2 packs: 15% off with code BUY2. 3 or more: 20% off with code BUY3.

Free Microsoft SC-500 Practice Questions

52 free Microsoft SC-500 practice questions from the CertStash pack of 207, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 52 free here, all 207 in the pack, and each step includes the one before it.

Get all 207 questions (US$39) · Download the first 10 as a PDF

Question 1

You have an Azure SQL Database logical server named Server1 that contains a database named DB1.

You need to configure authentication for Server1 to meet the following requirements:

SQL authentication cannot be used for any databases on Server1.

The solution must be enforced centrally at the server level.

What should you do?

  1. Configure a Microsoft Entra administrator for Server1.
  2. Enable a managed identity for Server1.
  3. Enable Microsoft Entra-only authentication for Server1.
  4. Remove SQL logins from DB1.
Show answer and explanation

Correct answer: C. Enable Microsoft Entra-only authentication for Server1.

Microsoft Entra-only authentication is a server-level setting on the Azure SQL logical server. Once enabled, the server refuses every SQL authentication connection across all of its databases, while existing SQL logins stay in place. That is exactly what the requirements ask for: SQL authentication unusable for any database on Server1, enforced centrally in one place rather than database by database.

Why the other options are wrong

  • A. Adding a Microsoft Entra administrator enables Entra authentication alongside SQL authentication. It permits the new method but never disables the old one.
  • B. A managed identity gives Server1 an identity for reaching out to other Azure resources. It has no bearing on how clients authenticate inbound to the server.
  • D. Removing SQL logins from DB1 is a per-database action that leaves other databases untouched and does not stop new SQL logins being created later. It fails the central enforcement requirement.

Question 2

You have a Microsoft Entra tenant that has the following configurations:

User consent for applications is disabled.

Only administrators can grant permissions to applications.

You register an application named App1 that uses delegated Microsoft Graph permissions.

You need to configure App1 to meet the following requirements:

Enable user sign-ins without interactive consent prompts.

Enable App1 to access Microsoft Graph on behalf of the signed-in user.

What should you do?

  1. Configure enterprise applications to require user assignment and assign users to App1.
  2. Modify the app registration to use application permissions instead of delegated permissions.
  3. Add the required delegated Microsoft Graph permissions to the app registration and rely on user consent during sign-in.
  4. Grant admin consent to App1 for the required delegated permissions.
Show answer and explanation

Correct answer: D. Grant admin consent to App1 for the required delegated permissions.

User consent is disabled tenant-wide, so a user can never approve the delegated permissions themselves and would be blocked at sign-in. Granting tenant-wide admin consent pre-approves the delegated Microsoft Graph permissions on behalf of the whole organization. Users then sign in with no interactive consent prompt, and because the permissions remain delegated, App1 still calls Graph as the signed-in user.

Why the other options are wrong

  • A. Requiring user assignment controls which users are allowed to access App1. It governs access, not consent, so the consent prompt still blocks sign-in.
  • B. Application permissions run as the app itself with no signed-in user, which breaks the requirement that App1 act on behalf of the user.
  • C. Relying on user consent during sign-in is precisely what the tenant configuration forbids, so sign-in fails.

Question 3

You have a Microsoft Entra tenant that uses Privileged Identity Management (PIM).

You need to modify the AI Administrator role settings to meet the following requirements:

Elevated access must be evaluated by another administrator before it is granted.

Privileged access must be removed automatically after a fixed period.

Which two settings should you configure? Each correct answer presents part of the solution.

NOTE: Each correct selection is worth one point.

  1. Expire active assignments after
  2. Require approval to activate
  3. Require justification on activation
  4. Expire eligible assignments after
  5. Activation maximum duration
Show answer and explanation

Correct answer: B, E. Require approval to activate; Activation maximum duration

Require approval to activate puts a second administrator in the path: the eligible user requests the AI Administrator role and someone else must approve before it is granted. Activation maximum duration caps how long that elevated session lasts, after which the role deactivates automatically. Together the two settings satisfy both requirements without any manual cleanup.

Why the other options are wrong

  • A. Expire active assignments after governs how long a standing active assignment lives, not how long an elevated activation lasts.
  • C. Requiring justification records a reason from the requester but nobody reviews or approves it, so access is still self-granted.
  • D. Expire eligible assignments after controls when a user stops being eligible to request the role. It does not remove privilege that has already been activated.

Question 4

You have two management groups named MG1 and MG2 that contain multiple Azure subscriptions. The subscriptions are linked to a Microsoft Entra tenant.

You have a user named User1 and a global administrator named Admin1.

You are informed that User1 created an Azure subscription named Sub1 under the MG2 management group and is the only owner of the subscription.

You need to ensure that Admin1 can remove the Owner role from User1 for Sub1.

What should you do first?

  1. Move Sub1 to MG1.
  2. Assign Admin1 the User Access Administrator role for Sub1.
  3. Instruct Admin1 to use Privileged Identity Management (PIM) to request the Security Administrator role.
  4. Instruct Admin1 to enable Access management for Azure resources.
Show answer and explanation

Correct answer: D. Instruct Admin1 to enable Access management for Azure resources.

A Global Administrator has no Azure RBAC permission over subscriptions by default, which is why Admin1 cannot touch the Owner assignment. Enabling Access management for Azure resources elevates the Global Administrator and assigns them User Access Administrator at the root scope, covering every management group and subscription in the tenant. From there Admin1 can manage role assignments on Sub1.

Why the other options are wrong

  • A. Moving Sub1 between management groups changes where it sits in the hierarchy but grants Admin1 no permission over it.
  • B. Assigning that role on Sub1 requires someone who already has role-assignment rights there, and User1 is the only owner. This is the problem, not the fix.
  • C. Security Administrator is a Microsoft Entra role. It carries no Azure RBAC write permission over subscriptions.

Question 5

You have a management group named MG1 that contains two subscriptions named Sub1 and Sub2.

Sub1 contains a resource group named RG-Exception and a resource group named RG1 that hosts Microsoft Foundry resources.

You need to assign an Azure policy to force new Foundry deployments in MG1 to use private endpoints. The solution must NOT restrict deployments in RG-Exception.

How should you configure the policy?

  1. Assign the policy to MG1 and exclude RG-Exception.
  2. Assign the policy to Sub1 and RG-Exception.
  3. Assign the policy to MG1 and RG-Exception.
  4. Assign the policy to Sub1 and exclude RG-Exception.
Show answer and explanation

Correct answer: A. Assign the policy to MG1 and exclude RG-Exception.

Assigning the policy at the management group means it flows down to every subscription and resource group under MG1, including ones created later. An exclusion on RG-Exception carves that single scope out of the assignment, so deployments there are unaffected while everything else is forced onto private endpoints.

Why the other options are wrong

  • B. Assigning to Sub1 covers only that subscription and misses Sub2 and any future subscription. Naming RG-Exception as a target enforces the policy there rather than exempting it.
  • C. Adding RG-Exception as an assignment scope applies the policy to it. Exclusion, not assignment, is what exempts a scope.
  • D. The exclusion is right but the scope is wrong. Assigning at Sub1 leaves the rest of MG1 unprotected.

Question 6

You have an Azure key vault named KV1 that uses role-based access control (RBAC) authorization. KV1 stores database connection strings for an Azure App Service web app named App1.

You enable a firewall on KV1 and allow access to KV1 from only the virtual network that contains App1.

You need to ensure that App1 can retrieve secrets from KV1 without using credentials stored in the application configuration.

What should you create?

  1. an access policy for KV1
  2. an app registration for App1
  3. a private endpoint for KV1
  4. a managed identity for App1
Show answer and explanation

Correct answer: D. a managed identity for App1

A managed identity gives App1 an identity in Microsoft Entra ID that Azure manages, with no secret stored anywhere in the app configuration. App1 requests a token for Key Vault with that identity and reads the secret, which is what the credential-free requirement demands. The firewall already permits the app virtual network, so network access is not the missing piece.

Why the other options are wrong

  • A. KV1 uses RBAC authorization, so access policies are not in effect. An access policy also does nothing about where credentials are stored.
  • B. An app registration needs a client secret or certificate that lives in the application configuration, which is the exact thing being eliminated.
  • C. A private endpoint changes the network path to KV1. Traffic from the virtual network is already allowed, and a network path is not an identity.

Question 7

You have a Microsoft Entra tenant that has user consent for applications disabled.

You register an application named App1 that requests the following Microsoft Graph delegated permissions:

• User.Read

• Mail.Read

You need to configure tenant permissions to meet the following requirements:

Enable users to grant consent for low-risk permissions without administrator interaction.

Ensure that applications requesting higher-privilege permissions require administrator approval.

What should you do?

  1. Grant tenant-wide admin consent to App1.
  2. Configure application assignments for App1.
  3. Configure Privileged Identity Management (PIM) role assignments.
  4. Create an app consent policy.
Show answer and explanation

Correct answer: D. Create an app consent policy.

An app consent policy defines which permissions users are allowed to consent to on their own and which ones must be escalated to an administrator. Classifying low-risk delegated permissions lets users self-consent, while anything outside that classification falls through to the admin consent workflow. One policy delivers both halves of the requirement and applies tenant-wide rather than to a single app.

Why the other options are wrong

  • A. Tenant-wide admin consent approves permissions for App1 alone. It sets no rule for other applications and does not let users consent to anything.
  • B. Application assignments decide which users may use an app. They have no effect on what permissions can be consented to.
  • C. PIM governs privileged directory and Azure role activation, not application permission consent.

Question 8

You have an Azure management group named MG1 that contains two subscriptions named Sub1 and Sub2. Both subscriptions are linked to a Microsoft Entra tenant that contains a security group named Group1.

You need to ensure that the members of Group1 can assign roles to the resources in Sub1 and Sub2. The solution must follow the principle of least privilege.

Which role should you assign to Group1?

  1. Contributor at the MG1 scope
  2. Contributor at the Sub1 and Sub2 scopes
  3. User Access Administrator at the MG1 scope
  4. Owner at the MG1 scope
Show answer and explanation

Correct answer: C. User Access Administrator at the MG1 scope

Assigning roles requires the Microsoft.Authorization/roleAssignments/write permission, which User Access Administrator carries and Contributor does not. Granting it at MG1 covers both Sub1 and Sub2 in a single assignment. It is the least privileged built-in role that can delegate access, since it adds no rights to manage the resources themselves.

Why the other options are wrong

  • A. Contributor can create and manage resources but is explicitly denied role assignment permissions at any scope.
  • B. Contributor still cannot assign roles, and splitting it across two subscriptions adds administrative overhead without adding the missing permission.
  • D. Owner would work but bundles full resource management with role assignment, which exceeds what the task requires.

Question 9

You have an Azure SQL Database logical server named Server1 that contains multiple databases.

The databases contain legacy SQL authentication logins that must no longer be usable for sign-in but must NOT be removed from the databases.

You need to ensure that SQL authentication is denied for connections.

What should you do?

  1. Run create USER ... FROM EXTERNAL PROVIDER on each database.
  2. Create a Conditional Access policy.
  3. Enable Microsoft Entra-only authentication for Server1.
  4. Assign the SQL Server Contributor role to Server1.
Show answer and explanation

Correct answer: C. Enable Microsoft Entra-only authentication for Server1.

Enabling Microsoft Entra-only authentication on Server1 makes the server reject all SQL authentication connections while leaving the legacy logins present in the databases. The accounts remain for auditing and future reference but can no longer be used to sign in, which is exactly the split the requirements describe.

Why the other options are wrong

  • A. Creating users from an external provider adds Microsoft Entra principals to a database. It does not block the SQL logins that already exist.
  • B. Conditional Access evaluates Microsoft Entra sign-ins. SQL authentication never reaches Entra, so no policy can be applied to it.
  • D. SQL Server Contributor is a management-plane role for administering the server resource, not a control over authentication methods.

Question 10

You have an Azure subscription named Sub1 that contains an Azure Database for PostgreSQL instance. Sub1 has Microsoft Defender for Cloud enabled.

You need to configure Microsoft Defender for Databases to minimize costs.

Which Defender plan should you enable?

  1. Microsoft Defender for Servers
  2. Microsoft Defender for Open-Source Relational Databases
  3. Microsoft Defender for SQL Servers on Machines
  4. Microsoft Defender for Azure SQL Databases
  5. Microsoft Defender for Storage
Show answer and explanation

Correct answer: B. Microsoft Defender for Open-Source Relational Databases

Azure Database for PostgreSQL is an open-source relational engine, so Microsoft Defender for Open-Source Relational Databases is the plan built for it. It is the narrowest plan that covers the workload, which keeps cost to a minimum because no other resource type is enrolled.

Why the other options are wrong

  • A. Defender for Servers protects virtual machines and is billed per server. It does not cover a PaaS database.
  • C. Defender for SQL Servers on Machines covers SQL Server installed on virtual machines, not managed PostgreSQL.
  • D. Defender for Azure SQL Databases covers Azure SQL Database and SQL Managed Instance only.
  • E. Defender for Storage protects storage accounts and has no database coverage.

What people say about the full SC-500 pack 5.0 from 2

The SC-500 exam questions helped me prepare for Microsoft security administration topics in a focused way. The practice questions were helpful for reviewing policy and protection concepts.
Mitchell SamuelsonSC-500
I found the SC-500 practice questions useful for reviewing security concepts. The materials helped me prepare with more confidence.
Damian SerieSC-500

Question 11

You have a Microsoft Entra tenant that contains a group named Group1.

You plan to target Group1 to use the Microsoft Authenticator authentication method.

You need to ensure that the members in Group1 can use the Authenticator app as their primary authentication method.

What should you do?

  1. Enable one-time passcodes in Authenticator for Group1.
  2. Revoke the sessions for the Group1 members.
  3. Enable Authenticator push authentication mode for Group1.
  4. Enable the Authenticator passwordless authentication method for Group1.
Show answer and explanation

Correct answer: D. Enable the Authenticator passwordless authentication method for Group1.

Using the Authenticator app as the primary authentication method means passwordless phone sign-in, where the app replaces the password entirely rather than confirming one. Enabling the Authenticator passwordless authentication method for Group1 is what makes that flow available to its members.

Why the other options are wrong

  • A. One-time passcodes in Authenticator are a fallback second factor entered after a password. The password is still primary.
  • B. Revoking sessions forces users to reauthenticate. It changes nothing about which methods are available.
  • C. Push notification mode is used as a second factor for multifactor authentication, so a password is still the primary credential.

Question 12

You are configuring a new Microsoft Sentinel workspace named Workspace1.

You have an external IT Service Management (ITSM) system that is NOT supported by any Microsoft Sentinel solutions in Azure Marketplace.

You need to ensure that Workspace1 creates service tickets in the ITSM system for all new security incidents.

What should you create?

  1. a playbook
  2. a workbook
  3. a watchlist
  4. an analytics rule
Show answer and explanation

Correct answer: A. a playbook

A playbook is a Logic App, so it can call any REST endpoint including an ITSM system that has no packaged Sentinel solution. Triggered on incident creation, it posts the ticket to the external system. The generic HTTP connector is precisely why a playbook is the answer when no built-in integration exists.

Why the other options are wrong

  • B. A workbook visualizes data in dashboards. It cannot call an external system or create tickets.
  • C. A watchlist is a reference dataset used to enrich queries and detections.
  • D. An analytics rule generates the incident. It detects the condition but performs no outbound action of its own.

Question 13

You plan to deploy Microsoft 365 Copilot.

You discover that Copilot can access sensitive information in your Microsoft SharePoint Online libraries.

You need to automatically identify which SharePoint Online content has been shared between all internal users.

What should you create?

  1. a Microsoft Purview data loss prevention (DLP) policy in audit mode for SharePoint Online
  2. a Microsoft Purview Data Security Posture Management (DSPM) remediation action
  3. a Conditional Access policy that requires multifactor authentication (MFA) for SharePoint Online
  4. a SharePoint Advanced Management (SAM) Data access governance report
Show answer and explanation

Correct answer: D. a SharePoint Advanced Management (SAM) Data access governance report

SharePoint Advanced Management includes Data access governance reports, which are designed for exactly this pre-Copilot problem. The reports enumerate sites and files shared broadly, including content shared with Everyone except external users, so you can see automatically which SharePoint content every internal user can reach and therefore which content Copilot can surface.

Why the other options are wrong

  • A. A DLP policy in audit mode watches for sensitive information being moved or shared going forward. It does not inventory existing broad sharing.
  • B. A DSPM remediation action changes a condition after it has been identified. The requirement is the identification step.
  • C. Conditional Access with MFA strengthens how users sign in. It has no bearing on which content is overshared.

Question 14

You have an Azure subscription.

You need to deploy an Azure virtual WAN to meet the following requirements:

Create three secured virtual hubs located in the East US, West US, and North Europe Azure regions.

Ensure that security rules sync between the regions.

What should you use?

  1. Azure Network Function Manager
  2. Azure Firewall Manager
  3. Azure Virtual Network Manager
  4. Azure Front Door
Show answer and explanation

Correct answer: B. Azure Firewall Manager

Azure Firewall Manager is the service that converts a Virtual WAN hub into a secured virtual hub by deploying Azure Firewall into it. Rules live in an Azure Firewall policy, and one policy can be attached to the hubs in East US, West US, and North Europe at once, so a rule change propagates to all three regions from a single place.

Why the other options are wrong

  • A. Azure Network Function Manager deploys third-party network functions to Azure Stack Edge. It does not secure Virtual WAN hubs.
  • C. Azure Virtual Network Manager groups and connects virtual networks and applies security admin rules. It does not create secured virtual hubs in a Virtual WAN.
  • D. Azure Front Door is a global HTTP load balancer and CDN with a web application firewall. It has no role in Virtual WAN hub security.

Question 15

You use Azure Virtual Network Manager to manage multiple virtual networks in a network group named Group1.

You discover that the virtual machines in Group1 are accessible from the internet by using TCP port 3389.

You need to block inbound TCP 3389 from the internet across all the virtual networks in Group1. The solution must minimize administrative effort.

What should you use?

  1. a connectivity configuration
  2. a security admin configuration
  3. a user-defined route (UDR)
  4. a network security group (NSG)
Show answer and explanation

Correct answer: B. a security admin configuration

A security admin configuration in Azure Virtual Network Manager lets you write a high-priority rule once and have it enforced across every virtual network in the target network group. A deny rule for inbound TCP 3389 from Internet applied to Group1 covers all current members and any virtual network added later. Security admin rules are evaluated before network security groups, so an existing permissive NSG cannot override the block.

Why the other options are wrong

  • A. A connectivity configuration builds the topology between virtual networks, such as a mesh or hub and spoke. It does not filter traffic.
  • C. A user-defined route changes where packets are sent next. It cannot deny traffic, and it would have to be maintained per subnet.
  • D. A network security group would work but has to be created and kept in sync on every virtual network or subnet individually, which is the administrative effort the question asks you to avoid. It is also overridden by security admin rules.

Question 16

You have an Azure subscription named Sub1 that is linked to a Microsoft Entra tenant named contoso.com.

Sub1 contains a Recovery Services vault named RSVault1 that stores virtual machines backups.

Your company’s security team maintains a dedicated Microsoft Entra tenant named security.contoso.com.

You need to ensure that modifying the backup settings of RSVault1 requires approval from an approver in security.contoso.com.

What should you do in contoso.com?

  1. Enable immutability for RSVault1 and lock the immutability setting.
  2. Create a private endpoint for RSVault1 on the virtual network.
  3. Configure Privileged Identity Management (PIM) activation for the Backup Operator role.
  4. Enable Multi-user authorization (MUA) for RSVault1.
Show answer and explanation

Correct answer: D. Enable Multi-user authorization (MUA) for RSVault1.

Multi-user authorization protects critical backup operations by tying the vault to a Resource Guard, which can live in a different Microsoft Entra tenant. Because the approver holds permissions on the Resource Guard in security.contoso.com and not in contoso.com, a vault administrator cannot approve their own change, which is exactly the separation of duties the requirement describes.

Why the other options are wrong

  • A. Immutability prevents backup data being deleted or shortened early, but it enforces a policy rather than routing a change through an approver.
  • B. A private endpoint restricts the network path to the vault. It has no bearing on who authorizes configuration changes.
  • C. PIM activation can require approval, but approvers must be principals in contoso.com, so it cannot place the decision with the separate security tenant.

Question 17

You have an Azure virtual network that contains 100 virtual machines and an Azure Firewall instance named FW1.

All the traffic from the virtual machines is routed through FW1.

You need to ensure that FW1 allows access to only a URL of updates.contoso.com and blocks all other outbound traffic.

What should you use?

  1. an inbound NAT rule
  2. an application rule
  3. an outbound NAT rule
  4. a network rule
Show answer and explanation

Correct answer: B. an application rule

Filtering outbound traffic by URL or fully qualified domain name requires an application rule, because only application rules inspect the HTTP host header and URL path. Permitting updates.contoso.com in an application rule and leaving everything else unmatched means the firewall default deny takes care of the rest.

Why the other options are wrong

  • A. An inbound NAT rule translates and forwards traffic arriving at the firewall. The requirement concerns outbound traffic.
  • C. Azure Firewall performs source NAT on outbound traffic automatically. There is no outbound NAT rule type, and NAT does not filter by URL.
  • D. A network rule matches on IP address, port, and protocol. It cannot express a URL, so it cannot restrict access to a single web address.

Question 18

You have an Azure subscription that contains a resource group named RG1.

RG1 contains a Microsoft Security Copilot deployment that is integrated with a Microsoft Sentinel workspace named Workspace1.

Analysts use the Security Copilot standalone experience to retrieve incidents by using the Microsoft Sentinel plugin.

A user named User1 can sign in to Security Copilot but cannot retrieve incidents from Workspace1. You verify that User1 has only the Security Copilot Contributor role.

You need to ensure that User1 can retrieve the incidents. The solution must follow the principle of least privilege and NOT require any configuration changes to Security Copilot.

Which role should you assign to User1?

  1. the Security Reader role in Microsoft Entra
  2. the Microsoft Sentinel Reader role for Workspace1
  3. the Security Copilot Owner role
  4. the Security Administrator role in Microsoft Entra
  5. the Contributor role in Azure for RG1
Show answer and explanation

Correct answer: B. the Microsoft Sentinel Reader role for Workspace1

The Security Copilot Contributor role lets User1 use Security Copilot but grants nothing in the Sentinel workspace, and the plugin queries Workspace1 using the signed-in user permissions. Assigning Microsoft Sentinel Reader on Workspace1 grants read access to incidents and nothing more, which is the least privileged role that fixes the failure without touching the Security Copilot configuration.

Why the other options are wrong

  • A. Security Reader is a Microsoft Entra directory role. It does not confer data access to an Azure Sentinel workspace.
  • C. Security Copilot Owner adds administrative rights over Security Copilot itself and still grants nothing in Workspace1.
  • D. Security Administrator is a broad directory role that exceeds least privilege and again does not grant workspace access.
  • E. Contributor on RG1 grants management rights over every resource in the group, far more than reading incidents.

Question 19

You have an Azure Storage account named storage1 that hosts a blob container named container1.

You have an Azure Functions app named app1 that uses a managed identity.

You need to configure app1 to read, write, and delete blobs in container1. The solution must follow the principle of least privilege.

What should you do?

  1. Assign the Storage Account Contributor role to the managed identity of app1 at the scope of storage1.
  2. Assign the Storage Blob Delegator role to the managed identity of App1 at the scope of container1.
  3. Assign the Owner role to the managed identity of App1 at the scope of container1.
  4. Assign the Storage Blob Data Contributor role to the managed identity of App1 at the scope of container1.
Show answer and explanation

Correct answer: D. Assign the Storage Blob Data Contributor role to the managed identity of App1 at the scope of container1.

Reading, writing, and deleting blobs are data-plane operations, and Storage Blob Data Contributor is the built-in role that grants exactly those. Assigning it at the scope of container1 rather than the whole storage account narrows the grant to the one container app1 actually needs, which satisfies least privilege on both the permission set and the scope.

Why the other options are wrong

  • A. Storage Account Contributor is a management-plane role. It allows managing the account and reading its keys, which is far more than reading blobs, and it does not grant data access on its own.
  • B. Storage Blob Delegator only allows requesting a user delegation key for generating SAS tokens. It grants no read, write, or delete access to blob data.
  • C. Owner grants full control including role assignment. It vastly exceeds what the app needs.

Question 20

Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem.

After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.

You have an Azure subscription that contains two virtual machines named VM1 and VM2. Each virtual machine has system-assigned managed identity enabled.

You have an Azure Storage account named storage1. Public access from all networks is enabled for storage1.

You need to ensure that VM1 and VM2 can access storage1.

Solution: You create a user-assigned managed identity, assign the identity to each virtual machine, and then add each managed identity to a role on storage1.

Does this meet the goal?

  1. Yes
  2. No
Show answer and explanation

Correct answer: A. Yes

A user-assigned managed identity is a standalone Microsoft Entra principal that can be attached to more than one virtual machine. Assigning it to VM1 and VM2 and then granting that identity an appropriate role on storage1 gives both machines authorized access. Public network access is already enabled, so the only missing piece was authorization, and this solution supplies it.

Why the other options are wrong

  • B. The solution does work. A user-assigned identity can be shared across virtual machines and granted a role on the storage account, which is a supported and common pattern.

Question 21

You have an Azure subscription named Sub1 that contains multiple virtual machines.

You have a Microsoft 365 E5 subscription that contains devices onboarded to Microsoft Defender for Endpoint.

You have an on-premises datacenter that contains multiple servers.

You plan to onboard all existing and future on-premises servers to Azure Arc.

You need to ensure that the Azure Arc-enabled servers are protected by using the same security features as the Microsoft 365 devices immediately after the servers are onboarded. The solution must minimize administrative effort.

What should you do?

  1. Onboard each server to Microsoft Defender for Endpoint by using Group Policy.
  2. Onboard each server to Microsoft Defender for Endpoint by using a local installation script.
  3. For Sub1, enable the Microsoft Defender for Servers plan in Microsoft Defender for Cloud.
  4. Configure an Azure Policy assignment.
Show answer and explanation

Correct answer: C. For Sub1, enable the Microsoft Defender for Servers plan in Microsoft Defender for Cloud.

Enabling the Defender for Servers plan on Sub1 turns on the built-in Defender for Endpoint integration. Any machine that joins the subscription, including servers onboarded through Azure Arc, is provisioned automatically with the Defender for Endpoint sensor as soon as it appears. That gives the on-premises servers the same protection as the Microsoft 365 devices with no per-server work.

Why the other options are wrong

  • A. Group Policy onboarding is a manual, per-server process that has to be repeated as new servers arrive and does not apply to Azure virtual machines.
  • B. A local installation script has to be run on every machine individually, which is the opposite of minimizing administrative effort.
  • D. An Azure Policy assignment can flag or trigger deployments but is unnecessary here, because the Defender for Servers plan already provisions the sensor automatically.

Question 22

Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem.

After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.

You have a Microsoft Sentinel workspace.

You have a multi-tier Security Operations Center (SOC) team.

You need to ensure that all new security incidents are assigned immediately to the Tier 1 analysts group and flagged for triage.

Solution: You create a hunting query.

Does this meet the goal?

  1. Yes
  2. No
Show answer and explanation

Correct answer: B. No

A hunting query is an analyst tool for proactively searching data. It runs when someone chooses to run it, produces results rather than incidents, and has no mechanism to set an owner or a status on an incident. Automatic assignment on incident creation requires an automation rule.

Why the other options are wrong

  • A. The solution does not work. Hunting queries return search results and cannot modify incidents or trigger on their creation.

Question 23

You have Microsoft Security Copilot agents that authenticate by using Microsoft Entra service principals.

You receive a Microsoft Defender alert triggered by the anomalous OAuth authentication of an agent's Microsoft Entra service principal.

You need to assess the impact of the agent identity and identify which resources are affected if the identity is abused for lateral movement. The solution must minimize administrative effort.

What should you do?

  1. From Advanced hunting, create a query against the IdentityLogonEvents table to list all the sign-ins performed by the identity.
  2. From Attack paths, select the identity and view the blast radius.
  3. From AI Observability in Microsoft Purview Data Security Posture Management (DSPM), review the agent activity.
  4. From Microsoft Purview Audit, query the audit logs for all the role assignments granted to the identity.
  5. From Incidents, review incidents related to OAuth events reported by Microsoft Defender for Cloud Apps.
Show answer and explanation

Correct answer: B. From Attack paths, select the identity and view the blast radius.

Attack paths builds a relationship graph across identities and resources, and selecting a compromised principal shows its blast radius: everything reachable if that identity is abused. For a Security Copilot agent service principal this answers the impact question directly, as a prebuilt visual rather than something you have to assemble from raw logs.

Why the other options are wrong

  • A. An advanced hunting query over IdentityLogonEvents lists where the identity has signed in. It shows history, not what the identity could reach next, and it takes manual effort to build.
  • C. AI Observability in Purview DSPM surfaces prompts, responses, and data interactions for AI apps. It does not map lateral movement across resources.
  • D. Auditing role assignments returns a permission list. Translating that into reachable resources is exactly the manual work blast radius removes.
  • E. Reviewing related incidents describes what has already been detected rather than the potential impact of the identity.

Question 24

You have an Azure subscription named Sub1 that contains a storage account named storage1. Sub1 has Microsoft Defender for Storage enabled.

Defender for Storage has malware scanning enabled.

You need to configure a solution that automates the remediation of malware detected in storage1.

What should you include in the solution?

  1. Azure Logic Apps
  2. a Log Analytics workspace
  3. an alert rule
  4. Azure Policy
Show answer and explanation

Correct answer: A. Azure Logic Apps

Defender for Storage publishes malware scan results to Event Grid, and Azure Logic Apps is the workflow engine Microsoft recommends subscribing to those events. The Logic App receives the verdict and performs the remediation, whether that is deleting the blob, moving it to a quarantine container, or revoking access. It is the component that actually acts on the detection.

Why the other options are wrong

  • B. A Log Analytics workspace stores and queries the results. Storage is not remediation.
  • C. An alert rule notifies someone that malware was found. A human still has to act.
  • D. Azure Policy governs resource configuration and cannot delete or quarantine an individual blob.

Question 25

You have a Microsoft Copilot Studio agent.

A Microsoft Power Platform administrator configures external threat detection for the agent by using a Microsoft Entra application.

You need to ensure that real-time protection is enabled during agent runtime.

What should you do in the Microsoft Defender portal?

  1. Configure Microsoft Defender for Cloud Apps session policies.
  2. Connect the Microsoft 365 app connector.
  3. Enable Global Secure Access for Agents.
  4. From Microsoft Sentinel, configure the Microsoft Purview data connector.
Show answer and explanation

Correct answer: B. Connect the Microsoft 365 app connector.

Real-time protection for Copilot Studio agents is delivered through the Defender for Cloud Apps layer, and that layer only sees agent runtime traffic once the Microsoft 365 app connector is connected in the Defender portal. Connecting it completes the path from the Entra application the administrator registered to the runtime enforcement point.

Why the other options are wrong

  • A. Session policies control and monitor user sessions to cloud apps. They are configured after the connector exists and do not themselves enable agent runtime protection.
  • C. Global Secure Access governs network access to resources. It is not the mechanism for inspecting Copilot Studio agent behaviour.
  • D. A Microsoft Purview data connector in Sentinel forwards data for analysis after the fact. It provides visibility, not real-time protection.

25 questions in. Want the rest? The first half of the pack, free by email · The full pack

Question 26

You have an Azure Storage account named storage1 that hosts a blob container used by an internal application.

You plan to enable a third-party workflow system to upload blobs to storage1.

You need to provide time-bound, least-privilege upload access to the third-party system.

Which authorization method should you use?

  1. Configure the workflow system to use a user delegation shared access signature (SAS).
  2. Enable a managed identity for the workflow system and assign a role for storage1.
  3. Enable anonymous public read access for the blob container.
  4. Configure the workflow system to use Shared Key authorization.
Show answer and explanation

Correct answer: A. Configure the workflow system to use a user delegation shared access signature (SAS).

A user delegation SAS is signed with a key obtained from Microsoft Entra ID rather than the account key, carries an explicit expiry, and can be scoped to just the write permission on one container. That gives the third party time-bound, least-privilege upload access, and the token can be revoked by revoking the delegation key.

Why the other options are wrong

  • B. A managed identity is issued to Azure resources. A third-party external system cannot hold one, and the grant would not be time-bound.
  • C. Anonymous public read access exposes the container to the internet and grants read, not upload.
  • D. Shared Key authorization hands over the account key, which never expires and grants full control of the account.

Question 27

Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem.

After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.

You have a Microsoft Sentinel workspace.

You have a multi-tier Security Operations Center (SOC) team.

You need to ensure that all new security incidents are assigned immediately to the Tier 1 analysts group and flagged for triage.

Solution: You create a playbook.

Does this meet the goal?

  1. Yes
  2. No
Show answer and explanation

Correct answer: B. No

A playbook can certainly assign an owner and add a tag, but creating one does not make it run. Something has to invoke it, and for incident creation that trigger is an automation rule. Without the automation rule the playbook sits idle, so the solution as stated does not meet the goal.

Why the other options are wrong

  • A. The solution does not work on its own. Creating the playbook supplies the action but not the trigger that fires it when a new incident arrives.

Question 28

You have an Azure subscription named Sub1 that contains an Azure Kubernetes Service (AKS) cluster named cluster1 and an Azure container registry named ACR1. Sub1 has Microsoft Defender for Containers enabled, and runtime protection is active on cluster1.

The developers at your company deploy pods that have elevated privileges, and the deployments are created in cluster1.

You need to prevent pods with elevated privileges from being accepted by cluster1.

What should you do?

  1. Create an Azure policy for cluster1.
  2. Enable agentless discovery for Kubernetes in Defender for Containers.
  3. Configure runtime threat protection alerts for privileged container activity.
  4. Enable vulnerability assessment for images in ACR1.
Show answer and explanation

Correct answer: A. Create an Azure policy for cluster1.

Blocking a deployment before the cluster accepts it is admission control, and on AKS that is delivered by the Azure Policy add-on, which runs Gatekeeper. Assigning a policy such as the built-in initiative that denies privileged containers makes the API server reject non-compliant pod specifications at creation time, so the elevated-privilege pods never run.

Why the other options are wrong

  • B. Agentless discovery inventories the cluster and its workloads for posture assessment. It reports on what exists rather than blocking anything.
  • C. Runtime threat protection alerts fire after a privileged container is already running. Detection is not prevention.
  • D. Vulnerability assessment scans images in the registry for known CVEs. A privileged pod specification is a configuration problem, not a vulnerable image.

Question 29

You have a hybrid environment that contains the following servers:

50 Azure virtual machines that run Windows Server 2019 20 physical, on-premises servers that run Windows Server 2019 All the servers use a third-party antivirus solution that must remain active during a phased security rollout.

You need to onboard all the servers to Microsoft Defender for Endpoint by using a centralized deployment method. The solution must meet the following requirements:

Endpoint detection and response (EDR) capabilities must be enabled.

Antivirus conflicts must be prevented during onboarding.

What should you do on the servers?

  1. Set the Microsoft Defender for Endpoint service to Disabled.
  2. Disable Microsoft Defender Antivirus real-time protection by using Set-MpPreference.
  3. Configure the ForceDefenderPassiveMode registry value.
  4. Enable EDR in block mode.
Show answer and explanation

Correct answer: C. Configure the ForceDefenderPassiveMode registry value.

Windows Server does not automatically fall back to passive mode when a third-party antivirus is present, unlike the client operating systems. Setting the ForceDefenderPassiveMode registry value puts Microsoft Defender Antivirus into passive mode explicitly, so the third-party product keeps handling real-time protection while Defender for Endpoint still delivers EDR. That satisfies both requirements at once.

Why the other options are wrong

  • A. Disabling the Defender for Endpoint service would remove the EDR capability that is explicitly required.
  • B. Turning off real-time protection with Set-MpPreference disables scanning but leaves Defender Antivirus in active mode, so the conflict with the third-party product remains and the state is not supported for onboarding.
  • D. EDR in block mode is a remediation feature that acts on detections after onboarding. It does not resolve an antivirus conflict and depends on Defender Antivirus already being in passive mode.

Question 30

Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem.

After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.

You have an Azure subscription that contains two virtual machines named VM1 and VM2. Each virtual machine has system-assigned managed identity enabled.

You have an Azure Storage account named storage1. Public access from all networks is enabled for storage1.

You need to ensure that VM1 and VM2 can access storage1.

Solution: You add each virtual machine to a security group, and then add the security group to a role on storage1.

Does this meet the goal?

  1. Yes
  2. No
Show answer and explanation

Correct answer: A. Yes

Managed identities are service principals in Microsoft Entra ID, and service principals can be members of a security group. Placing VM1 and VM2 in a group and assigning the group a role on storage1 gives both machines access through a single assignment, and any virtual machine added to the group later inherits it.

Why the other options are wrong

  • B. The solution does work. Microsoft Entra security groups accept service principals, including the managed identities of virtual machines, so a group-based role assignment reaches both machines.

Question 31

You have an Azure subscription that contains a user named User1 and an Azure Container Registry named ContReg1.

You enable content trust for ContReg1.

You need to ensure that User1 can create trusted images in ContReg1. The solution must use the principle of least privilege.

Which two roles should you assign to User1? Each correct answer presents part of the solution.

NOTE: Each correct selection is worth one point.

  1. AcrQuarantineWriter
  2. Contributor
  3. AcrQuarantineReader
  4. AcrPush
  5. AcrImageSigner
Show answer and explanation

Correct answer: D, E. AcrPush; AcrImageSigner

Creating a trusted image takes two distinct permissions. AcrPush allows the image itself to be pushed to ContReg1. With content trust enabled the image must also be signed, and AcrImageSigner is the role that grants permission to push the trust metadata and sign tags. Neither role alone is sufficient, and together they are the least privileged combination.

Why the other options are wrong

  • A. AcrQuarantineWriter relates to the image quarantine workflow, letting a user change quarantine state. It has nothing to do with signing.
  • B. Contributor would allow the operation but grants broad management rights over the registry, violating least privilege.
  • C. AcrQuarantineReader only allows pulling quarantined images for inspection.

Question 32

You use Microsoft Security Copilot.

Security Copilot contributors currently create custom plugins for their own sessions and manage organization-wide custom plugins.

You need to prevent the contributors from managing the organization-wide custom plugins. The solution must NOT affect the contributors' ability to create custom plugins for their own sessions.

What should you select in the Plugin settings?

  1. Contributors and Owners at the tenant scope
  2. Owners only at the user scope
  3. Contributors and Owners at the user scope
  4. Owners only at the tenant scope
Show answer and explanation

Correct answer: D. Owners only at the tenant scope

The plugin setting controls who may manage plugins at each scope. Setting the tenant scope to Owners only removes the contributors from organization-wide plugin management, while the user scope is left alone so contributors keep creating and managing plugins inside their own sessions. Separating the two scopes is what allows one capability to be removed without the other.

Why the other options are wrong

  • A. Keeping contributors at the tenant scope leaves them able to manage organization-wide plugins, which is exactly what must stop.
  • B. Restricting the user scope to owners takes away the contributors ability to create plugins for their own sessions, which the requirement protects.
  • C. This leaves the user scope open, which is fine, but changes nothing about the tenant scope where the problem is.

Question 33

You have a Microsoft Sentinel workspace.

You need to collect Windows security events from 200 Azure virtual machines that run Windows Server. The solution must meet the following requirements:

Use direct agent-based data collection from each virtual machine.

Use a supported agent for new virtual machine deployments.

Which Microsoft Sentinel connector should you use?

  1. Windows Forwarded Events
  2. Windows Security Events via AMA
  3. Security Events via Legacy Agent
  4. Syslog via AMA
  5. Azure Resource Graph
Show answer and explanation

Correct answer: B. Windows Security Events via AMA

The Windows Security Events via AMA connector installs the Azure Monitor Agent on each virtual machine and streams Windows security events directly into the SecurityEvent table. It satisfies both requirements: collection is agent-based and per machine, and the Azure Monitor Agent is the supported agent for new deployments.

Why the other options are wrong

  • A. Windows Forwarded Events collects from a Windows Event Collector server, so machines forward through a collector instead of reporting directly.
  • C. Security Events via Legacy Agent uses the retired Log Analytics agent, which is not supported for new deployments.
  • D. Syslog via AMA collects from Linux systems and does not handle Windows security events.
  • E. Azure Resource Graph queries resource metadata. It is not a security event source.

Question 34

You have an Azure subscription named Sub1 that contains a storage account named storage1.

Sub1 has Microsoft Defender for Storage enabled. Defender for Storage has on-upload malware scanning enabled for a monthly cap of 10,000 GB per storage account.

You use a Microsoft Sentinel workspace to monitor security events on all Azure resources.

You need to configure storage1 to use a malware scanning cap of 2,000 GB per month.

What should you do?

  1. Enable the Override Defender for Storage subscription-level settings for storage1.
  2. From Microsoft Sentinel, modify the data collection rule (DCR) to restrict log ingestion from storage1.
  3. Modify the malware scanning configuration of Sub1.
  4. From the Microsoft Sentinel workspace, modify the daily cap.
Show answer and explanation

Correct answer: A. Enable the Override Defender for Storage subscription-level settings for storage1.

Malware scanning caps are inherited from the subscription-level Defender for Storage configuration by default. Turning on Override Defender for Storage subscription-level settings for storage1 detaches that one account from the inherited value so its own limit of 2,000 GB per month is saved and is not overwritten the next time the subscription settings apply.

Why the other options are wrong

  • B. A Sentinel data collection rule governs what telemetry is ingested into the workspace. It has no effect on how much data Defender scans for malware.
  • C. Changing the Sub1 configuration would move the cap for every storage account in the subscription, not just storage1.
  • D. The Sentinel daily cap limits log ingestion volume into the workspace and is unrelated to malware scanning quotas.

Question 35

You have multiple Microsoft Security Copilot workspaces.

A user named User1 accesses Security Copilot by using the default workspace.

You create a new workspace named Workspace1 and assign a capacity to Workspace1.

You plan to route Security Copilot agent traffic to Workspace1.

You need to ensure that User1 can use embedded experiences without errors.

What should you do before switching to Workspace1?

  1. Add User1 to Workspace1.
  2. Assign User1 the Security Operator role in Microsoft Entra.
  3. Disassociate the capacity from the default workspace.
  4. Create a new capacity for Workspace1.
Show answer and explanation

Correct answer: A. Add User1 to Workspace1.

Access in Security Copilot is granted per workspace. User1 is a member of the default workspace only, so once agent traffic is routed to Workspace1 the embedded experiences would fail for User1 with an access error. Adding User1 to Workspace1 before the switch keeps those experiences working.

Why the other options are wrong

  • B. A Microsoft Entra directory role does not grant membership of a Security Copilot workspace, which is managed separately.
  • C. Removing capacity from the default workspace breaks the workspace User1 is currently using and still does not add them to Workspace1.
  • D. Workspace1 already has a capacity assigned. Creating another one adds cost without addressing access.

Question 36

You have a Microsoft Entra tenant that contains a user named User1.

You have an Azure Arc-enabled server named SRV1 that runs Windows Server. SRV1 is configured for Microsoft Entra sign-in.

User1 reports that when they use their Microsoft Entra credentials to sign in to SRV1 over RDP, they receive the following message:

“Your account is configured to prevent you from using this device.” You need to ensure that User1 can sign in to SRV1 over RDP. The solution must follow the principle of least privilege.

What should you do?

  1. Assign User1 the Virtual Machine Administrator Login role for SRV1.
  2. Create a Conditional Access policy that requires multifactor authentication (MFA).
  3. Add User to the local Remote Desktop Users group on SRV1.
  4. Assign User1 the Virtual Machine User Login role for SRV1.
Show answer and explanation

Correct answer: D. Assign User1 the Virtual Machine User Login role for SRV1.

Microsoft Entra sign-in to an Arc-enabled server requires an explicit Azure RBAC role on the machine resource, and the message User1 receives is what appears when neither login role is assigned. Virtual Machine User Login grants standard user sign-in over RDP, which is all User1 needs, making it the least privileged of the two login roles.

Why the other options are wrong

  • A. Virtual Machine Administrator Login also permits sign-in but adds local administrator rights, which exceeds what the user requires.
  • B. A Conditional Access policy requiring MFA adds an authentication requirement. It grants no sign-in permission and would not clear this error.
  • C. Adding the user to the local Remote Desktop Users group does not satisfy the Entra sign-in path, which is authorized through Azure RBAC rather than local group membership.

Question 37

You have an Azure Logic Apps Consumption workflow that uses a Request trigger. All supported authentication methods are enabled on the Request trigger.

You need to ensure that the endpoint accepts only OAuth-based requests. The solution must minimize costs.

What should you do?

  1. Use OAuth 2.0 authorization.
  2. Enable Secure Inputs and enable Secure Outputs for the Request trigger.
  3. Disable shared access signature (SAS) authentication for the Request trigger.
  4. Deploy Azure API Management.
Show answer and explanation

Correct answer: C. Disable shared access signature (SAS) authentication for the Request trigger.

Every supported authentication method is currently enabled, which means both shared access signature and OAuth are accepted. OAuth is therefore already available and nothing needs to be turned on. Disabling SAS authentication on the Request trigger removes the other accepted method, leaving OAuth as the only way in, and it costs nothing.

Why the other options are wrong

  • A. OAuth is already enabled because all supported methods are on. Enabling it again does not remove the SAS path into the endpoint.
  • B. Secure Inputs and Secure Outputs hide sensitive values in run history. They do not affect how callers authenticate.
  • D. Azure API Management would let you enforce OAuth in front of the workflow, but it is an additional billed service and the question asks you to minimize costs.

Question 38

You have an Azure subscription.

You plan to map an online infrastructure and perform vulnerability scanning for the following:

• ASNs

• Hostnames

• IP addresses

• SSL certificates

What should you use?

  1. Microsoft Defender for Identity
  2. Microsoft Defender External Attack Surface Management (Defender EASM)
  3. Microsoft Defender for Endpoint
  4. Microsoft Defender for Cloud
Show answer and explanation

Correct answer: B. Microsoft Defender External Attack Surface Management (Defender EASM)

Defender EASM continuously discovers and inventories internet-facing assets, and its asset types are exactly the ones listed: autonomous system numbers, hostnames, IP addresses and blocks, and SSL certificates. It then scans that discovered surface for vulnerabilities and exposures, including assets nobody knew were published.

Why the other options are wrong

  • A. Defender for Identity monitors on-premises Active Directory signals for identity attacks. It has no view of external infrastructure.
  • C. Defender for Endpoint protects managed devices that have its sensor installed. Unknown internet-facing assets are precisely what it cannot see.
  • D. Defender for Cloud assesses resources inside connected cloud subscriptions and accounts. It does not map an external attack surface by ASN or certificate.

Question 39

You have an Azure subscription named Sub1 that contains multiple virtual machines. Sub1 has the Microsoft Defender Cloud Security Posture Management (CSPM) plan enabled.

You discover that Defender for Cloud fails to identify plaintext connection strings and SSH keys stored on the virtual machines.

You need to ensure that secrets can be identified on the virtual machines.

What should you do?

  1. Configure the Defender for Cloud data connector in Microsoft Sentinel.
  2. Enable agentless machine scanning.
  3. Deploy the Azure Monitor Agent to all the virtual machines.
  4. Enable Microsoft Defender for Key Vault.
Show answer and explanation

Correct answer: B. Enable agentless machine scanning.

Secrets scanning, which finds plaintext connection strings, SSH keys, and similar credentials on a machine disk, is delivered by agentless machine scanning in Defender CSPM. It takes a snapshot of the disk and analyses it out of band, so nothing runs on the virtual machine. Until agentless scanning is enabled, Defender for Cloud has no view of the file system and cannot surface those secrets.

Why the other options are wrong

  • A. The Defender for Cloud data connector forwards existing alerts and recommendations into Sentinel. It creates no new scanning capability.
  • C. The Azure Monitor Agent collects logs and performance data. It does not inspect disks for exposed secrets.
  • D. Defender for Key Vault watches access to the vault itself. It cannot see credentials sitting in files on a virtual machine.

Question 40

You use Microsoft Security Copilot.

Users are assigned either the Security Copilot Contributor role or the Security Copilot Owner role.

A contributor enables a custom plugin that is NOT approved, and some Security Copilot features in embedded experiences no longer function.

You need to ensure that plugins affecting all users can only be added by owners.

What should you do in the Plugin settings?

  1. Select Contributors and Owners to configure which users can add custom plugins at the user scope.
  2. Select Contributors and Owners to configure which users can add custom plugins at the workspace scope.
  3. Select Owners only to configure which users can add custom plugins at the workspace scope.
  4. Select Owners only to configure which users can add custom plugins at the user scope.
Show answer and explanation

Correct answer: C. Select Owners only to configure which users can add custom plugins at the workspace scope.

Plugins added at the workspace scope apply to everyone, which is why one contributor breaking a plugin degraded embedded experiences for all users. Setting the workspace scope to Owners only stops contributors adding plugins that affect the whole workspace, while the user scope is untouched so they can still enable plugins in their own sessions.

Why the other options are wrong

  • A. Changing the user scope does not address the problem, which occurred at the workspace scope.
  • B. Leaving contributors permitted at the workspace scope allows the same failure to happen again.
  • D. Locking the user scope to owners removes individual plugin use and still leaves the workspace scope open.

Question 41

You have an Azure subscription that has Microsoft Defender for Cloud enabled.

You have an Amazon Web Services (AWS) account connected to Defender for Cloud that has the Defender Cloud Security Posture Management (CSPM) plan enabled.

You need to identify the potential impact of security incidents that exploit multiple risks reported by Defender CSPM.

What should you use?

  1. regulatory compliance
  2. cloud security explorer
  3. security recommendations
  4. attack path analysis
Show answer and explanation

Correct answer: D. attack path analysis

Attack path analysis is the Defender CSPM capability that chains several individually modest risks into a single exploitable route and ranks the paths by the impact of the assets at the end of them. Because the AWS account is connected with the CSPM plan, its resources are in the same graph, so the analysis covers both clouds.

Why the other options are wrong

  • A. Regulatory compliance scores your environment against control frameworks. It measures conformance, not exploitability.
  • B. Cloud security explorer answers ad hoc questions about the inventory graph. You have to know what to look for, whereas attack path analysis surfaces the routes automatically.
  • C. Security recommendations list individual issues in isolation. The question is specifically about the combined impact of several risks.

Question 42

You have a Microsoft Sentinel workspace named Workspace1.

You have 100 on-premises servers that run Linux and have the Azure Monitor Agent installed.

You need to collect Syslog events from the Linux servers. The solution must meet the following requirements:

Ensure that filtering occurs before data is written to Workspace1.

Reduce ingestion costs by excluding low-value Syslog messages.

What should you include in the solution?

  1. an Advanced Security Information Model (ASIM) parser
  2. a data collection rule (DCR)
  3. an analytics rule
  4. a table-level filter and split transformation
Show answer and explanation

Correct answer: B. a data collection rule (DCR)

A data collection rule defines what the Azure Monitor Agent collects and can carry a transformation that drops records before they are written to the workspace. Filtering low-value Syslog facilities and severities in the DCR means the excluded events are never ingested, so they never incur cost, which is what filtering before the write requires.

Why the other options are wrong

  • A. An ASIM parser normalizes data at query time. The events have already been ingested and billed by then.
  • C. An analytics rule runs detections over data that is already in the workspace.
  • D. Table-level transformations still apply to a stream the DCR has already defined, and the routing and filtering decision for agent-collected Syslog belongs in the data collection rule itself.

Question 43

You create a new Microsoft Sentinel workspace named Workspace1.

Workspace1 ingests Azure Firewall logs that are used only occasionally during investigations.

You need to retain the logs for seven years at the lowest cost. The solution must ensure that investigators can search the retained data when needed.

What should you do?

  1. Archive the logs to an Azure Storage account.
  2. Configure the table in Workspace1 that stores the logs to use the data lake tier.
  3. Configure the table in Workspace1 that stores the logs to use the analytics tier.
  4. Increase the analytics retention period of Workspace1 to seven years.
Show answer and explanation

Correct answer: B. Configure the table in Workspace1 that stores the logs to use the data lake tier.

The data lake tier is built for security data that must be kept for years but is queried only occasionally. It costs substantially less per gigabyte than the analytics tier, and because the data stays in the workspace, investigators can still search it when a case calls for it. That matches occasional-use firewall logs kept for seven years.

Why the other options are wrong

  • A. Exporting to a storage account is cheap but the data leaves the workspace, so investigators can no longer search it from Sentinel without a restore process.
  • C. The analytics tier is the high-cost tier meant for active detection and frequent querying, which is the wrong profile for rarely used logs.
  • D. Extending analytics retention to seven years keeps everything in the most expensive tier and maximizes rather than minimizes cost.

Question 44

You have a Microsoft Sentinel-enabled Log Analytics workspace named Workspace1.

Your company receives JSON security events from a software as a service (SaaS) application.

You plan to create a custom Microsoft Sentinel data connector.

You need to prepare Workspace1 for the incoming JSON data.

What should you do first?

  1. Configure a diagnostic setting for the SaaS application.
  2. Install a built-in Microsoft Sentinel data connector.
  3. Create a custom log table in Workspace1.
  4. Create an analytics rule in Microsoft Sentinel.
Show answer and explanation

Correct answer: C. Create a custom log table in Workspace1.

Ingested data has to land somewhere with a defined schema, so the first step is creating a custom log table in Workspace1 that matches the JSON the SaaS application produces. Until that table exists, there is no destination for the connector to write to and no schema to map the fields onto.

Why the other options are wrong

  • A. Diagnostic settings export telemetry from Azure resources. A third-party SaaS application has no Azure diagnostic settings to configure.
  • B. A built-in connector is exactly what does not exist for this application, which is why a custom one is being created.
  • D. An analytics rule queries data that is already in the workspace. It cannot be written before the table exists.

Question 45

You have an Azure subscription named Sub1 that contains a storage account named storage1.

Sub1 has Microsoft Defender for Storage enabled. Defender for Storage has on-upload malware scanning enabled.

The security team at your company requires that all malicious files be processed automatically by a serverless workflow for quarantine and notification.

You need to ensure that the malware scan results trigger an automated response. The solution must minimize operational effort.

What should you configure?

  1. an Azure Event Grid subscription
  2. diagnostic settings to send logs to a Log Analytics workspace
  3. lifecycle management policies
  4. an Azure Monitor alert rule
Show answer and explanation

Correct answer: A. an Azure Event Grid subscription

Defender for Storage publishes on-upload malware scan results directly to Azure Event Grid. An Event Grid subscription routes those events straight to a serverless target such as a Logic App or Function, which then quarantines the blob and sends the notification. Because the integration is native, there is nothing to poll and no glue code to maintain.

Why the other options are wrong

  • B. Sending logs to Log Analytics makes the results queryable after the fact. It stores data rather than triggering a workflow.
  • C. Lifecycle management policies move or delete blobs on an age-based schedule. They cannot react to a scan verdict.
  • D. An Azure Monitor alert rule runs on a query schedule and adds latency and configuration overhead compared to the native Event Grid events.

Question 46

Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem.

After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.

You have a Microsoft Sentinel workspace.

You have a multi-tier Security Operations Center (SOC) team.

You need to ensure that all new security incidents are assigned immediately to the Tier 1 analysts group and flagged for triage.

Solution: You create an automation rule.

Does this meet the goal?

  1. Yes
  2. No
Show answer and explanation

Correct answer: A. Yes

An automation rule triggers on incident creation and can set the owner and change the severity, status, or tags in a single step, with no Logic App required. Creating one that fires on all new incidents, assigns them to the Tier 1 analysts group, and tags them for triage meets the goal exactly as stated.

Why the other options are wrong

  • B. The solution does work. Automation rules are triggered by incident creation and can assign an owner and apply tags natively.

Question 47

You have an Azure subscription named Sub1 that contains a resource group named RG1.

RG1 contains a virtual network named VNet1 and a storage account named storage1. Several engineers are assigned the Owner role for Sub1.

You need to prevent updates to and deletions from VNet1. The solution must ensure that engineers can continue updating other resources in RG1.

Which lock should you apply?

  1. a Read-only resource lock at the RG1 scope
  2. a Delete resource lock at the RG1 scope
  3. a Read-only resource lock at the VNet1 scope
  4. a Delete resource lock at the VNet1 scope
Show answer and explanation

Correct answer: C. a Read-only resource lock at the VNet1 scope

A Read-only lock blocks both modification and deletion, which covers the requirement to prevent updates and deletions. Applying it at the VNet1 scope confines it to that one resource, so the engineers keep full control of storage1 and anything else in RG1 despite holding the Owner role.

Why the other options are wrong

  • A. A Read-only lock at RG1 would also freeze storage1 and every other resource in the group, blocking work that must continue.
  • B. A Delete lock prevents deletion but still allows updates, so VNet1 could be modified. It is also applied at the wrong scope.
  • D. The scope is right but a Delete lock does not stop updates to VNet1.

Question 48

You have an Azure subscription named Sub1 that contains a storage account named storage1. Sub1 has Microsoft Defender for Storage enabled.

Defender for Storage has malware scanning enabled.

You need to configure a solution that automates the remediation of malware detected in storage1.

What should you include in the solution?

  1. Application Insights
  2. Azure Event Hubs
  3. Azure Event Grid
  4. Azure Policy
Show answer and explanation

Correct answer: C. Azure Event Grid

Defender for Storage malware scanning publishes its scan results as events to Azure Event Grid. Subscribing to that topic lets you trigger a Logic App or Function that deletes, quarantines, or tags the infected blob automatically, which is the pattern Microsoft documents for automated response.

Why the other options are wrong

  • A. Application Insights collects application telemetry and traces. It has no hook into malware scan results.
  • B. Event Hubs is a high-throughput ingestion pipeline for streaming telemetry. Malware scan results are surfaced through Event Grid instead.
  • D. Azure Policy evaluates and enforces resource configuration. It cannot act on the contents of an individual blob.

Question 49

You have an Azure subscription named Sub1. Sub1 contains 20 virtual machines that run Windows Server.

Sub1 has the Microsoft Defender for Cloud Defender Cloud Security Posture Management (CSPM) plan enabled.

You need to ensure that all the virtual machines are scanned automatically for known security flaws and misconfigurations.

What should you use?

  1. attack path analysis
  2. Microsoft cloud security benchmark (MCSB)
  3. cloud security explorer
  4. just-in-time (JIT) VM access
  5. vulnerability assessment on the virtual machines
Show answer and explanation

Correct answer: E. vulnerability assessment on the virtual machines

Scanning machines for known security flaws, missing patches, and misconfigurations is what the vulnerability assessment capability does. Enabled on the virtual machines, it runs automatically against all 20 servers and reports findings as recommendations in Defender for Cloud with no per-machine scheduling.

Why the other options are wrong

  • A. Attack path analysis chains existing findings into exploitable routes. It reasons over discovered risk rather than discovering it.
  • B. The Microsoft cloud security benchmark is a policy standard that evaluates resource configuration against controls. It does not scan inside the operating system for CVEs.
  • C. Cloud security explorer is a query tool for investigating your inventory on demand. It surfaces data that other scanners produced.
  • D. Just-in-time VM access limits when management ports are open. It reduces exposure but performs no scanning.

Question 50

You have an Azure subscription that contains a virtual network named VNet1.

VNet1 contains an Azure VPN gateway named Gateway1 that is configured for Point-to-Site (P2S) connections.

You have a Microsoft 365 E5 subscription.

You need to configure a VPN authentication method for Gateway1. The solution must enforce Conditional Access policies during VPN sign-ins.

Which authentication method should you configure?

  1. a custom IPsec/IKE policy
  2. Microsoft Entra authentication
  3. certificate authentication
  4. forced tunneling
Show answer and explanation

Correct answer: B. Microsoft Entra authentication

Only Microsoft Entra authentication routes the VPN sign-in through Entra ID, which is what allows a Conditional Access policy to be evaluated against it. Certificate and RADIUS methods authenticate outside Entra, so no policy can apply.

Why the other options are wrong

  • A. A custom IPsec/IKE policy configures the cryptographic parameters of the tunnel. It is not an authentication method.
  • C. Certificate authentication validates a client certificate locally at the gateway. Entra ID never sees the sign-in, so Conditional Access cannot be enforced.
  • D. Forced tunneling controls which traffic is sent through the tunnel. It has nothing to do with authentication.

50 questions in. Want the rest? The first half of the pack, free by email · The full pack

Question 51

You have a virtual network named VNet1 that contains a subnet named Subnet1 and a virtual machine named VM1. VM1 uses only dynamic IP addresses from Subnet1.

You have an Azure key vault named KV1.

You enable a firewall on KV1 and allow access to KV1 from only select virtual networks and IP addresses.

VM1 receives 403 errors when it attempts to access KV1.

You need to enable VM1 to access KV1, while maintaining the current restrictions on KV1.

What should you do?

  1. Create a routing rule on Subnet1.
  2. Allow trusted Microsoft services to bypass the firewall on KV1.
  3. Add a Microsoft.KeyVault service endpoint for Subnet1.
  4. Add the current IPv4 address of VM1 to the firewall allowlist of KV1.
Show answer and explanation

Correct answer: C. Add a Microsoft.KeyVault service endpoint for Subnet1.

With the Key Vault firewall set to selected networks, traffic from an Azure virtual network is rejected unless the subnet is added as a virtual network rule, and that rule requires the Microsoft.KeyVault service endpoint on the subnet. Enabling it on Subnet1 lets VM1 reach KV1 by its subnet identity rather than its address, which matters because VM1 uses dynamic IP addresses.

Why the other options are wrong

  • A. A routing rule changes the next hop for traffic. The failure is an authorization decision at the vault firewall, not a routing problem.
  • B. The trusted Microsoft services bypass applies to first-party Azure services such as Azure Backup. A customer virtual machine is not a trusted service.
  • D. Allowlisting the current IPv4 address works only until the dynamic address changes, so access breaks again on the next lease.

Question 52

Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem.

After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.

You have a Microsoft Sentinel workspace.

You have a multi-tier Security Operations Center (SOC) team.

You need to ensure that all new security incidents are assigned immediately to the Tier 1 analysts group and flagged for triage.

Solution: You create an analytics rule.

Does this meet the goal?

  1. Yes
  2. No
Show answer and explanation

Correct answer: B. No

An analytics rule is what detects a condition and generates the incident in the first place. It has no facility to assign an owner or flag an incident for triage after creation. Routing new incidents to a team is the job of an automation rule, so creating an analytics rule does not meet the goal.

Why the other options are wrong

  • A. The solution does not work. Analytics rules produce incidents; they do not assign them to an owner or tag them.

That was 52 of 207.

The full Microsoft SC-500 pack has all 207 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.

Get the full pack

Not ready yet? Get the first 103 free as one PDF by email. Get the Half Pack →