Microsoft SC-500 Practice Exam Questions

Microsoft SC-500 Sample Question Answers

Question # 1

You have an Azure management group named MG1 that contains two subscriptions named Sub1 and Sub? Both subscriptions are linked to a Microsoft Entra tenant that contains a security group named Group! You need to ensure that the members of Group1 can assign roles to the resources in Sub1 and Sub2. The solution must follow the principle of least privilege. Which role should you assign to Group1?

A. Contributor at the MG1 scope 
B. Contributor at the Sub1 and Sub2 scopes 
C. User Access Administrator at the MG1 scope 
D. Owner at the MG1 scope

Show Answer

Question # 2

You have an Azure SQL Database logical server named Server1 that contains multiple databases. The databases contain legacy SQL authentication logins that must no longer be usable for sign-in but must NOT be removed from the databases. You need to ensure that SQL authentication is denied for connections. What should you do?

A. Run CREATE USER ... FROM EXTERNAL PROVIDER on each database.
B. Create a Conditional Access policy.
C. Enable Microsoft Entra-only authentication for Server1.
D. Assign the SQL Server Contributor role to Server1. 

Show Answer

Question # 3

You have an Azure subscription named Sub1 that contains a storage account named storage1. Sub1 has Microsoft Defender for Storage enabled. Defender for Storage has malware scanning enabled. You need to configure a solution that automates the remediation of malware detected in storage1. What should you include in the solution?

A. Application Insights
B. Azure Event Hubs
C. Azure Event Grid
D. Azure Policy

Show Answer

Question # 4

You have an Azure Storage account named storage1 that hosts a blob container named container1. You have an Azure Functions app named app1 that uses a managed identity. You need to configure app1 to read, write, and delete blobs in container1. The solution must follow the principle of least privilege. What should you do?

A. Assign the Storage Account Contributor role to the managed identity of app1 at the scope of storage1.
B. Assign the Storage Blob Delegator role to the managed identity of app1 at the scope of container1. 
C. Assign the Owner role to the managed identity of app1 at the scope of container1. 
D. Assign the Storage Blob Data Contributor role to the managed identity of app1 at the scope of container1.

Show Answer

Question # 5

You have an Azure subscription.You need to deploy an Azure virtual WAN to meet the following requirements:•Create three secured virtual hubs located in the East US. West US, and North EuropeAzure regions.•Ensure that security rules sync between the regions.What should you use?

A. Azure Network Function Manager
B. Azure Firewall Manager
C. Azure Virtual Network Manager
D. Azure Front Door

Show Answer

Question # 6

You have a hybrid environment that contains the following servers:•50 Azure virtual machines that run Windows Server 2019•20 physical, on premises servers that run Windows Server 2019All the servers use a third-party antivirus solution that must remain active during a phasedsecurity rolloutYou need to onboard all the servers to Microsoft Defender for Endpoint by using acentralized deployment method. The solution must meet the following requirements:•Endpoint detection and response (EDR) capabilities must be enabled.•Antivirus conflicts must be prevented during onboarding.What should you do on the servers?

A. Set the Microsoft Defender for Endpoint service to Disabled.
B. Disable Microsoft Defender Antivirus real-time protection by using Set-MpPreference.
C. Configure the ForceDefenderPassiveMode registry value.
D. Enable EDR in block mode.

Show Answer

Question # 7

You are configuring a new Microsoft Sentinel workspace named Workspace1.You have an external IT Service Management (ITSM) system that is NOT supported by anyMicrosoft Sentinel solutions in Azure Marketplace.You need to ensure that Workspace1 creates service tickets in the ITSM system for all newsecurity incidents.What should you create?

A. A playbook
B. A workbook
C. A watchlist
D. An analytics rule

Show Answer

Question # 8

You have a Microsoft Entra tenant that has user consent for applications disabled.You register an application named App1 that requests the following Microsoft Graphdelegated permissions:•user.Read•Mail.ReadYou need to configure tenant permissions to meet the following requirements:•Enable users to grant consent for low-risk permissions without administrator interaction.•Ensure that applications requesting higher-privilege permissions require administratorapproval.What should you do?

A. Grant tenant-wide admin consent to App1.
B. Configure application assignments for App1.
C. Configure Privileged Identity Management (PIM) role assignments.
D. Create an app consent policy.

Show Answer

Question # 9

You have multiple Microsoft Security Copilot workspaces.A user named User1 accesses Security Copilot by using the default workspace.You create a new workspace named Workspace 1 and assign a capacity to Workspace1.You plan to route Security Copilot agent traffic to Workspace1.You need to ensure that User1 can use embedded experiences without errors.What should you do before switching to Workspace1?

A. Add User1 to Workspace1.
B. Assign User1 the Security Operator role in Microsoft Entra.
C. Disassociate the capacity from the default workspace.
D. Create a new capacity for Workspace1.

Show Answer

Question # 10

You have a Microsoft Sentinel workspace named Workspace1You have 100 on-premises servers that run Linux and have the Azure Monitor Agentinstalled.You need to collect Syslog events from the Linux servers. The solution must meet thefollowing requirements:•Ensure that filtering occurs before data is written to Workspace1•Reduce ingestion costs by excluding low value Syslog messages.What should you include in the solution?

A. An Advanced Security Information Model (ASIM) parser  
B. A data collection rule (DCR)  
C. An analytics rule  
D. A table-level filter and split transformation  

Show Answer