Microsoft SC-500 Microsoft Certified: Cloud and AI Security Engineer Associate Exam Practice Test

Add a custom WAF rule. The planned change requires WAF1 to implement rate limiting based on the geographic location of incoming requests. Azure Web Application Firewall supports this combination directly through custom rate-limit rules.

Microsoft documents that Application Gateway WAF rate-limit rules can group requests by GeoLocation, where requests are categorized based on the geographic location derived from the client IP address. The rule can then apply the configured rate threshold independently to traffic originating from each geographic location. Microsoft Learn Azure WAF custom rules also support the GeoMatch operator, which evaluates requests according to their country or region of origin. Microsoft Learn

This makes a single custom rule the most direct and administratively efficient implementation.

The Azure-managed Default Rule Set (DRS) provides predefined protections against common web application attacks, such as injection and protocol attacks; it is not where custom geographic rate limits are defined. Bot Manager 1.1 identifies and handles automated bot traffic but is not the appropriate mechanism for general location-based rate limiting. Azure Policy can enforce configuration standards across resources but does not itself process web requests or impose per-location request thresholds.

Therefore, configure a custom rate-limit rule with geographic matching/grouping.

===============

Storage2 must be configured to use an account encryption key. The planned storage account must support Azure Table storage, while the technical requirement specifies that all storage data must be encrypted using Fabrikam-managed keys, meaning customer-managed keys (CMKs).

Azure Storage treats Table and Queue encryption differently from Blob Storage and Azure Files. Microsoft states that to encrypt Table Storage or Queue Storage with a customer-managed key, the storage account must be configured at creation time to use an encryption key scoped to the account rather than the default service-scoped key. After creation, this setting cannot be changed. Microsoft Learn

An encryption scope does not solve this requirement because encryption scopes apply to Blob Storage containers and individual blobs, not Azure Table data. Microsoft Learn

An Azure RBAC assignment may later be required so that the storage account ' s managed identity can access the customer-managed key in Key Vault, but it does not itself configure Table Storage to support account-level CMK encryption. Purge protection applies to Azure Key Vault rather than storage2.

Therefore, when storage2 is created, configure Table Storage to use the account encryption key.

===============

For AKS1, assign the AcrPull role on Registry1. AcrPull provides the permissions required to download container images from an Azure Container Registry without granting permissions to push, modify, or delete images. Microsoft documents that when AKS is integrated with an Azure Container Registry, the appropriate pull-only role is assigned to the AKS identity used for image pulls. This satisfies the explicit requirement that AKS1 must only be able to pull images and follows least privilege. Microsoft Learn

For ID1, assign AcrPush. Microsoft defines AcrPush as the built-in Azure RBAC role for identities that require both push and pull permissions on a non-ABAC-enabled Azure Container Registry. It therefore allows ID1 to upload container images and retrieve existing images from Registry1 without granting broad resource-management capabilities such as Contributor or Owner. Microsoft Learn

Contributor and Owner would grant substantially more Azure management permissions than required. Reader does not provide container image pull/push data-plane permissions.

Encryption type

ExpressRoute circuits

Layer 2 encryption

ER3 and ER4 only

Layer 3 encryption

ER1, ER2, ER3, and ER4

For Layer 2 encryption, Azure ExpressRoute uses MACsec (Media Access Control Security). Microsoft states that MACsec is available for ExpressRoute Direct connections because customers have dedicated physical ports connecting their edge routers directly to Microsoft Enterprise Edge routers. Therefore, both ER3 (ExpressRoute Direct) and ER4 (ExpressRoute Metro Direct) can use MACsec. Provider-based ExpressRoute circuits such as ER1 and ER2 do not expose dedicated ExpressRoute Direct ports to the customer and therefore do not support this native Layer 2 MACsec capability. Microsoft Learn

For Layer 3 encryption, ExpressRoute can use IPsec over ExpressRoute private peering. Unlike MACsec, IPsec is an end-to-end network-layer encryption mechanism and is not dependent on ExpressRoute Direct physical ports. Microsoft states that IPsec over ExpressRoute works with any ExpressRoute circuit, allowing encrypted connectivity between the on-premises network and Azure over private peering.

Choose Admin1 because the planned Defender for Cloud change is to enable the NIST SP 800-53 Rev. 5 regulatory compliance standard for Sub1. Defender for Cloud implements regulatory compliance standards through Azure Policy initiatives, and assigning a new standard requires permissions to create or manage policy assignments.

Microsoft states that assigning a regulatory compliance standard requires Owner or Policy Contributor permissions at the relevant scope. Microsoft Learn Admin1 has the Resource Policy Contributor Azure role on Sub1, which provides the policy-management permissions required to assign policy initiatives and therefore supports enabling the NIST standard without granting broader resource-management permissions.

Admin2 has User Access Administrator, which manages Azure RBAC assignments but does not provide the policy-management permissions required for this operation. Admin3 has Contributor, which can manage Azure resources but is restricted from performing certain Microsoft.Authorization operations, including policy assignment operations needed here. Admin4 is a Global Administrator in Microsoft Entra but has no Azure role assignment for Sub1; Microsoft Entra directory administration does not automatically provide subscription-level Defender for Cloud policy-management rights.

Because Admin1 already has the specific policy-management role required for the change, selecting Admin1 satisfies both the functional requirement and the principle of least privilege.

===============

The first step is to enable a system-assigned managed identity on VM1. The scenario requires VM1 to read data from storage1 and also specifies that when VM1 is deleted, the permissions associated with VM1 must effectively cease automatically.

A system-assigned managed identity has a one-to-one lifecycle relationship with the Azure resource to which it belongs. Microsoft explicitly states that when the associated resource is deleted, its system-assigned managed identity is automatically deleted from Microsoft Entra ID. In contrast, a user-assigned identity such as ID1 exists independently and remains after the VM is deleted. Microsoft Learn

After enabling the identity, the appropriate storage data-plane role—such as Storage Blob Data Reader when VM1 requires read access to blobs—can be granted to VM1 ' s managed identity at the required scope. Microsoft documents this exact pattern for a Windows VM accessing Azure Storage: enable its managed identity and assign Storage Blob Data Reader to that identity. Microsoft Learn

Federated credentials are unnecessary for a VM ' s native managed identity. Assigning ID1 would violate the lifecycle requirement because ID1 is user-assigned and survives VM1 deletion. A role assignment cannot be created for VM1 ' s system identity until that identity exists.

Therefore, first enable VM1 ' s system-assigned managed identity.

The technical requirement states that all outbound traffic from the function apps to the on-premises network must use ExpressRoute circuits. To accomplish this, the Function App hosting plan must support outbound virtual network integration, because the application must send outbound traffic into an Azure virtual network from which routes learned through or directed toward the ExpressRoute gateway can reach the on-premises environment.

Fa1, which uses the Flex Consumption plan, supports virtual network integration. Microsoft documents that Flex Consumption provides outbound virtual network connectivity and can therefore reach resources accessible through the integrated virtual network. Microsoft Learn

Fa3, which uses a Dedicated App Service plan, also supports outbound virtual network integration. Microsoft further documents that VNet-integrated Functions can have outbound traffic affected by BGP routes learned from an ExpressRoute gateway, and route tables can direct traffic through that gateway. Microsoft Learn

Fa2, however, uses the legacy Consumption plan, which does not support outbound virtual network integration. Consequently, it cannot meet the requirement to route its outbound on-premises traffic through ExpressRoute using this architecture. Microsoft Learn

Therefore, only Fa1 and Fa3 support the required networking configuration.

A user-assigned managed identity can be attached to multiple virtual machines and then granted an Azure Storage data role. The applications running on VM1 and VM2 can request tokens for that identity and access storage1 without account keys. Public network access is already enabled, so the missing control is authorization. Assigning the user-assigned managed identity to the correct storage role satisfies the access requirement. For SC-500, the decisive distinction is whether the control authenticates an identity, grants authorization, or merely changes configuration visibility. The incorrect choices generally either grant excessive privilege, change the application model, or operate at the wrong scope. Microsoft expects the least-privilege identity path that satisfies the scenario without introducing shared secrets or unnecessary tenant-wide rights. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > managed identities; Microsoft Learn > user-assigned managed identities and role assignment to storage.

==============================================================

An automation rule is the native Sentinel control for applying actions automatically when incidents are created or updated. It can assign incidents to users or groups, change status/severity, add tags, and run playbooks. This directly matches the requirement to assign all new incidents immediately and flag them for triage. It is more direct than hunting queries and is intended for incident-handling automation. The posture and monitoring objective focuses on turning security data into usable operational outcomes. The correct answer either collects the right signal, grants the right security-operations role, or automates incident handling at the correct layer. Distractors often provide dashboards, queries, or broad permissions, but those do not create the requested workflow or least-privilege security capability. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > Sentinel automation rules; Microsoft Learn > automation rule actions for incident assignment.

==============================================================

A private endpoint changes network routing so clients reach the storage account over a private IP address, but it does not grant data-plane authorization. The scenario already allows public network access, so network reachability is not the missing component. VM1 and VM2 still need Azure RBAC assignments for their managed identities or another valid authentication path. Therefore, a private endpoint alone does not meet the goal. For this domain, least privilege means granting only the required data operation or allowing only the required network flow. The correct response avoids shared keys, broad peering, general contributor roles, or log-only controls when the scenario demands prevention, routing, event triggering, or account-specific configuration. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > private endpoints and storage access; Microsoft Learn > private endpoints provide network access, not authorization.

Yes; 2) No; 3) Yes

The visible PIM settings indicate that Admin1 must approve Agent ID Developer activations, Admin2 is not an approver for the AI Administrator role, and Admin3 can assign User1 a two-day active assignment for Agent ID Developer. The controlling factors are the configured approver list and active assignment duration policy for each role. PIM evaluates those settings per role, so approval authority or duration for one role cannot be assumed for another role. For SC-500, the decisive distinction is whether the control authenticates an identity, grants authorization, or merely changes configuration visibility. The incorrect choices generally either grant excessive privilege, change the application model, or operate at the wrong scope. Microsoft expects the least-privilege identity path that satisfies the scenario without introducing shared secrets or unnecessary tenant-wide rights. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > PIM role settings and Agent ID governance; Microsoft Learn > approvers and maximum activation duration.

==============================================================

A playbook can automate incident response actions by using a Logic Apps workflow. When designed with the Microsoft Sentinel incident trigger or invoked from an automation rule, it can assign an incident and add a triage flag. Because the proposed solution is a playbook for new incidents, it can meet the goal. The essential point is that the workflow must run when incidents are created and update incident properties. The SC-500 study guide places these tasks under security posture, event collection, Defender CSPM, EASM, Sentinel, and Security Copilot operations. The exam expects the control that minimizes analyst effort while preserving correct permissions and data flow. The selected answer reflects that service boundary and avoids a broader or merely investigative alternative. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > Sentinel playbooks; Microsoft Learn > automate incident assignment and tagging.

==============================================================

A hunting query is an investigation tool. It can find suspicious activity or support manual threat hunting, but it does not automatically assign every new incident to a group or flag it for triage. The requirement is an operational automation requirement on incident creation. Therefore, a hunting query alone does not meet the goal even though it may help analysts review incidents later. In Microsoft Sentinel and Defender scenarios, collection, detection, investigation, and automation are separate functions. The selected answer maps to the function requested by the question rather than a neighboring capability. This is why analytics, hunting, workbooks, connectors, automation rules, and playbooks must not be treated as interchangeable. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > Sentinel hunting and automation; Microsoft Learn > hunting queries versus incident automation.

==============================================================

The correct configuration is the Secrets Store CSI Driver. The planned change requires AKS1 to integrate with Vault1, which is an Azure Key Vault. Microsoft provides the Azure Key Vault Provider for Secrets Store CSI Driver specifically for this scenario. It enables an AKS cluster to consume Key Vault objects—such as secrets, keys, and certificates—by mounting them into Kubernetes pods through a CSI volume. Microsoft explicitly describes this driver as providing integration between Azure Key Vault and AKS.

A workload identity can be used as an authentication mechanism that allows Kubernetes workloads to authenticate to Azure resources, including Key Vault, but it is not by itself the feature that performs the Key Vault integration requested by the question. In fact, Workload ID is one of several supported identity methods that can be used with the Secrets Store CSI Driver.

Application scaling controls workload capacity and does not provide secret-store integration. Kubernetes RBAC controls authorization to Kubernetes resources but does not connect AKS to Azure Key Vault.

This maps directly to the SC-500 Secure compute domain, which includes implementing and configuring security controls for Azure Kubernetes Service (AKS).

The correct choice is storage1 only.

For Azure SQL Database auditing, Microsoft supports writing audit logs to an Azure Storage account. Both Standard storage accounts and Premium BlockBlobStorage accounts are supported as audit destinations. However, the question specifically requires configuring auditing for sql1 by using the Azure portal. Microsoft states that when auditing is configured through the Azure portal, the selected storage account must be in the same Azure region as the logical SQL server/database. Microsoft Learn

In this case, sql1 is located in West US. Of the available storage accounts, storage1 is also in West US and uses Standard performance, which is supported for SQL audit storage. Therefore, storage1 satisfies both the storage-type and regional requirements.

Although storage2 uses Premium Block blobs, which is technically supported for SQL auditing, it is located in East US, so it cannot be selected through the Azure portal for sql1. storage3 is Premium File shares and storage4 is Premium Page blobs; these are not supported SQL auditing storage destinations. Microsoft specifically identifies Standard storage and Premium BlockBlobStorage as supported.

The solution as worded adds virtual machine resources to a role. Azure Storage authorization through Azure RBAC is granted to security principals such as managed identities, users, groups, and service principals, not to VM compute objects as resource containers. Since each VM already has a system-assigned managed identity, the correct approach would be to assign the storage data role to those identities. As stated, this solution does not meet the goal. The exam objective emphasizes practical identity enforcement rather than cosmetic configuration. A valid answer must identify who authenticates, what permission is granted, where the scope is applied, and whether the method continues to work without passwords or secrets. That is why the selected answer is preferred over broader administrative roles or unrelated access settings. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > managed identities and storage access; Microsoft Learn > RBAC role assignments are made to identities.

==============================================================

Set Analytics retention to 2 years. The case states that the DnsEvents table uses the Analytics tier and requires data to be retained for the maximum supported duration without changing the tier. For a Log Analytics table using the Analytics plan, Microsoft currently supports an Analytics—or interactive—retention period of up to 730 days (two years). During this period, the data remains directly available for high-performance KQL queries, Microsoft Sentinel analytics rules, hunting, workbooks, and other real-time security operations.

The important distinction is between Analytics retention and total retention. Microsoft Sentinel can retain data for up to 12 years in long-term/Data Lake retention, but data beyond the Analytics retention period is no longer maintained as normal interactive Analytics-tier data. Access to long-term data uses mechanisms such as search jobs or the Data Lake tier. Therefore, 12 years does not satisfy a question specifically asking for the maximum Analytics retention.

The other choices—180 days and one year—are valid durations but are below the maximum. Six years exceeds the two-year Analytics limit.

To create trusted images, the user must be able to push images and sign them. AcrPush allows pushing image content to the registry, while AcrImageSigner allows signing trusted images. Contributor would be excessive because it grants broad management rights. Quarantine reader/writer roles relate to quarantine workflows, not content trust signing. The combination of AcrPush and AcrImageSigner matches least privilege for trusted image creation. This answer also follows operational scalability. Microsoft security architecture favors policy-driven deployment, agentless assessment, managed identities, and Defender workload plans where possible. Those mechanisms reduce manual configuration while keeping enforcement tied to the resource type, which is why the selected choice is stronger than manual or after-the-fact alternatives. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > Azure Container Registry security; Microsoft Learn > ACR roles for push and image signing.

==============================================================

The requirement is centralized enforcement for all databases on the logical server. Microsoft Entra-only authentication disables SQL authentication at the server level, so SQL logins cannot be used against any database hosted there. Configuring an Entra administrator is typically a prerequisite or supporting step, but by itself it does not disable SQL authentication. A managed identity for the server and deleting logins from one database do not meet the central enforcement requirement. For SC-500, the decisive distinction is whether the control authenticates an identity, grants authorization, or merely changes configuration visibility. The incorrect choices generally either grant excessive privilege, change the application model, or operate at the wrong scope. Microsoft expects the least-privilege identity path that satisfies the scenario without introducing shared secrets or unnecessary tenant-wide rights. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > Azure SQL authentication; Microsoft Learn > Microsoft Entra-only authentication for Azure SQL.

==============================================================

A user delegation SAS is the best choice because the requirement specifically calls for time-bound, least-privilege access to Azure Blob Storage. A SAS can be restricted to the exact resource, permissions, and validity period required. For example, the token can grant only the permissions needed to upload blobs and can be configured with a defined expiration time. Microsoft recommends using a user delegation SAS whenever possible because it is secured with Microsoft Entra credentials instead of the storage account key. Microsoft Learn

This is more secure than Shared Key authorization, which relies on storage account keys that provide broad access and are harder to constrain safely. Microsoft explicitly recommends avoiding Shared Key when more secure Microsoft Entra-based approaches are available. Microsoft Learn

A managed identity would be ideal for a workload hosted on an Azure service that supports managed identities, but the question describes a third-party workflow system and emphasizes temporary delegated access. A user delegation SAS directly satisfies that use case. Anonymous public access is inappropriate because it does not provide controlled authenticated upload access.

Therefore, the correct authorization mechanism is a user delegation SAS.

Statement

Selection

___ can create keys in the key vault.

Only User2

___ can create secrets in the key vault.

Only User3

Comprehensive and Detailed 150 to 250 words of Explanation From [Cloud and AI Security Engineer/Course Guide/topics]:

User2 is the only user who can create keys in KeyVault1. The Key Vault Crypto Officer role permits key-management data-plane operations, including creating and managing keys, and User2’s role is assigned at the vault scope, so it applies to all keys in that vault.

User3 is the only user who can create secrets. The Key Vault Secrets Officer role permits secret-management data-plane operations and is also scoped to the entire vault.

User1 cannot create keys or secrets merely because they are an Owner at subscription scope. Owner grants broad Azure Resource Manager control-plane permissions, including the ability to assign roles, but Key Vault keys and secrets are data-plane resources that require explicit Key Vault data roles.

User4 has Key Vault Administrator, but the assignment scope is only the existing Key1 resource. That permission applies to Key1 and does not extend upward to the vault or sideways to other keys/secrets, so User4 cannot create a new key or a secret at vault scope.

Azure Firewall application rules inspect HTTP and HTTPS traffic by FQDN or URL-oriented application targets. The scenario says the virtual machines may reach only updates.contoso.com and all other outbound traffic must be blocked. A network rule works at IP address, port, and protocol level, but it is not the best fit for URL/FQDN-based allowlisting. NAT rules translate inbound traffic and do not solve outbound web filtering. The important exam skill is separating data-plane access, management-plane administration, and network reachability. A storage, database, or firewall setting must be selected because it enforces the exact path requested in the scenario. Distractors often look plausible because they improve security generally, but they do not satisfy the protocol, scope, or automation requirement stated in the question. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > Azure Firewall; Microsoft Learn > Azure Firewall application rules and FQDN filtering.

==============================================================

Secured virtual hubs in Virtual WAN are managed through Azure Firewall Manager. Firewall Manager can deploy and manage Azure Firewall policies across secured virtual hubs and keep policy configuration consistent across regions. Azure Virtual Network Manager is designed for virtual network topology and security admin rules, not Virtual WAN secured hub policy synchronization. Azure Front Door and Network Function Manager address different perimeter or network appliance scenarios. The important exam skill is separating data-plane access, management-plane administration, and network reachability. A storage, database, or firewall setting must be selected because it enforces the exact path requested in the scenario. Distractors often look plausible because they improve security generally, but they do not satisfy the protocol, scope, or automation requirement stated in the question. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > Secure Azure Virtual WAN; Microsoft Learn > Azure Firewall Manager secured virtual hubs and policies.

==============================================================

Defender plan

Selection

Defender for Servers Plan 1

Sub1 and VM1 only

Defender for Key Vault

Sub1 and Vault1 only

For Defender for Servers Plan 1, Microsoft supports enablement at the Azure subscription level and at the individual server resource level. Microsoft’s current deployment-scope table explicitly states that Plan 1 can be enabled for an Azure subscription and for a specific resource, such as an Azure VM. It cannot be enabled directly on a management group, resource group, or Log Analytics workspace as a Plan 1 protection scope.

For Defender for Key Vault, the exam item targets the Defender plan at the subscription or individual vault scope. Defender for Key Vault is billed and represented using a per-vault protection model, and Microsoft’s Defender for Cloud policy set includes a dedicated configuration for the Key Vault plan. It is not enabled on a resource group, management group, or Log Analytics workspace.

One current-platform nuance: Microsoft announced in July 2026 that new onboarding through the legacy Defender for Key Vault plan-enablement path is deprecated/blocked, with migration to the newer fixed-pricing model. The exam answer for this item as written remains the scope combination above.

Final selections:

Defender for Servers Plan 1 → Sub1 and VM1 only

Defender for Key Vault → Sub1 and Vault1 only

A SharePoint Advanced Management Data access governance report is specifically designed to identify SharePoint content that is broadly accessible across the organization. In particular, SharePoint provides reports for content shared with Everyone except external users (EEEU) and Everyone. EEEU automatically includes all internal users, making this report directly applicable when investigating content that Microsoft 365 Copilot could surface to employees because of overly broad SharePoint permissions.

Microsoft states that Data access governance reports help organizations detect oversharing, analyze permission exposure, and identify sites and files whose current permissions allow excessive internal access. This is especially relevant before or during Copilot adoption because Copilot honors existing user permissions: broadly accessible SharePoint content can therefore appear in Copilot-powered experiences for users who already have permission to access it.

A Purview DLP policy detects and governs sensitive-data handling but does not provide the required inventory of content shared with all internal users. A DSPM remediation action is intended to remediate identified risks rather than produce this specific SharePoint permission report. Conditional Access controls authentication conditions and does not analyze SharePoint permissions.

The SC-500 study guide explicitly includes identifying overexposure of data in SharePoint under Secure compute and AI security.

===============

Use Attack paths and inspect the identity ' s blast radius. Microsoft specifically teaches this workflow for AI-agent identities: Microsoft Defender XDR can discover AI agents, assess the blast radius of each agent identity, and analyze attack paths that could lead to unauthorized resource or data access. This directly addresses the requirement to determine what could be affected if the agent ' s service principal were compromised and used for lateral movement. Microsoft Learn

Blast-radius analysis visually shows how compromise of one entity could affect connected assets and exposes the highest-risk lateral movement paths. Microsoft describes attack paths as routes attackers could exploit through identity permissions and resource relationships, while blast radius identifies the broader set of assets that could be reached from the compromised identity. Microsoft Learn

Advanced Hunting could enumerate sign-in activity, and Purview Audit could reveal role-assignment events, but both require manual correlation and do not directly calculate reachable resources. Reviewing OAuth incidents provides detection context, not full impact analysis. AI Observability focuses on agent usage and data activity rather than identity-to-resource lateral movement.

Therefore, the lowest-effort and most direct method is:

Correct answer: E. From Attack paths, select the identity and view the blast radius.

Statement

Answer

On May 15, User1 can activate the Contributor role.

Yes

On May 15, User2 can use the Contributor role.

Yes

On June 15, User3 can activate the Contributor role.

No

User1 = Yes. User1 received an eligible assignment on May 1, and eligible assignments expire after three months, so the assignment remains valid on May 15. Eligible users must activate the role before using it. PIM is configured to require Azure MFA and justification during activation. Microsoft states that PIM can require MFA during role activation independently of the user ' s legacy per-user MFA state; a per-user state of Disabled does not prevent PIM from challenging the user for MFA.

User2 = Yes. User2 has an active assignment, so no activation is required. Microsoft explicitly states that active assignments provide role privileges immediately. The assignment expires after one month, meaning it is still valid on May 15. The “Require Azure MFA on active assignment” setting applies when an administrator creates the active assignment; it does not force MFA every time the user uses the role.

User3 = No. User3 also received an active assignment on May 1, which expires after one month, around June 1. By June 15, that assignment has expired. Because User3 was not assigned an eligible role, there is nothing available to activate.

For successful database logins, configure SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP. This action group records successful authentication events against the Azure SQL database and supplies identity and connection information that can be valuable during Microsoft Defender for SQL investigations.

For unsuccessful login attempts, configure FAILED_DATABASE_AUTHENTICATION_GROUP. It records failed database authentication attempts, which are particularly relevant to Defender for SQL detections involving suspicious login activity, credential attacks, or anomalous access attempts.

Microsoft ' s Azure SQL auditing documentation identifies a recommended default set of database audit action groups consisting of BATCH_COMPLETED_GROUP, SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP, and FAILED_DATABASE_AUTHENTICATION_GROUP. Together, these capture executed queries and stored procedures plus successful and failed database authentication events. Microsoft specifically warns against unnecessarily combining the recommended set with overlapping action groups because this can generate duplicate audit records. Microsoft Learn

For the two authentication requirements represented in this drag-and-drop item, the corresponding selections are therefore the successful and failed database authentication groups. These audit records enrich Defender for SQL Advanced Threat Protection investigations with the authentication context needed to analyze suspicious database activity.

Statement

Answer

You can establish a Remote Desktop connection from VM1 to VM3 for a maximum of three hours.

No

You can establish a Remote Desktop connection from VM2 to VM1 after requesting access.

No

You can establish a Remote Desktop connection from VM3 to VM1 without requesting access.

No

JIT access on VM1 controls inbound traffic to VM1, not outbound traffic originating from VM1. Therefore, the three-hour RDP rule on VM1 does not limit a connection from VM1 to VM3. Microsoft states that JIT protects selected VM ports by blocking inbound traffic until access is requested and approved.

The second statement is No because VM2 ' s source address is in 172.16.0.0/24, but VM1 ' s JIT configuration for RDP port 3389 permits requests only from 10.10.0.0/24 and 192.168.10.0/24. JIT requests must use source addresses allowed by the configured JIT policy.

The third statement is also No. VM3 is in 192.168.10.0/24, which is an allowed source range for port 3389, but that does not mean permanent access is open. Microsoft documents that when JIT is enabled, users must still request access; Defender for Cloud then temporarily opens the selected port for the approved source IP and duration.

For IPObject1, the resource is being deployed to RG2, whose location is East US, and the public IP is also East US. The location condition is therefore false. Its name, IPObject1, contains obj when evaluated case-insensitively, so the second condition is also false. Azure Policy string comparisons other than the explicitly case-sensitive matching operators use InvariantCultureIgnoreCase, making Object satisfy obj. Microsoft Learn

obj1 cannot be created. The policy uses the resourceGroup() function even while evaluating creation of a resource-group resource itself. For a policy/template-function evaluation that produces an error, Microsoft states that policy evaluation fails and the result is an implicit deny. Microsoft Learn

For OBJ3, the VNet is West US and RG1 is also West US, so the location matches. OBJ3 also contains obj under Azure Policy ' s case-insensitive string evaluation. Neither part of the anyOf expression therefore evaluates true, so the deny effect isn ' t triggered.

Microsoft documents that the deny effect prevents matching resource-creation requests before they ' re sent successfully to the resource provider.

The protected resource is Azure Database for PostgreSQL, which is an open-source relational database service. Microsoft Defender for Open-Source Relational Databases is scoped to PostgreSQL and MySQL style services, so it satisfies the requirement without enabling broader plans. Defender for Azure SQL Databases applies to Azure SQL, Defender for SQL Servers on Machines applies to SQL Server on VMs or Arc-enabled machines, and Defender for Servers or Storage would charge for unrelated workloads. Microsoft platform security questions usually hinge on where enforcement occurs: at the resource, server, subnet, firewall policy, private endpoint, or subscription level. The selected answer uses the control plane that owns that enforcement point. Other options are rejected when they only log activity, broaden network access, or protect a different service category. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > Defender for Databases; Microsoft Learn > Defender for open-source relational databases.

==============================================================

Configure the native cloud connector first. Defender for Cloud uses its native AWS connector to establish the integration between an AWS account and Microsoft Defender for Cloud. During onboarding, the connector can be configured for Defender for Servers and automatic provisioning of the components required to protect EC2 instances.

Microsoft documents that AWS EC2 instances protected by Defender for Servers use Azure Arc-enabled servers and that automatic provisioning is recommended. The AWS integration uses AWS Systems Manager (SSM) to install Azure Arc on eligible EC2 instances, after which Defender for Cloud can deploy required security extensions such as Microsoft Defender for Endpoint. Microsoft Learn

Therefore, the Azure Connected Machine agent is ultimately involved, but manually configuring that agent is not the first step when the requirement is to protect newly created instances automatically. The multicloud/native connector handles the Arc onboarding workflow.

The classic connector represents the older AWS integration architecture and isn ' t the appropriate current onboarding model. The Azure Monitor Agent is designed for monitoring and telemetry collection rather than establishing automatic Defender for Servers onboarding for AWS.

Correct answer: A. the native cloud connector

===============

Create a user-assigned managed identity before deploying the database. Microsoft documents that when Azure SQL Database is created with TDE using a customer-managed key (CMK), a user-assigned managed identity can be created in advance, granted access to the Azure Key Vault, and then assigned to the SQL logical server as its primary identity. This allows the server to access the TDE protector during deployment. Microsoft Learn

The identity must have the required Key Vault cryptographic permissions—typically Get, Wrap Key, and Unwrap Key—on the key used as the TDE protector. Microsoft explicitly states that preauthorizing the user-assigned identity enables CMK-backed TDE at server/database creation time, which is the key distinction in this question. Microsoft Learn

An app registration is not required because Azure SQL uses the managed identity to authenticate to Key Vault. A storage account is unrelated to TDE key access. Assigning SQL Security Manager to a user might permit administrative configuration of TDE, but it does not provide the SQL server with the runtime identity needed to retrieve and use the customer-managed key.

Therefore, the required prerequisite is:

Correct answer: B. a user-assigned managed identity

To configure Azure to allow RDP connections from the Internet to a virtual machine named VM1, you can follow the steps below:

Create a new inbound security rule in the network security group (NSG) that is associated with the virtual network subnet that contains VM1. The rule should allow RDP traffic from the Internet to the virtual network subnet. You can use the Azure portal, Azure PowerShell, or Azure CLI to create the rule.

Configure the network security group (NSG) to associate it with the virtual network subnet that contains VM1.

Configure the virtual machine to allow RDP traffic. You can use the Azure portal, Azure PowerShell, or Azure CLI to configure the virtual machine.

To minimize the attack surface of VM1, you can use the following best practices:

Use a strong password for the local administrator account on the virtual machine.

Use Network Security Groups (NSGs) to restrict traffic to only the necessary ports and protocols.

Use Azure Security Center to monitor and protect your virtual machines.

To add the network interface of a virtual machine named VM1 to an application security group named ASG1, you can follow these steps:

In the Azure portal, search for and select the virtual machine named VM1.

In the left pane, select Networking.

In the Networking pane, select the network interface that you want to add to the application security group named ASG1.

In the network interface pane, select Application security groups.

In the Application security groups pane, select Add.

In the Add application security group pane, select the application security group named ASG1.

Select Save.

You can find more information on this topic in the following Microsoft documentation: Add a network interface to an application security group using the Azure portal.

To collect all the audit failure data from the security log of a virtual machine named VM1 to an Azure Storage account, you can follow these steps:

In the Azure portal, search for and select the virtual machine named VM1.

In the left pane, select Diagnostic settings.

Select Add diagnostic setting.

In the Add diagnostic setting pane, enter the following information:

Name: Enter a name for the diagnostic setting.

Destination: Select Storage account.

Storage account: Select the storage account you want to use.

Logs: Select Windows Event Logs.

Categories: Select Security.

Event types: Select Audit Failure.

Select Save.

To register App28681041 to Azure AD and generate a password for it, you can follow these steps:

In the Azure portal, search for and select Azure Active Directory.

In the left pane, select App registrations.

Select New registration.

In the Register an application pane, enter the following information:

Name: App28681041

Supported account types: Select the appropriate account types for your scenario.

Redirect URI: Leave this field blank.

Select Register.

In the App registrations pane, select the newly created App28681041 application.

In the left pane, select Certificates & secrets.

Select New client secret.

In the Add a client secret pane, enter the following information:

Description: Enter a description for the client secret.

Expires: Select an appropriate expiration date for the client secret.

Select Add.

In the Certificates & secrets pane, copy the value of the newly created client secret.

You can find more information on this topic in the following Microsoft documentation: Quickstart: Register an application with the Microsoft identity platform.

To prevent HTTP connections to the rg1lod28681041n1 Azure Storage account, you can follow these steps:

In the Azure portal, search for and select the storage account named rg1lod28681041n1.

In the left pane, select Firewalls and virtual networks.

In the Firewalls and virtual networks pane, select Selected networks.

In the Selected networks pane, select Add existing virtual network.

In the Add existing virtual network pane, select the virtual network that does not allow HTTP connections.

Select Add.

To ensure that the rg1lod28681041n1 Azure Storage account is encrypted by using a key stored in the KeyVault28681041 Azure key vault, you can follow these steps:

In the Azure portal, search for and select the storage account named rg1lod28681041n1.

In the left pane, select Encryption.

In the Encryption pane, select Customer-managed key.

In the Customer-managed key pane, select Select from Key Vault.

In the Select from Key Vault pane, enter the following information:

Key vault: Select the KeyVault28681041 Azure key vault.

Key: Select the key you want to use.

Select Save.

To ensure that only devices connected to a 131-107.0.0/16 subnet can access data in the rg1lod28681041 Azure Storage account, you can follow these steps:

In the Azure portal, search for and select the storage account named rg1lod28681041.

In the left pane, select Firewalls and virtual networks.

In the Firewalls and virtual networks pane, select Selected networks.

In the Selected networks pane, select Add existing virtual network.

In the Add existing virtual network pane, select the virtual network that contains the 131-107.0.0/16 subnet.

Select Add.

https://docs.microsoft.com/en-us/azure/storage/common/storage-network-security

To email an alert to a user named adminl@contoso.com if the average CPU usage of a virtual machine named VM1 is greater than 70 percent for a period of 15 minutes, you can follow these steps:

In the Azure portal, search for and select the virtual machine named VM1.

In the left pane, select Alerts.

Select New alert rule.

In the New alert rule pane, enter the following information:

Name: Enter a name for the alert rule.

Description: Enter a description for the alert rule.

Condition: Select Metric measurement.

Resource: Select the virtual machine named VM1.

Metric: Select Percentage CPU.

Operator: Select Greater than.

Threshold: Enter 70.

Aggregation type: Select Average.

Period: Select 15 minutes.

In the Actions pane, select Add action group.

In the Add action group pane, enter the following information:

Name: Enter a name for the action group.

Short name: Enter a short name for the action group.

Email recipient: Enter the email address of the user you want to receive the alert. For example, adminl@contoso.com.

Select OK.

To ensure that a user named user2-28681041 can manage the properties of the virtual machines in the RG1lod28681041 resource group using the principle of least privilege, you can follow these steps:

In the Azure portal, search for and select the resource group named RG1lod28681041.

In the left pane, select Access control (IAM).

Select Add.

In the Add role assignment pane, enter the following information:

Role: Select the appropriate role for your scenario. For example, Virtual Machine Contributor.

Assign access to: Select User, group, or service principal.

Select: Enter the name of the user you want to assign the role to. For example, user2-28681041.

Select Save.

https://docs.microsoft.com/en-us/azure/role-based-access-control/role-assignments-portal

To create a new Azure AD directory named 28681041.onmicrosoft.com that contains a new user named user1@28681041.onmicrosoft.com, you can follow these steps:

In the Azure portal, search for and select Azure Active Directory.

In the left pane, select Domains.

Select Add domain.

In the Add a custom domain pane, enter the following information:

Domain name: Enter the domain name you want to use. For example, 28681041.onmicrosoft.com.

Add domain: Select Add domain.

In the left pane, select Users.

Select New user.

In the New user pane, enter the following information:

User name: Enter the user name you want to use. For example, user1@28681041.onmicrosoft.com.

Name: Enter the name of the user.

Password: Enter a password for the user.

Groups: Select the groups you want the user to be a member of.

Select Create.

You can find more information on these topics in the following Microsoft documentation:

Add a custom domain name to Azure Active Directory

Create a new user in your organization - Azure Active Directory