SC-500 Practice Questions & Answers • ExamPrepare

Question 1

Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem.

After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.

You have an Azure subscription that contains two virtual machines named VM1 and VM2 and a storage account named storage1.

An application runs on VM1 and VM2. The application is being migrated from storage account key authentication to Microsoft Entra authentication.

You review the current configuration and identify the following:

VM1 and VM2 each have a system-assigned managed identity.
Each application instance requests tokens by using only the local system-assigned managed identity.
Network access to storage1 from VM1 and VM2 is allowed.
No Azure RBAC data roles are assigned to the managed identities on storage1.

You need to enable the application on VM1 and VM2 to read and write blob data in storage1 by using Microsoft Entra authentication without changing how the application requests tokens.

Solution: You add the system-assigned managed identities of VM1 and VM2 to a Microsoft Entra security group, and assign the group the Storage Blob Data Contributor role scoped to storage1.

Does this meet the goal?

Yes
No

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 2

Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem.

After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.

You have an Azure subscription that contains two virtual machines named VM1 and VM2 and a storage account named storage1.

An application runs on VM1 and VM2. The application is being migrated from storage account key authentication to Microsoft Entra authentication.

You review the current configuration and identify the following:

VM1 and VM2 each have a system-assigned managed identity.
Each application instance requests tokens by using only the local system-assigned managed identity.
Network access to storage1 from VM1 and VM2 is allowed.
No Azure RBAC data roles are assigned to the managed identities on storage1.

You need to enable the application on VM1 and VM2 to read and write blob data in storage1 by using Microsoft Entra authentication without changing how the application requests tokens.

Solution: You create a private endpoint for the blob service of storage1.

Does this meet the goal?

Yes
No

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 3

Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem.

After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.

You have an Azure subscription that contains two virtual machines named VM1 and VM2 and a storage account named storage1.

An application runs on VM1 and VM2. The application is being migrated from storage account key authentication to Microsoft Entra authentication.

You review the current configuration and identify the following:

VM1 and VM2 each have a system-assigned managed identity.
Each application instance requests tokens by using only the local system-assigned managed identity.
Network access to storage1 from VM1 and VM2 is allowed.
No Azure RBAC data roles are assigned to the managed identities on storage1.

You need to enable the application on VM1 and VM2 to read and write blob data in storage1 by using Microsoft Entra authentication without changing how the application requests tokens.

Solution: You assign the system-assigned managed identities of VM1 and VM2 the Storage Account Contributor role scoped to storage1.

Does this meet the goal?

Yes
No

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 4

You have an Azure subscription that contains the virtual machines shown in the following table.

Name	Connected to
VM1	VNet1/Subnet1
VM2	VNet1/Subnet2

Subnet1 and Subnet2 have an associated network security group (NSG). The NSG has an outbound rule that has the following configurations:

Port: Any
Source: Any
Priority: 100
Action: Deny
Protocol: Any
Destination: Storage

The subscription contains a storage account named storage1.

You create a private endpoint named Private1 that has the following settings:

Resource type: Microsoft.Storage/storageAccounts
Resource: storage1
Target sub-resource: blob
Virtual network: VNet1
Subnet: Subnet1

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

NOTE: Each correct selection is worth one point.

Statements	Yes	No
From VM2, you can create a container in storage1.
From VM1, you can upload data to the blob storage of storage1.
From VM2, you can upload data to the blob storage of storage1.

Question 5

You have an Azure subscription that is linked to a Microsoft Entra tenant and contains the virtual machines shown in the following table.

Name	Connected to	Private IP address	Public IP address
VM1	VNET1/Subnet1	10.1.1.5	20.224.219.170
VM2	VNET1/Subnet2	10.1.2.5	20.224.219.230
VM3	VNET2/Subnet1	10.11.1.5	40.122.155.212

The subnets of the virtual networks have the service endpoints shown in the following table.

Subnet	Service endpoint
VNET1/Subnet1	Microsoft.Storage
VNET1/Subnet2	Microsoft.KeyVault
VNET2/Subnet1	Microsoft.Storage, Microsoft.KeyVault

You create the resources shown in the following table.

Name	Type
storage1	Azure Storage account
Vault1	Azure Key Vault

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

NOTE: Each correct selection is worth one point.

Statements	Yes	No
Connections from VM1 to storage1 always use IP address 10.1.1.5.
Connections from VM2 to Vault1 always use IP address 20.224.219.230.
Authentication from VM3 to the tenant uses either IP address 10.11.1.5 or 40.122.155.212.

Question 6

You have a Microsoft 365 tenant that uses Microsoft Security Copilot and Microsoft Defender XDR.

Access to Microsoft Defender XDR is managed by using Microsoft Entra global roles.

The Phishing Triage Agent is available in Microsoft Defender. The required agent prerequisites and approvals are complete.

Two users will perform the following tasks:

User1 will enable and manage the Phishing Triage Agent settings.
User2 will use Security Copilot in Microsoft Defender XDR to manage phishing incidents identified by the agent.

You need to assign the least-privileged built-in Microsoft Entra role and Security Copilot role combination to each user.

Which roles should you assign to each user? To answer, select the appropriate options in the answer area.