Free Microsoft SC-500 Practice Exam with Questions & Answers | Set: 4

For a partner-built Security Copilot agent that accesses a Microsoft product such as Microsoft Intune , Microsoft requires a Global Administrator in the tenant to approve the permissions requested by the agent . After that approval is granted, users who are Security Copilot owners or contributors can complete the remaining agent configuration. User2 already holds the Global Administrator role, while User1 already has Security Copilot Contributor , so User2 should perform the required approval first.

This also satisfies the principle of least privilege . Assigning User1 the AI Administrator or Agent ID Administrator role would unnecessarily elevate User1 ' s Microsoft Entra privileges. The Agent ID Administrator role, for example, can manage the full lifecycle of agent identities, agent identity blueprints, blueprint principals, and agent users—far broader authority than is necessary merely to finish this Security Copilot agent deployment.

Creating an agent identity or configuring the Intune data source occurs during or after agent setup and does not replace the tenant-level consent requirement. Microsoft specifically distinguishes the initial administrator approval for partner agents requiring Microsoft product permissions from the subsequent configuration steps that Security Copilot contributors can perform.

Therefore, User2 must first approve Agent1 ' s requested permissions , after which User1 can continue the setup.

Defender for Storage can be configured at the subscription level and overridden at the individual storage account level. Because the subscription cap is 10,000 GB but storage1 needs its own 2,000 GB monthly cap, the correct action is to enable the storage-account override and configure the account-specific malware scanning limit. Sentinel ingestion caps and DCR filtering affect logs, not the malware scanning volume cap. For this domain, least privilege means granting only the required data operation or allowing only the required network flow. The correct response avoids shared keys, broad peering, general contributor roles, or log-only controls when the scenario demands prevention, routing, event triggering, or account-specific configuration. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > Defender for Storage configurations; Microsoft Learn > override subscription-level Defender for Storage settings.

==============================================================

Organization-wide custom plugin management is a tenant-scope administrative action. Setting the plugin setting to Owners only at the tenant scope removes that capability from contributors while leaving their user-scope session plugin ability unaffected. Moving ownership to user scope would not govern tenant-wide plugins correctly. Allowing contributors at tenant scope preserves the problem. The selected setting separates personal experimentation from organization-wide plugin governance. For SC-500, the decisive distinction is whether the control authenticates an identity, grants authorization, or merely changes configuration visibility. The incorrect choices generally either grant excessive privilege, change the application model, or operate at the wrong scope. Microsoft expects the least-privilege identity path that satisfies the scenario without introducing shared secrets or unnecessary tenant-wide rights. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > Security Copilot plugins; Microsoft Learn > manage custom plugins and owner/contributor scope.

==============================================================

Multi-user authorization (MUA) is the Azure Backup control designed to require a second, independently controlled authorization before critical Recovery Services vault operations can proceed. MUA uses an Azure Resource Guard as an additional authorization boundary. Microsoft explicitly supports placing the Resource Guard in a different Microsoft Entra tenant from the Recovery Services vault, which provides the highest degree of administrative isolation.

In this design, RSVault1 remains in contoso.com, while the security team can own the Resource Guard in security.contoso.com. When a vault administrator attempts a protected operation, such as modifying protection or changing a backup policy in a way that reduces retention or increases RPO , the user must obtain the required Resource Guard permission. An approver in the security tenant can control that access, including through PIM and the Backup MUA Operator role.

Immutability primarily prevents backup data from being altered or deleted and does not provide cross-tenant approval. PIM on the Backup Operator role alone does not create the Resource Guard authorization boundary. A private endpoint addresses network access only.

The SC-500 study guide explicitly includes configuring security controls for backup protection by using Azure Backup security features .

===============

Assign Virtual Machine User Login to User1. Microsoft Entra authentication for supported Azure Arc-enabled Windows servers uses Azure RBAC to authorize RDP sign-in. Microsoft specifies two relevant roles: Virtual Machine Administrator Login , which provides administrator privileges, and Virtual Machine User Login , which provides standard user privileges. Because the requirement is only for User1 to sign in and explicitly requires least privilege , Virtual Machine User Login is the correct role.

Assigning Virtual Machine Administrator Login would also permit access, but it unnecessarily grants local administrative privileges and therefore violates least privilege. Adding User1 manually to the local Remote Desktop Users group is not the correct authorization model for Microsoft Entra-based Arc sign-in. Microsoft specifically requires the appropriate Azure login role and documents that manual local-group elevation is not the supported mechanism for authorizing Microsoft Entra sign-in.

A Conditional Access policy requiring MFA can impose an additional authentication condition, but it does not provide the underlying authorization required to log on to SRV1.

The SC-500 study guide places extending security controls to hybrid servers by using Azure Arc within the Secure compute domain.

===============

Use Azure Logic Apps to automate remediation actions when Defender for Storage detects malicious content. Microsoft documents an event-driven remediation pattern in which Defender for Storage malware scanning sends scan results through Azure Event Grid , and an Azure Logic App or Azure Function performs an automated response such as quarantining, deleting, moving, or otherwise handling a malicious blob . This enables near-real-time remediation rather than simply recording or reporting the detection.

A Log Analytics workspace is useful for retaining malware scan results for audit, compliance, and investigation, but it does not itself execute remediation actions. An alert rule can generate notifications based on detected conditions, but it is not the primary workflow engine for taking corrective action against infected blobs. Azure Policy can enforce Defender for Storage configuration at scale, such as ensuring malware scanning is enabled across storage accounts, but it does not perform per-detection malware remediation.

Therefore, the solution should include Azure Logic Apps , typically triggered through Event Grid, to implement the required automated response.

This aligns with the SC-500 objective Implement Defender for Storage threat protection configurations under Secure storage, databases, and networking.