Free Microsoft SC-500 Practice Exam with Questions & Answers | Set: 3

Statement

Selection

Traffic destined for an Azure Storage account is

able to connect to East US 2

FTP connections from 1.2.3.4 to 10.0.0.10/32 are

dropped

The first selection is able to connect to East US 2 because NSG rules are evaluated in ascending priority order—the lower numerical value has higher priority. The StorageEA2Allow outbound rule has priority 104 and permits traffic to the Storage.EastUS2 service tag on destination port 443. The broader DenyStorageAccess rule has priority 105 and denies outbound traffic to the general Storage service tag. Because priority 104 is evaluated first, HTTPS storage traffic to East US 2 is allowed; storage traffic for other regions subsequently matches the priority-105 deny rule. Microsoft confirms that regional service tags such as Storage.EastUS2 restrict the tag to the service ' s IP ranges in that specific region. Microsoft Learn

The FTP connection is dropped. The Contoso_FTP inbound rule permits TCP port 21 from 1.2.3.4/32, but only when the destination is 10.0.0.5/32. The question ' s destination is 10.0.0.10/32, so this custom allow rule does not match. The traffic ultimately reaches the NSG ' s default DenyAllInbound rule and is blocked. Microsoft documents that NSG processing stops on the first matching rule.

A private endpoint is the appropriate mechanism because it exposes the Azure Storage service through a private IP address associated with Subnet1. Private endpoints support Azure virtual network network policies, including network security groups (NSGs). When private-endpoint network policies are enabled for the subnet, NSG rules can be applied to traffic destined for the private endpoint, allowing network access to be controlled through the NSG associated with Subnet1.

This differs materially from a service endpoint. Service endpoints continue to access Azure Storage through its public service endpoint and require service-side virtual network ACL/firewall configuration to restrict which subnets may access the storage account. Microsoft explicitly states that enabling a service endpoint alone is insufficient: the Azure service must also be configured with appropriate virtual-network access controls. Therefore, access would not be governed only by the NSG.

An Azure Private Link service is used to privately publish a customer-owned service, typically behind a load balancer; it is not required to consume Azure Storage privately. A UDR controls routing and does not establish private access to Storage.

For a complete private-access design, the storage account ' s public endpoint should also be restricted or disabled. Microsoft recommends private endpoints when private network access to Azure Storage is required.

Requirement

Component

When Microsoft Sentinel identifies a threat, an incident must be created

Analytics

A ticket must be logged in the service management platform when an incident is created in Microsoft Sentinel

Playbooks

For threat detection and incident creation, configure Analytics. Microsoft Sentinel analytics rules query ingested security data to identify suspicious behaviors and security conditions. When a rule matches the configured detection criteria, it generates alerts, and those alerts can be grouped into incidents for investigation. Microsoft documents analytics rules as the primary mechanism for transforming collected data into actionable security alerts and incidents. Microsoft Learn

For integration with the third-party service management platform, use a playbook. Sentinel playbooks are built on Azure Logic Apps and provide Security Orchestration, Automation, and Response (SOAR). A playbook can be invoked automatically when an incident is created and can call external services through Logic Apps connectors or APIs. Microsoft specifically documents a ticketing integration pattern in which an automation rule detects creation of a Sentinel incident and launches a playbook that creates a corresponding ticket in systems such as ServiceNow. Microsoft Learn

Data connectors only ingest security data, while workbooks provide visualization and reporting rather than threat detection or response automation.

The workload already has a managed identity, so the required control is an Azure Storage data-plane role assignment. Storage account keys are shared secrets and do not identify App1; putting them in Key Vault or rotating them only improves secret handling, not keyless authorization. Disabling shared key access or setting portal defaults is not enough unless the identity has the file-share data role required to read the share. Storage File Data Privileged Reader grants the managed identity Azure Files read access through Microsoft Entra authorization. Microsoft platform security questions usually hinge on where enforcement occurs: at the resource, server, subnet, firewall policy, private endpoint, or subscription level. The selected answer uses the control plane that owns that enforcement point. Other options are rejected when they only log activity, broaden network access, or protect a different service category. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > secure storage access; Microsoft Learn > Azure Files identity-based access and Azure Storage data-plane RBAC.

==============================================================

Statement

Selection

___ can create keys in the key vault.

Only User2

___ can create secrets in the key vault.

Only User3

Comprehensive and Detailed 150 to 250 words of Explanation From [Cloud and AI Security Engineer/Course Guide/topics]:

User2 is the only user who can create keys in KeyVault1. The Key Vault Crypto Officer role permits key-management data-plane operations, including creating and managing keys, and User2’s role is assigned at the vault scope, so it applies to all keys in that vault.

User3 is the only user who can create secrets. The Key Vault Secrets Officer role permits secret-management data-plane operations and is also scoped to the entire vault.

User1 cannot create keys or secrets merely because they are an Owner at subscription scope. Owner grants broad Azure Resource Manager control-plane permissions, including the ability to assign roles, but Key Vault keys and secrets are data-plane resources that require explicit Key Vault data roles.

User4 has Key Vault Administrator, but the assignment scope is only the existing Key1 resource. That permission applies to Key1 and does not extend upward to the vault or sideways to other keys/secrets, so User4 cannot create a new key or a secret at vault scope.

For external threat detection and real-time agent protection to work, Defender must receive app activity through the Microsoft 365 app connector. Session policies in Defender for Cloud Apps govern user sessions, Global Secure Access controls network access, and a Sentinel connector is for log ingestion and investigation. The Microsoft 365 app connector is the required Defender portal-side integration for this runtime protection scenario. For SC-500, compute controls are evaluated by workload type: VM, Arc server, AKS, container registry, container group, Functions, Logic Apps, App Service, and AI agent runtime. The right answer uses the Microsoft control that is native to that workload. Broad Azure roles or unrelated monitoring services would either overgrant access or fail to enforce the required security state. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > AI workload runtime protection; Microsoft Learn > Microsoft 365 app connector and Copilot agent protection.

==============================================================

Code location

Value

Storage account property

supportsHttpsTrafficOnly

Decorator before the output

@secure

Function used to retrieve the storage account key

listKeys

The completed relevant Bicep code is:

properties: {

supportsHttpsTrafficOnly: true

minimumTlsVersion: ' TLS1_2 '

allowBlobPublicAccess: false

}

@secure()

output storageAccountKey string = listKeys(stg.id, ' 2023-01-01 ' ).keys[0].value

The first value is supportsHttpsTrafficOnly. For Microsoft.Storage/storageAccounts, Microsoft defines this Boolean property as controlling whether the storage service accepts HTTPS traffic only. Setting supportsHttpsTrafficOnly: true rejects unencrypted HTTP requests and ensures storage data is transmitted over encrypted HTTPS connections. Microsoft’s Bicep resource examples explicitly use this property for secure StorageV2 deployments. Microsoft Learn

The second value is @secure. Bicep supports the @secure() decorator on string and object outputs. Microsoft states that a secure output is treated as sensitive and its value is not stored in deployment history and is not displayed in Azure portal, Azure CLI, or PowerShell deployment output. This is exactly what is required when an output contains an account key. Microsoft Learn

The final value is listKeys. Storage account access keys are retrieved through the Storage resource provider ' s listKeys operation. Microsoft documents using listKeys() when a deployment needs to obtain a storage-account key dynamically. Microsoft Learn

publicNetworkAccess controls network reachability rather than HTTPS enforcement, while reference retrieves resource properties rather than storage access keys.

Final mapping:

supportsHttpsTrafficOnly → @secure → listKeys

Statement

Answer

From VM1, you can access File1 by using a private IP address.

Yes

From VM2, you can access File1 by using a private IP address.

Yes

From VM2, you can access File2 by using a private IP address.

No

The private endpoint is configured for the blob sub-resource of contoso2024. Azure Storage private endpoints are created for individual storage services. Microsoft documents separate private endpoint targets for blob, file, queue, table, and other supported storage services. Therefore, PE1 provides private connectivity to Blob Storage, which contains File1, but it does not provide a private endpoint for the Azure Files service that contains File2. Microsoft Learn

VM1 → File1 = Yes. VM1 is in VNet1, and VNet1 is peered with VNet2. A private endpoint has an IP address in Subnet21, and private endpoint connectivity can be consumed from connected virtual networks, including peered VNets, provided DNS resolves the storage Blob endpoint to that private IP. Microsoft Learn

VM2 → File1 = Yes. VM2 resides directly in VNet2, where the blob private endpoint exists, so it can reach File1 through the endpoint ' s private IP.

VM2 → File2 = No. File2 resides in an Azure file share, which requires a separate private endpoint targeting the file sub-resource and normally uses the privatelink.file.core.windows.net private DNS zone. The existing blob private endpoint cannot provide private-IP connectivity to Azure Files.

For AKS1, assign the AcrPull role on Registry1. AcrPull provides the permissions required to download container images from an Azure Container Registry without granting permissions to push, modify, or delete images. Microsoft documents that when AKS is integrated with an Azure Container Registry, the appropriate pull-only role is assigned to the AKS identity used for image pulls. This satisfies the explicit requirement that AKS1 must only be able to pull images and follows least privilege. Microsoft Learn

For ID1, assign AcrPush. Microsoft defines AcrPush as the built-in Azure RBAC role for identities that require both push and pull permissions on a non-ABAC-enabled Azure Container Registry. It therefore allows ID1 to upload container images and retrieve existing images from Registry1 without granting broad resource-management capabilities such as Contributor or Owner. Microsoft Learn

Contributor and Owner would grant substantially more Azure management permissions than required. Reader does not provide container image pull/push data-plane permissions.