Free Microsoft SC-500 Exam Dumps Questions & Answers

You have an Azure key vault named KV1 that uses rale based access control (RBAC) for data plane authorization.
You have multiple Azure App Service web apps that retrieve a SQL connection string stored as a secret in KV1.
You need to ensure that the web apps can access KV1. the solution must minimize the number of required identities and follow the principle of least privilege.
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Correct Answer:

Explanation:

You need to implement the function apps to meet the technical requirements.
Which apps should you include in the implementation?

• A.  Fa1 and Fa2 only
• B.  Fa1, Fa2, and Fa3
• C.  Fa2 and Fa3 only
• D.  Fa1 and Fa3 only

You plan to deploy Microsoft 365 Copilot
You discover that Copilot can access sensitive information in your Microsoft SharePoint Online libraries. You need to automatically identify which SharePoint Online content has been shared between all internal users- What should you create?

• A.  a SharePoint Advanced Management (SAM) Data access governance report
• B.  a Microsoft Purview Data Security Posture Management (DSPM) remediation action
• C.  a Microsoft Purview data loss prevention IDLP) policy in audit mode for SharePoint Online
• D.  a Conditional Access policy that requires multifactor authentication (MFA) for SharePoint Online

You have an Azure subscription that contains an Azure SQL database named SQL1.
You plan to deploy an Azure app service web app named Appl.
You need to provide App1 with read and write access to SQL1. The solution must meet the following requirements:
* Provide App1 with access to SQL1 without storing a password.
* Use the principle of least privilege.
* Minimize administrative effort.
Which type of account should App1 use to access SQL1, and which database roles should you assign to App1? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Correct Answer:

Explanation:

App1 should use a managed identity . Azure App Service supports system-assigned and user-assigned managed identities that allow applications to obtain Microsoft Entra access tokens without storing passwords, client secrets, or certificates in application configuration. Microsoft specifically recommends managed identities for application access to Azure SQL because they eliminate developer-managed credentials and support passwordless authentication. Microsoft Learn After enabling the identity, create a contained database user in SQL1 that represents App1 ' s managed identity. To satisfy the required permissions while following least privilege, assign that user to db_datareader and db_datawriter . db_datareader permits reading data from user tables and views, while db_datawriter permits adding, modifying, and deleting data. Microsoft documents this role combination for applications requiring normal read/write database access. Microsoft Learn The db_owner role would grant substantially broader permissions, including extensive database administration capabilities, and therefore violates least privilege. A conventional service principal can also authenticate without a user password, but typically requires management of a client secret or certificate unless additional federation is configured. A Microsoft Entra user is inappropriate for an application workload.

You have an Azure subscription named Sub1. Sub1 contains 60 virtual machines that run either Window Server or Linux.
All the Windows Server virtual machines host line-of-business (LOB) applications and all the Linux virtual machines host backend databases.
You need to enable malware protection for the virtual machines.
Which Microsoft Defender for Cloud plan should you enable for each type of virtual machine? To answer, drag the appropriate plans to the correct virtual machine types. Each plan may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.

Correct Answer:

Explanation:
Virtual machine type
Plan
Windows Server
Microsoft Defender for Servers
Linux
Microsoft Defender for Servers
Microsoft Defender for Servers is the correct plan for both the Windows Server and Linux virtual machines because the requirement is to provide malware protection at the virtual-machine operating-system level .
Defender for Servers protects both Windows and Linux VMs and integrates with Microsoft Defender for Endpoint to provide endpoint protection, including antimalware capabilities. Microsoft states that Defender for Servers supports Windows and Linux virtual machines across Azure and other supported environments.
For Linux systems, Defender for Servers deploys the Defender for Endpoint component that includes antimalware functionality. For Windows Server, Defender Antivirus is integrated with Defender for Endpoint and provides malware protection. In addition, Defender for Servers Plan 2 supports agentless malware scanning , which scans VM disks for malicious files without installing an additional scanning agent.
The fact that the Linux machines host databases does not make Microsoft Defender for Databases the correct answer. Defender for Databases protects supported database workloads against database-specific threats; it does not replace VM-level malware protection.
The SC-500 study guide places onboarding and configuring VMs with Defender for Servers under the Secure compute objective.