidable effort and drift when maintained packaged content is available.
• Broad workspace rights do not provide a packaged solution and may increase privilege risk.
• Custom table only addresses ingestion storage but not packaged detections, workbooks, or connector guidance.

Question 46

Topic: Secure Storage, Databases, and Networking

An organization uses a hub-and-spoke Azure network. Workloads in multiple spoke VNets need outbound internet access and limited spoke-to-spoke communication. Security requires centrally managed allow/deny rules, FQDN-based filtering, and traffic logs without duplicating controls on every workload subnet. Which implementation best reduces risk while preserving required connectivity?

Options:

• A. Require Azure Bastion for all administrative connections

• B. Create private endpoints for all workload services

• C. Apply separate NSG rules to every workload subnet

• D. Deploy Azure Firewall in the hub and route spoke traffic to it

Best answer: D

Explanation: Azure Firewall is the appropriate control when traffic filtering must be centralized across Azure networks. In a hub-and-spoke design, placing Azure Firewall in the hub and using route tables to send spoke outbound and spoke-to-spoke traffic through it allows security teams to enforce consistent network rules, application rules, FQDN filtering, and logging from one control point. This reduces rule drift and avoids duplicating complex filtering logic on each workload subnet. NSGs still help with subnet or NIC-level segmentation, but they do not replace centralized inspection and policy management for routed traffic.

• Subnet-only NSGs can restrict traffic locally, but they do not provide one centralized filtering and logging point across all spokes.
• Private endpoints reduce exposure for supported PaaS services, but they do not control general outbound or spoke-to-spoke traffic.
• Azure Bastion secures administrative access to VMs, but it is not a centralized firewall for application or network flows.

Question 47

Topic: Manage Identity, Access, and Governance

An Azure App Service API reads blobs from Azure Storage and retrieves application configuration from Azure Key Vault. The current deployment stores an app registration client secret in an app setting. Security policy now requires the workload to authenticate to Azure resources without storing any authentication secret and to use Azure RBAC where possible. Which implementation should you use?

Options:

• A. Create a long-lived storage SAS token in Key Vault.

• B. Enable a managed identity and assign required data-plane roles.

• C. Move the app registration client secret into Key Vault.

• D. Store a certificate credential in the deployment pipeline.

Best answer: B

Explanation: Managed identities are the safer authentication pattern for Azure-hosted workloads that need to access Azure resources. Azure manages the credential lifecycle and the app obtains Microsoft Entra tokens from the platform, so there is no client secret to store in app settings, Key Vault, code, or pipeline variables. The identity can then be granted only the required Azure RBAC data-plane roles, such as storage blob access and Key Vault secret read access. Moving a client secret to Key Vault improves storage location, but it does not eliminate the stored credential.

• Key Vault secret storage still leaves a client secret that must be protected, accessed, and rotated.
• Pipeline certificate credential replaces one stored credential with another and does not meet the no-secret requirement.
• Long-lived SAS token is a stored bearer credential and is narrower than account keys but still not secretless authentication.

Question 48

Topic: Secure Storage, Databases, and Networking

An application in a spoke virtual network accesses an Azure Storage account by using https://contoso.blob.core.windows.net. Security policy requires blob traffic to use a private IP address from the spoke VNet and prevents access through the storage account public endpoint. Which configuration should you implement?

Options:

• A. Enable a storage service endpoint and allow the subnet in the firewall

• B. Allow the app’s NAT public IPs in the storage account firewall

• C. Create a blob private endpoint, integrate private DNS, and disable public access

• D. Deploy a Private Link service to publish the storage account

Best answer: C

Explanation: Azure Private Endpoint creates a network interface with a private IP address in your virtual network for a specific PaaS subresource, such as blob on a storage account. With private DNS integration, the normal storage FQDN resolves to the private endpoint address, so the application can keep using the same URL while traffic stays on the private path. Disabling public network access closes the public endpoint path. A service endpoint can restrict public endpoint access by subnet, but it does not create a private IP for the PaaS resource. Private Link service is for publishing your own service privately, not for consuming Azure Storage.

• Service endpoint is tempting because it can limit subnet access, but it still uses the service’s public endpoint rather than a private IP.
• IP firewall rules keep access tied to public source addresses and do not satisfy the private IP requirement.
• Private Link service is used to expose customer-owned services behind a load balancer, not to front an Azure Storage account.

Question 49

Topic: Secure Storage, Databases, and Networking

A security engineer reviews an Azure SQL logical server used by a payments app.

The SOC must query database access and schema-change events from its central Log Analytics workspace. You must remediate the finding without changing network exposure or threat-protection settings. What should you implement?

Options:

• A. Enable Microsoft Defender for SQL

• B. Enable SQL auditing to Log Analytics

• C. Configure a new private endpoint

• D. Require Microsoft Entra-only authentication

Best answer: B

Explanation: This finding is about database auditing, not platform hardening or Defender protection. Azure SQL auditing records database events such as access, queries, and schema changes and can send them to a Log Analytics workspace for SOC review. The stem already states that Defender for SQL is enabled, so turning on Defender protection would not remediate missing audit records. The network posture is also already private, so changing private endpoint configuration would not address audit evidence. The key is to match the finding category to the control that produces the required evidence.

• Defender protection fails because Defender for SQL is already enabled and provides threat detection, not the missing audit event stream.
• Private endpoint fails because network exposure is already restricted and the requirement is audit visibility.
• Entra-only authentication may improve identity posture, but it does not produce database audit logs in Log Analytics.

Question 50

Topic: Secure Compute

An organization hosts Windows and Linux VMs in two spoke VNets that are directly peered to a hub VNet. Administrators need RDP and SSH access from the Azure portal without VPN clients or maintained jump hosts. The VMs must keep only private IP addresses, and VM subnets must not allow inbound RDP/SSH from the Internet. A public IP is allowed only for a Microsoft-managed administrative connectivity service. Which implementation should you plan?

Options:

• A. Deploy Azure Bastion with its public IP in hub AzureBastionSubnet; connect to private VM IPs.

• B. Assign VM public IPs and restrict RDP/SSH to administrator source ranges.

• C. Deploy a public jump server and RDP/SSH from it to private VMs.

• D. Enable Defender for Cloud JIT access for VM RDP/SSH ports.

Best answer: A

Explanation: Azure Bastion is the managed service designed for secure administrative connectivity to VMs without exposing the VMs directly to the Internet. It is deployed into a dedicated subnet named AzureBastionSubnet and uses its own public IP endpoint. Administrators connect through the Azure portal, while Bastion reaches the VM over the private IP path in the same or directly peered virtual network. This preserves the constraint that workload VMs have no public IP addresses and no Internet-facing RDP/SSH rules. JIT access reduces the time a management port is open, but it is not a replacement for Bastion when the requirement is managed portal-based connectivity with no public VM exposure.

• Restricted public IPs still expose VM management endpoints to the Internet, even if source ranges are limited.
• Public jump server violates the no maintained jump-host constraint and creates another administrative attack surface.
• JIT access controls when ports open, but it does not provide the Bastion connection path required in the scenario.

Questions 51-60

Question 51

Topic: Secure Compute

An internal API runs on Azure App Service. Only workloads in vnet-prod must be able to reach the app by using a private IP address, and public internet ingress must be blocked. You must meet the requirement without changing application code. What should you configure?

Options:

• A. Require Microsoft Entra authentication on the public app endpoint.

• B. Enable regional VNet integration and keep public network access enabled.

• C. Move app secrets to Key Vault and use a managed identity.

• D. Add a Private Endpoint, configure private DNS, and disable public network access.

Best answer: D

Explanation: For App Service, a Private Endpoint is the control that changes inbound access to use Azure Private Link through a private IP in a virtual network. Private DNS, such as the App Service private link zone, ensures callers resolve the app name to that private endpoint. Disabling public network access prevents clients from reaching the public endpoint. Regional VNet integration is commonly confused with this requirement, but it is for outbound connectivity from the app to a virtual network. Authentication and Key Vault improve identity and secret security, but they do not enforce a private-only network path.

• VNet integration fails because it secures outbound app traffic, not private inbound access to the app.
• Entra authentication can restrict who signs in, but the endpoint would still be publicly reachable.
• Key Vault with managed identity protects secrets, but it does not block public ingress to App Service.

Question 52

Topic: Secure Storage, Databases, and Networking

Contoso requires every Azure database service that stores customer data to have Microsoft Defender for Databases coverage. Network isolation is already implemented with private endpoints, and the security team must remediate by enabling the missing Defender for Cloud workload protection only. Which action is the best design fit?

Exhibit: Current inventory

Options:

• A. Enable Defender for Azure Cosmos DB for audit-cosmos.

• B. Enable Defender for open-source relational databases for ops-pg.

• C. Deploy another private endpoint for sales-sql.

• D. Enable Defender for SQL servers on machines for vm-sql01.

Best answer: A

Explanation: Defender for Databases coverage must be checked against the specific Azure database service and its current Defender for Cloud plan status. In the inventory, Azure SQL Database, Azure Database for PostgreSQL, and SQL Server on an Azure VM already have their matching Defender coverage enabled. The only customer-data database service explicitly listed without Defender for Databases coverage is the Azure Cosmos DB account. Private endpoints help with network isolation, but they do not replace Defender workload protection or generate the database-specific threat detections expected by the requirement.

• SQL VM coverage is already enabled through Defender for SQL servers on machines, so enabling it again does not remediate the gap.
• PostgreSQL coverage is already present through the open-source relational databases plan.
• Private endpoint changes address network exposure, not the missing Defender for Databases workload protection.

Question 53

Topic: Manage Identity, Access, and Governance

An Azure subscription contains a production storage account that stores audit exports for a regulated workload. The security team must prevent accidental deletion and accidental configuration changes to this storage account. Application identities must continue writing blobs by using existing data-plane permissions, and platform engineers must remain able to manage other resources in the resource group. Which design is the best fit?

Options:

• A. Replace engineer Contributor access with Reader access.

• B. Apply a CanNotDelete lock to the resource group.

• C. Create an Azure Policy assignment that audits changes.

• D. Apply a ReadOnly lock to the storage account.

Best answer: D

Explanation: Azure resource locks protect critical resources from accidental management-plane operations. A ReadOnly lock prevents both deletion and configuration changes, and applying it directly to the storage account keeps the scope narrow. This meets the protection requirement without blocking engineers from managing unrelated resources in the same resource group. Existing blob write access is a data-plane permission, so the lock choice should focus on protecting the Azure resource configuration, not redesigning application access.

A CanNotDelete lock is useful when updates must remain allowed, but it does not meet a requirement to prevent accidental modification.

• Resource group lock over-scopes the control and a CanNotDelete lock still allows configuration changes.
• Reader-only engineers weakens operational ownership and does not protect the resource from other privileged identities.
• Audit policy can detect or report changes, but it does not directly block accidental deletion or modification.

Question 54

Topic: Secure Compute

Your company permits approved teams to build AI apps in Azure. Security leadership asks for a recurring control that highlights risky AI resources and data exposure so teams can remediate issues without pausing approved AI development. Which action should you take?

Options:

• A. Create only Microsoft Sentinel analytics for AI activity logs.

• B. Require teams to delete all Copilot Studio agents pending review.

• C. Disable public network access for every AI-related resource.

• D. Review AI risks in the Defender for Cloud Data and AI security dashboard.

Best answer: D

Explanation: The Data and AI security dashboard in Microsoft Defender for Cloud provides a control-oriented view of AI security posture, including AI resources, data exposure signals, and prioritized security findings. In this scenario, leadership needs ongoing monitoring and risk prioritization, not a blanket shutdown of approved AI work. Using the dashboard lets the security team identify high-risk AI assets and guide remediation while preserving legitimate development activity. Sentinel can help with event correlation, but it does not replace the Defender for Cloud dashboard for AI posture monitoring.

• Blanket blocking reduces exposure but can unnecessarily disrupt approved AI workloads.
• Sentinel-only monitoring may help detect events but misses the posture-focused Data and AI security dashboard requirement.
• Agent deletion is overly disruptive and does not establish an ongoing AI security monitoring control.

Question 55

Topic: Manage and Monitor Security Posture

A security operations team uses a Microsoft Security Copilot workspace. The team wants a Microsoft-supported agent to perform phishing triage automatically and provide results in the Security Copilot experience. They must avoid custom automation and third-party agents. What should you configure?

Options:

• A. Enable only the Defender XDR plugin in Security Copilot.

• B. Create a Microsoft Entra Agent ID for each analyst.

• C. Install a Security Store agent from a partner publisher.

• D. Enable the relevant Microsoft agent in the Security Copilot workspace.

Best answer: D

Explanation: Microsoft Security Copilot separates plugins, Microsoft agents, and Security Store agents. When the requirement is to use a Microsoft-supported autonomous capability, such as phishing triage, the implementation is to enable the appropriate Microsoft agent in the Security Copilot workspace and complete any required setup for that agent. Plugins extend Copilot’s data access and actions, but enabling a plugin alone does not enable an agent workflow. Security Store agents are separate installable agents from the store, which does not meet the constraint to avoid third-party agents. Microsoft Entra Agent ID is used for agent identity and access control scenarios, not for enabling a Security Copilot Microsoft agent for analysts.

• Plugin only fails because a plugin provides integration, not the Microsoft agent workflow requested.
• Security Store agent fails because the scenario explicitly excludes third-party or store-provided agents.
• Entra Agent ID fails because it manages agent identity, not Security Copilot agent enablement for analysts.

Question 56

Topic: Manage Identity, Access, and Governance

During an Azure RBAC review, the BackupOps Microsoft Entra group is found to have the Owner role at the subscription scope. The group must continue to configure backup policies and trigger restores for Recovery Services vaults in RG-Backup, and view VM metadata in RG-Prod. The group must not grant access or modify nonbackup resources. Which RBAC configuration should you implement?

Options:

• A. Keep Owner; require PIM activation for the assignment.

• B. Remove Owner; assign Contributor at the subscription scope.

• C. Remove Owner; assign Backup Contributor on RG-Backup only.

• D. Remove Owner; assign Backup Contributor on RG-Backup and Reader on RG-Prod.

Best answer: D

Explanation: Azure RBAC remediation should replace broad assignments with the least-privileged roles at the narrowest scope that still supports required work. Owner at the subscription scope grants role assignment and broad control-plane permissions beyond backup operations. Backup Contributor on RG-Backup supports managing backup policies and restores for the vaults, while Reader on RG-Prod preserves the required VM visibility without allowing changes. PIM can reduce standing privilege, but it does not fix an assignment whose active permissions are still too broad.

• Subscription Contributor still allows modifications across the subscription, including nonbackup resources outside the stated job.
• PIM for Owner limits when access is active but still exposes Owner permissions when activated.
• Backup-only access preserves vault operations but omits the required VM metadata visibility in RG-Prod.

Question 57

Topic: Secure Storage, Databases, and Networking

An Azure Function uploads blobs to a storage account by using a user-assigned managed identity. After the storage account was changed to Selected networks, uploads fail. You must restore uploads without opening the account to public access.

Which action best addresses the likely cause?

Options:

• A. Assign Storage Blob Data Owner to the identity.

• B. Create a stored access policy and issue a SAS.

• C. Use VNet integration and a storage private endpoint.

• D. Enable Defender for Storage malware scanning.

Best answer: C

Explanation: The evidence points to a network isolation problem, not an identity or access policy problem. The function is authenticating with OAuth and its managed identity already has Storage Blob Data Contributor at the storage account scope, which is sufficient for blob uploads. The failure began after the account was restricted to selected networks, and the function is not integrated with an allowed subnet or private endpoint path. Routing the function through an approved VNet path and a storage private endpoint restores legitimate access while keeping the storage account closed to broad public network access. Granting more privileges would not fix a firewall block and would increase risk.

• More RBAC fails because the managed identity already has the needed blob data role for uploads.
• SAS policy fails because the workload is using OAuth with a managed identity, not a SAS tied to a stored access policy.
• Defender scanning fails because threat protection can detect storage threats but does not authorize blocked network traffic.

Question 58

Topic: Secure Storage, Databases, and Networking

An application tier runs on Azure VMs in asg-app. Web-tier VMs in the same virtual network are in asg-web. The requirement is to allow inbound TCP 443 to the app tier only from the web tier. The NSG associated with the app subnet currently has only default rules. Which NSG change best implements the rule intent without blocking legitimate web traffic?

Options:

• A. Add only inbound allow asg-web to asg-app TCP 443 at priority 100.

• B. Add inbound deny VirtualNetwork to asg-app at priority 100 and inbound allow asg-web to asg-app TCP 443 at priority 200.

• C. Add inbound deny Internet to asg-app at priority 100 and keep default rules.

• D. Add inbound allow asg-web to asg-app TCP 443 at priority 100 and inbound deny VirtualNetwork to asg-app at priority 200.

Best answer: D

Explanation: NSG rules are evaluated by priority, with lower numbers processed first, and processing stops at the first match. Because the app subnet currently has only default rules, the default AllowVNetInBound rule would continue to allow other resources in the same virtual network unless a more specific deny is added above it. The safest implementation is to place a specific allow for the intended web-to-app TCP 443 flow before a broader deny for other virtual-network sources to the app ASG. NSGs are stateful, so response traffic for the allowed connection does not require a separate inbound exception. A deny ordered before the allow, or a deny scoped only to Internet sources, does not implement the east-west isolation requirement.

• Allow-only rule leaves the default AllowVNetInBound rule in place, so non-web VNet sources can still reach the app tier.
• Deny-before-allow causes NSG processing to stop at the deny because the lower priority number is evaluated first.
• Internet-only deny does not address same-VNet east-west traffic and duplicates the intent of the default inbound deny.

Question 59

Topic: Manage Identity, Access, and Governance

A security team must grant a small group of engineers temporary elevation to the Azure subscription Owner role during production incidents. Each use must require approval, the role must remain inactive until requested, and the elevated access must expire automatically after activation. Which configuration best meets these requirements?

Options:

• A. Time-bound active Azure RBAC assignment with Conditional Access MFA

• B. Permanent Azure RBAC assignment with quarterly access reviews

• C. Entitlement management access package with approver and expiration

• D. PIM eligible assignment with approval and maximum activation duration

Best answer: D

Explanation: Privileged Identity Management is the Microsoft Entra control designed for just-in-time privileged elevation. For a high-impact Azure role, users should be made eligible, not permanently active. The PIM role settings can require approval before activation and define a maximum activation duration so the elevated role expires automatically after the approved session. A plain Azure RBAC assignment grants access directly and does not provide the same activation workflow. Access reviews and Conditional Access can improve governance or authentication strength, but they do not replace PIM activation controls.

• Permanent assignment leaves the Owner role active instead of requiring just-in-time activation.
• Time-bound active RBAC can expire the assignment, but it does not create an approval-based activation workflow.
• Access package approval governs entitlement access, not privileged Azure role activation through PIM.

Question 60

Topic: Secure Compute

A company deployed Azure AI services in subscription Sub1. Sub1 is visible in Microsoft Defender for Cloud, and Defender CSPM is already enabled. The security team now needs workload protection and threat detections for the AI services before routing alerts to Microsoft Sentinel. What should you do next?

Options:

• A. Enable only Defender CSPM at the management group.

• B. Enable Defender for AI Service for Sub1.

• C. Create a Microsoft Sentinel analytics rule.

• D. Configure Foundry guardrails on the model endpoints.

Best answer: B

Explanation: Defender CSPM provides posture management, recommendations, and exposure context, but workload threat protection for AI services requires the Defender for AI Service plan in Microsoft Defender for Cloud. Because Sub1 is already visible in Defender for Cloud, the next implementation step is to enable the relevant Defender plan for that subscription. After the plan is enabled and producing protection signals, alert routing or Sentinel analytics can be configured. Foundry guardrails can help control AI app behavior, but they are not the Defender for Cloud workload protection plan.

• Sentinel first fails because analytics rules depend on security signals being collected; they do not enable AI workload protection.
• Foundry guardrails address AI application control, not Defender for Cloud workload protection activation.
• CSPM only improves posture visibility but does not replace the Defender for AI Service workload protection plan.

Continue with full practice

Use the Microsoft SC-500 Practice Test page for the full IT Mastery practice bank, mixed-topic practice, timed mock exams, explanations, and web/mobile app access.

Try Microsoft SC-500 on Web View Microsoft SC-500 Practice Test

Focused topic pages

• Identity and Governance
• Storage and Networking Security
• Secure Compute
• Security Posture Monitoring

Free review resource

Read the Microsoft SC-500 Cheat Sheet for compact concept review before returning to timed practice.