SC-500 Practice Test

SC-500 Practice Test practice questions, page 8 of 9, with answer review and explanations.

Question 36

You have an Azure Logic Apps Consumption workflow that uses a Request trigger. All supported authentication methods are enabled on the Request trigger. You need to ensure that the endpoint accepts only OAuth-based requests. The solution must minimize costs. What should you do?

  1. Use OAuth 2.0 authorization.
  2. Enable Secure Inputs and enable Secure Outputs for the Request trigger.
  3. Disable shared access signature (SAS) authentication for the Request trigger.
  4. Deploy Azure API Management.

Question 37

You have Microsoft Security Copilot agents that authenticate by using Microsoft Entra service principals. You receive a Microsoft Defender alert triggered by the anomalous OAuth authentication of an agent's Microsoft Entra service principal. You need to assess the impact of the agent identity and identify which resources are affected if the identity is abused for lateral movement. The solution must minimize administrative effort. What should you do?

  1. From Advanced hunting, create a query against the IdentityLogonEvents table to list all the sign-ins performed by the identity.
  2. From Attack paths, select the identity and view the blast radius.
  3. From AI Observability in Microsoft Purview Data Security Posture Management (DSPM), review the agent activity.
  4. From Microsoft Purview Audit, query the audit logs for all the role assignments granted to the identity.
  5. From Incidents, review incidents related to OAuth events reported by Microsoft Defender for Cloud Apps.

Question 38

You have an Azure subscription named Sub1 that contains multiple virtual machines. You have a Microsoft 365 E5 subscription that contains devices onboarded to Microsoft Defender for Endpoint. You have an on-premises datacenter that contains multiple servers. You plan to onboard all existing and future on-premises servers to Azure Arc. You need to ensure that the Azure Arc-enabled servers are protected by using the same security features as the Microsoft 365 devices immediately after the servers are onboarded. The solution must minimize administrative effort. What should you do?

  1. Onboard each server to Microsoft Defender for Endpoint by using Group Policy.
  2. Onboard each server to Microsoft Defender for Endpoint by using a local installation script.
  3. For Sub1, enable the Microsoft Defender for Servers plan in Microsoft Defender for Cloud.
  4. Configure an Azure Policy assignment.

Question 39

You have an Azure subscription that contains a user named User1 and an Azure Container Registry named ContReg1. You enable content trust for ContReg1. You need to ensure that User1 can create trusted images in ContReg1. The solution must use the principle of least privilege. Which two roles should you assign to User1? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

  1. AcrQuarantineWriter
  2. Contributor
  3. AcrQuarantineReader
  4. AcrPush
  5. AcrImageSigner

Question 40

You have a hybrid environment that contains the following servers: 50 Azure virtual machines that run Windows Server 201920 physical, on-premises servers that run Windows Server 2019 All the servers use a third-party antivirus solution that must remain active during a phased security rollout. You need to onboard all the servers to Microsoft Defender for Endpoint by using a centralized deployment method. The solution must meet the following requirements: Endpoint detection and response (EDR) capabilities must be enabled.Antivirus conflicts must be prevented during onboarding. What should you do on the servers?

  1. Set the Microsoft Defender for Endpoint service to Disabled.
  2. Disable Microsoft Defender Antivirus real-time protection by using Set-MpPreference.
  3. Configure the ForceDefenderPassiveMode registry value.
  4. Enable EDR in block mode.