20:00

PDF|

Guide for SC-500: Microsoft Implementing End-to-End Security Controls for Cloud and AI Workloads

Quiz SC-500: Microsoft Implementing End-to-End Security Controls for Cloud and AI Workloads

Free Test
/ 10

Quiz

1/10
Topic 1, Contoso Ltd.
Case Study: Contoso, Ltd.
Company Background
Contoso, Ltd. is a financial analytics company that is modernizing its cloud security architecture in
Microsoft Azure. Contoso uses Azure Kubernetes Service, Azure Functions, Azure SQL Database,
Azure Storage, Microsoft Defender for Cloud, Microsoft Entra Privileged Identity Management, and
Azure Arc to secure production workloads and AI-based services.
Contoso has one Azure subscription named Sub1 that is linked to a Microsoft Entra tenant named
contoso.com.
Existing Azure Environment
Subscription and Resource Groups
Sub1 contains the following resource groups:
Resource Group Purpose
RG-App Hosts production application workloads
RG-Data Hosts storage and database services
RG-Security Hosts monitoring and security resources
RG-AI Hosts AI and agent-related workloads
Compute Resources
Contoso has the following compute resources:
Resource Type Description
AKS1 Azure Kubernetes Service cluster Hosts production containerized applications
ACR1 Azure Container Registry Stores container images used by AKS1
Fa1 Azure Function App Processes production AI transaction events
Fa2 Azure Function App Runs test and diagnostic jobs only
Fa3 Azure Function App Processes production security automation events
Server1 On-premises server Hosts a legacy security processing workload
AKS1 uses a managed identity. A separate user-assigned managed identity named ID1 is used by the
deployment automation process.
Data Resources
Contoso has the following data resources:
Resource Type Description
SQLServer1 Azure SQL logical server Hosts production SQL databases
SQLdb1 Azure SQL Database Stores sensitive application data
storage2 Azure Storage account Stores AI output files and security processing artifacts
Current Security Configuration
Microsoft Defender for Cloud is enabled for Sub1. Defender Cloud Security Posture Management is
also enabled.
Contoso has not yet enabled a Defender workload protection plan for AKS1.
Server1 is not currently connected to Azure. The security team wants Server1 to be visible in Azure
for monitoring, compliance, and security operations.
Users and Administrators
The Microsoft Entra tenant contains the following users:
User Current Role / Responsibility
User1 AI engineering user who requests privileged access when required
Admin1 Security administrator for Sub1 and approved Defender for Cloud delegate
Admin2 General application administrator
Admin3 Privileged Role Administrator for Microsoft Entra roles
Admin4 Helpdesk administrator
Privileged Identity Management Configuration
Contoso uses Microsoft Entra Privileged Identity Management.
The following PIM role settings are configured:
Role Approval Required Eligible Approvers Maximum Active Duration
AI Administrator Yes Admin1 and Admin3 only 1 day
Agent ID Developer Yes Admin1 only 2 days
Admin3 has permission to manage eligible and active assignments for Microsoft Entra roles.
Admin2 is not configured as an approver for the AI Administrator role.
Planned Changes
Contoso plans to implement the following changes:
Configure AKS1 so that it can pull images from ACR1 without granting unnecessary permissions.
Configure ID1 so that the deployment automation process can modify Azure resources required by
the application deployment.
Configure SQLdb1 so that access is controlled by Microsoft Entra authentication and Conditional
Access.
Configure storage2 so that selected blobs can use a separate encryption boundary without changing
encryption for the entire storage account.
Implement the production Function App security changes only for Function Apps that process
production workload data.
Enable the correct Microsoft Defender for Cloud plan to protect applications running on AKS1.
Delegate the Defender for Cloud planned change to the least-privileged administrator.
Configure Server1 so that it can be monitored and managed through Azure security tooling.
Technical Requirements
Contoso has the following technical requirements:
AKS and Container Registry
AKS1 must pull container images from ACR1.
AKS1 must receive only the minimum role required to pull images.
The managed identity ID1 must be able to perform deployment automation tasks that modify Azure
resources.
Permissions must follow the principle of least privilege.
Azure SQL Database
SQLdb1 must support Microsoft Entra-based authentication.
Access to SQLdb1 must be controlled by Conditional Access.
SQL authentication must not be used for the planned access model.
Azure Storage
storage2 must support granular encryption for selected application data.
The encryption change must not force all data in storage2 to use the same account-level encryption
configuration.
The solution must support future separation of encrypted data by workload.
Azure Functions
Only Function Apps that process production workload data must be included in the implementation.
Fa1 processes production AI transaction events and must be included.
Fa2 is used only for diagnostics and test jobs and must not be included.
Fa3 processes production security automation events and must be included.
Microsoft Defender for Cloud
Applications hosted on AKS1 must be protected by the appropriate Defender for Cloud workload
plan.
The Defender for Cloud planned change must be delegated to the user with the least privilege
required.
Azure Arc and Monitoring
Server1 must be onboarded to Azure.
Security telemetry from Server1 must be collected centrally.
The solution must support security monitoring through Azure-native tooling.
You need to implement the planned change for SQLdb1
Which two actions should you perform? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point
Select the answer
2 correct answers
A.
Create a compliance policy.
B.
Configure Microsoft Entra authentication for SQLServer1.
C.
Create a Conditional Access policy.
D.
Configure federated client identity for SQLdb1.
E.
Configure a user-assigned managed identity for SQLdb1.

Quiz

2/10
Topic 1, Contoso Ltd.
Case Study: Contoso, Ltd.
Company Background
Contoso, Ltd. is a financial analytics company that is modernizing its cloud security architecture in
Microsoft Azure. Contoso uses Azure Kubernetes Service, Azure Functions, Azure SQL Database,
Azure Storage, Microsoft Defender for Cloud, Microsoft Entra Privileged Identity Management, and
Azure Arc to secure production workloads and AI-based services.
Contoso has one Azure subscription named Sub1 that is linked to a Microsoft Entra tenant named
contoso.com.
Existing Azure Environment
Subscription and Resource Groups
Sub1 contains the following resource groups:
Resource Group Purpose
RG-App Hosts production application workloads
RG-Data Hosts storage and database services
RG-Security Hosts monitoring and security resources
RG-AI Hosts AI and agent-related workloads
Compute Resources
Contoso has the following compute resources:
Resource Type Description
AKS1 Azure Kubernetes Service cluster Hosts production containerized applications
ACR1 Azure Container Registry Stores container images used by AKS1
Fa1 Azure Function App Processes production AI transaction events
Fa2 Azure Function App Runs test and diagnostic jobs only
Fa3 Azure Function App Processes production security automation events
Server1 On-premises server Hosts a legacy security processing workload
AKS1 uses a managed identity. A separate user-assigned managed identity named ID1 is used by the
deployment automation process.
Data Resources
Contoso has the following data resources:
Resource Type Description
SQLServer1 Azure SQL logical server Hosts production SQL databases
SQLdb1 Azure SQL Database Stores sensitive application data
storage2 Azure Storage account Stores AI output files and security processing artifacts
Current Security Configuration
Microsoft Defender for Cloud is enabled for Sub1. Defender Cloud Security Posture Management is
also enabled.
Contoso has not yet enabled a Defender workload protection plan for AKS1.
Server1 is not currently connected to Azure. The security team wants Server1 to be visible in Azure
for monitoring, compliance, and security operations.
Users and Administrators
The Microsoft Entra tenant contains the following users:
User Current Role / Responsibility
User1 AI engineering user who requests privileged access when required
Admin1 Security administrator for Sub1 and approved Defender for Cloud delegate
Admin2 General application administrator
Admin3 Privileged Role Administrator for Microsoft Entra roles
Admin4 Helpdesk administrator
Privileged Identity Management Configuration
Contoso uses Microsoft Entra Privileged Identity Management.
The following PIM role settings are configured:
Role Approval Required Eligible Approvers Maximum Active Duration
AI Administrator Yes Admin1 and Admin3 only 1 day
Agent ID Developer Yes Admin1 only 2 days
Admin3 has permission to manage eligible and active assignments for Microsoft Entra roles.
Admin2 is not configured as an approver for the AI Administrator role.
Planned Changes
Contoso plans to implement the following changes:
Configure AKS1 so that it can pull images from ACR1 without granting unnecessary permissions.
Configure ID1 so that the deployment automation process can modify Azure resources required by
the application deployment.
Configure SQLdb1 so that access is controlled by Microsoft Entra authentication and Conditional
Access.
Configure storage2 so that selected blobs can use a separate encryption boundary without changing
encryption for the entire storage account.
Implement the production Function App security changes only for Function Apps that process
production workload data.
Enable the correct Microsoft Defender for Cloud plan to protect applications running on AKS1.
Delegate the Defender for Cloud planned change to the least-privileged administrator.
Configure Server1 so that it can be monitored and managed through Azure security tooling.
Technical Requirements
Contoso has the following technical requirements:
AKS and Container Registry
AKS1 must pull container images from ACR1.
AKS1 must receive only the minimum role required to pull images.
The managed identity ID1 must be able to perform deployment automation tasks that modify Azure
resources.
Permissions must follow the principle of least privilege.
Azure SQL Database
SQLdb1 must support Microsoft Entra-based authentication.
Access to SQLdb1 must be controlled by Conditional Access.
SQL authentication must not be used for the planned access model.
Azure Storage
storage2 must support granular encryption for selected application data.
The encryption change must not force all data in storage2 to use the same account-level encryption
configuration.
The solution must support future separation of encrypted data by workload.
Azure Functions
Only Function Apps that process production workload data must be included in the implementation.
Fa1 processes production AI transaction events and must be included.
Fa2 is used only for diagnostics and test jobs and must not be included.
Fa3 processes production security automation events and must be included.
Microsoft Defender for Cloud
Applications hosted on AKS1 must be protected by the appropriate Defender for Cloud workload
plan.
The Defender for Cloud planned change must be delegated to the user with the least privilege
required.
Azure Arc and Monitoring
Server1 must be onboarded to Azure.
Security telemetry from Server1 must be collected centrally.
The solution must support security monitoring through Azure-native tooling.
You need to configure the AKS1 and ID 1 managed identities to meet the technical requirements. The
solution must follow the principle of least privilege.
Which role should you assign to each identity? To answer, select the appropriate options in the
answer area.
NOTE: Each correct selection is worth one point.
Certification Exam SC-500: Microsoft Implementing End-to-End Security Controls for Cloud and AI Workloads Microsoft Microsoft-SC-500 2-617140249
Select the answer
1 correct answer
Certification Exam SC-500: Microsoft Implementing End-to-End Security Controls for Cloud and AI Workloads Microsoft Microsoft-SC-500 1-1285805503

AKS1: AcrPull; ID1: Contributor
AKS1 needs to pull images from Azure Container Registry, so AcrPull is the least-privilege registry role
for the cluster identity. ID1 requires Contributor in the visible answer area because the referenced
technical requirement requires resource changes beyond a read-only or pull-only role. The important
distinction is scope: AKS image retrieval should not receive Contributor, while the separate managed
identity receives the broader role only for its implementation task. This domain is tested through
precise scope control: tenant, subscription, resource, application, and data-plane authorization are
not interchangeable. The correct choice applies the smallest identity or governance control that
enforces the stated requirement. Options that only add users, create registrations, or provide broad
administrator access fail because they do not directly enforce the requested access behavior. The
result is a direct exam-style implementation choice: it changes the required security behavior
without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft
source/topic: SC-500 Study Guide > AKS and managed identities; Microsoft Learn > ACR pull role and
Azure RBAC.
==============================================================

Quiz

3/10
Topic 1, Contoso Ltd.
Case Study: Contoso, Ltd.
Company Background
Contoso, Ltd. is a financial analytics company that is modernizing its cloud security architecture in
Microsoft Azure. Contoso uses Azure Kubernetes Service, Azure Functions, Azure SQL Database,
Azure Storage, Microsoft Defender for Cloud, Microsoft Entra Privileged Identity Management, and
Azure Arc to secure production workloads and AI-based services.
Contoso has one Azure subscription named Sub1 that is linked to a Microsoft Entra tenant named
contoso.com.
Existing Azure Environment
Subscription and Resource Groups
Sub1 contains the following resource groups:
Resource Group Purpose
RG-App Hosts production application workloads
RG-Data Hosts storage and database services
RG-Security Hosts monitoring and security resources
RG-AI Hosts AI and agent-related workloads
Compute Resources
Contoso has the following compute resources:
Resource Type Description
AKS1 Azure Kubernetes Service cluster Hosts production containerized applications
ACR1 Azure Container Registry Stores container images used by AKS1
Fa1 Azure Function App Processes production AI transaction events
Fa2 Azure Function App Runs test and diagnostic jobs only
Fa3 Azure Function App Processes production security automation events
Server1 On-premises server Hosts a legacy security processing workload
AKS1 uses a managed identity. A separate user-assigned managed identity named ID1 is used by the
deployment automation process.
Data Resources
Contoso has the following data resources:
Resource Type Description
SQLServer1 Azure SQL logical server Hosts production SQL databases
SQLdb1 Azure SQL Database Stores sensitive application data
storage2 Azure Storage account Stores AI output files and security processing artifacts
Current Security Configuration
Microsoft Defender for Cloud is enabled for Sub1. Defender Cloud Security Posture Management is
also enabled.
Contoso has not yet enabled a Defender workload protection plan for AKS1.
Server1 is not currently connected to Azure. The security team wants Server1 to be visible in Azure
for monitoring, compliance, and security operations.
Users and Administrators
The Microsoft Entra tenant contains the following users:
User Current Role / Responsibility
User1 AI engineering user who requests privileged access when required
Admin1 Security administrator for Sub1 and approved Defender for Cloud delegate
Admin2 General application administrator
Admin3 Privileged Role Administrator for Microsoft Entra roles
Admin4 Helpdesk administrator
Privileged Identity Management Configuration
Contoso uses Microsoft Entra Privileged Identity Management.
The following PIM role settings are configured:
Role Approval Required Eligible Approvers Maximum Active Duration
AI Administrator Yes Admin1 and Admin3 only 1 day
Agent ID Developer Yes Admin1 only 2 days
Admin3 has permission to manage eligible and active assignments for Microsoft Entra roles.
Admin2 is not configured as an approver for the AI Administrator role.
Planned Changes
Contoso plans to implement the following changes:
Configure AKS1 so that it can pull images from ACR1 without granting unnecessary permissions.
Configure ID1 so that the deployment automation process can modify Azure resources required by
the application deployment.
Configure SQLdb1 so that access is controlled by Microsoft Entra authentication and Conditional
Access.
Configure storage2 so that selected blobs can use a separate encryption boundary without changing
encryption for the entire storage account.
Implement the production Function App security changes only for Function Apps that process
production workload data.
Enable the correct Microsoft Defender for Cloud plan to protect applications running on AKS1.
Delegate the Defender for Cloud planned change to the least-privileged administrator.
Configure Server1 so that it can be monitored and managed through Azure security tooling.
Technical Requirements
Contoso has the following technical requirements:
AKS and Container Registry
AKS1 must pull container images from ACR1.
AKS1 must receive only the minimum role required to pull images.
The managed identity ID1 must be able to perform deployment automation tasks that modify Azure
resources.
Permissions must follow the principle of least privilege.
Azure SQL Database
SQLdb1 must support Microsoft Entra-based authentication.
Access to SQLdb1 must be controlled by Conditional Access.
SQL authentication must not be used for the planned access model.
Azure Storage
storage2 must support granular encryption for selected application data.
The encryption change must not force all data in storage2 to use the same account-level encryption
configuration.
The solution must support future separation of encrypted data by workload.
Azure Functions
Only Function Apps that process production workload data must be included in the implementation.
Fa1 processes production AI transaction events and must be included.
Fa2 is used only for diagnostics and test jobs and must not be included.
Fa3 processes production security automation events and must be included.
Microsoft Defender for Cloud
Applications hosted on AKS1 must be protected by the appropriate Defender for Cloud workload
plan.
The Defender for Cloud planned change must be delegated to the user with the least privilege
required.
Azure Arc and Monitoring
Server1 must be onboarded to Azure.
Security telemetry from Server1 must be collected centrally.
The solution must support security monitoring through Azure-native tooling.
You need to implement the planned change for storage2 The solution must meet the technical
requirements for storage encryption.
What should you do?
Select the answer
1 correct answer
A.
Enable purge protection for storage2.
B.
Create an encryption scope in storage2.
C.
Configure storage2 to use an account encryption key.
D.
Assign an Azure role-based access control (Azure RBAC) role to storage2.

Quiz

4/10
Topic 1, Contoso Ltd.
Case Study: Contoso, Ltd.
Company Background
Contoso, Ltd. is a financial analytics company that is modernizing its cloud security architecture in
Microsoft Azure. Contoso uses Azure Kubernetes Service, Azure Functions, Azure SQL Database,
Azure Storage, Microsoft Defender for Cloud, Microsoft Entra Privileged Identity Management, and
Azure Arc to secure production workloads and AI-based services.
Contoso has one Azure subscription named Sub1 that is linked to a Microsoft Entra tenant named
contoso.com.
Existing Azure Environment
Subscription and Resource Groups
Sub1 contains the following resource groups:
Resource Group Purpose
RG-App Hosts production application workloads
RG-Data Hosts storage and database services
RG-Security Hosts monitoring and security resources
RG-AI Hosts AI and agent-related workloads
Compute Resources
Contoso has the following compute resources:
Resource Type Description
AKS1 Azure Kubernetes Service cluster Hosts production containerized applications
ACR1 Azure Container Registry Stores container images used by AKS1
Fa1 Azure Function App Processes production AI transaction events
Fa2 Azure Function App Runs test and diagnostic jobs only
Fa3 Azure Function App Processes production security automation events
Server1 On-premises server Hosts a legacy security processing workload
AKS1 uses a managed identity. A separate user-assigned managed identity named ID1 is used by the
deployment automation process.
Data Resources
Contoso has the following data resources:
Resource Type Description
SQLServer1 Azure SQL logical server Hosts production SQL databases
SQLdb1 Azure SQL Database Stores sensitive application data
storage2 Azure Storage account Stores AI output files and security processing artifacts
Current Security Configuration
Microsoft Defender for Cloud is enabled for Sub1. Defender Cloud Security Posture Management is
also enabled.
Contoso has not yet enabled a Defender workload protection plan for AKS1.
Server1 is not currently connected to Azure. The security team wants Server1 to be visible in Azure
for monitoring, compliance, and security operations.
Users and Administrators
The Microsoft Entra tenant contains the following users:
User Current Role / Responsibility
User1 AI engineering user who requests privileged access when required
Admin1 Security administrator for Sub1 and approved Defender for Cloud delegate
Admin2 General application administrator
Admin3 Privileged Role Administrator for Microsoft Entra roles
Admin4 Helpdesk administrator
Privileged Identity Management Configuration
Contoso uses Microsoft Entra Privileged Identity Management.
The following PIM role settings are configured:
Role Approval Required Eligible Approvers Maximum Active Duration
AI Administrator Yes Admin1 and Admin3 only 1 day
Agent ID Developer Yes Admin1 only 2 days
Admin3 has permission to manage eligible and active assignments for Microsoft Entra roles.
Admin2 is not configured as an approver for the AI Administrator role.
Planned Changes
Contoso plans to implement the following changes:
Configure AKS1 so that it can pull images from ACR1 without granting unnecessary permissions.
Configure ID1 so that the deployment automation process can modify Azure resources required by
the application deployment.
Configure SQLdb1 so that access is controlled by Microsoft Entra authentication and Conditional
Access.
Configure storage2 so that selected blobs can use a separate encryption boundary without changing
encryption for the entire storage account.
Implement the production Function App security changes only for Function Apps that process
production workload data.
Enable the correct Microsoft Defender for Cloud plan to protect applications running on AKS1.
Delegate the Defender for Cloud planned change to the least-privileged administrator.
Configure Server1 so that it can be monitored and managed through Azure security tooling.
Technical Requirements
Contoso has the following technical requirements:
AKS and Container Registry
AKS1 must pull container images from ACR1.
AKS1 must receive only the minimum role required to pull images.
The managed identity ID1 must be able to perform deployment automation tasks that modify Azure
resources.
Permissions must follow the principle of least privilege.
Azure SQL Database
SQLdb1 must support Microsoft Entra-based authentication.
Access to SQLdb1 must be controlled by Conditional Access.
SQL authentication must not be used for the planned access model.
Azure Storage
storage2 must support granular encryption for selected application data.
The encryption change must not force all data in storage2 to use the same account-level encryption
configuration.
The solution must support future separation of encrypted data by workload.
Azure Functions
Only Function Apps that process production workload data must be included in the implementation.
Fa1 processes production AI transaction events and must be included.
Fa2 is used only for diagnostics and test jobs and must not be included.
Fa3 processes production security automation events and must be included.
Microsoft Defender for Cloud
Applications hosted on AKS1 must be protected by the appropriate Defender for Cloud workload
plan.
The Defender for Cloud planned change must be delegated to the user with the least privilege
required.
Azure Arc and Monitoring
Server1 must be onboarded to Azure.
Security telemetry from Server1 must be collected centrally.
The solution must support security monitoring through Azure-native tooling.
You need to implement the function apps to meet the technical requirements.
Which apps should you include in the implementation?
Select the answer
1 correct answer
A.
Fa1 and Fa2 only
B.
Fa2 and Fa3 only
C.
Fa1 and Fa3 only
D.
Fa1, Fa2, and Fa3

Quiz

5/10
Topic 1, Contoso Ltd.
Case Study: Contoso, Ltd.
Company Background
Contoso, Ltd. is a financial analytics company that is modernizing its cloud security architecture in
Microsoft Azure. Contoso uses Azure Kubernetes Service, Azure Functions, Azure SQL Database,
Azure Storage, Microsoft Defender for Cloud, Microsoft Entra Privileged Identity Management, and
Azure Arc to secure production workloads and AI-based services.
Contoso has one Azure subscription named Sub1 that is linked to a Microsoft Entra tenant named
contoso.com.
Existing Azure Environment
Subscription and Resource Groups
Sub1 contains the following resource groups:
Resource Group Purpose
RG-App Hosts production application workloads
RG-Data Hosts storage and database services
RG-Security Hosts monitoring and security resources
RG-AI Hosts AI and agent-related workloads
Compute Resources
Contoso has the following compute resources:
Resource Type Description
AKS1 Azure Kubernetes Service cluster Hosts production containerized applications
ACR1 Azure Container Registry Stores container images used by AKS1
Fa1 Azure Function App Processes production AI transaction events
Fa2 Azure Function App Runs test and diagnostic jobs only
Fa3 Azure Function App Processes production security automation events
Server1 On-premises server Hosts a legacy security processing workload
AKS1 uses a managed identity. A separate user-assigned managed identity named ID1 is used by the
deployment automation process.
Data Resources
Contoso has the following data resources:
Resource Type Description
SQLServer1 Azure SQL logical server Hosts production SQL databases
SQLdb1 Azure SQL Database Stores sensitive application data
storage2 Azure Storage account Stores AI output files and security processing artifacts
Current Security Configuration
Microsoft Defender for Cloud is enabled for Sub1. Defender Cloud Security Posture Management is
also enabled.
Contoso has not yet enabled a Defender workload protection plan for AKS1.
Server1 is not currently connected to Azure. The security team wants Server1 to be visible in Azure
for monitoring, compliance, and security operations.
Users and Administrators
The Microsoft Entra tenant contains the following users:
User Current Role / Responsibility
User1 AI engineering user who requests privileged access when required
Admin1 Security administrator for Sub1 and approved Defender for Cloud delegate
Admin2 General application administrator
Admin3 Privileged Role Administrator for Microsoft Entra roles
Admin4 Helpdesk administrator
Privileged Identity Management Configuration
Contoso uses Microsoft Entra Privileged Identity Management.
The following PIM role settings are configured:
Role Approval Required Eligible Approvers Maximum Active Duration
AI Administrator Yes Admin1 and Admin3 only 1 day
Agent ID Developer Yes Admin1 only 2 days
Admin3 has permission to manage eligible and active assignments for Microsoft Entra roles.
Admin2 is not configured as an approver for the AI Administrator role.
Planned Changes
Contoso plans to implement the following changes:
Configure AKS1 so that it can pull images from ACR1 without granting unnecessary permissions.
Configure ID1 so that the deployment automation process can modify Azure resources required by
the application deployment.
Configure SQLdb1 so that access is controlled by Microsoft Entra authentication and Conditional
Access.
Configure storage2 so that selected blobs can use a separate encryption boundary without changing
encryption for the entire storage account.
Implement the production Function App security changes only for Function Apps that process
production workload data.
Enable the correct Microsoft Defender for Cloud plan to protect applications running on AKS1.
Delegate the Defender for Cloud planned change to the least-privileged administrator.
Configure Server1 so that it can be monitored and managed through Azure security tooling.
Technical Requirements
Contoso has the following technical requirements:
AKS and Container Registry
AKS1 must pull container images from ACR1.
AKS1 must receive only the minimum role required to pull images.
The managed identity ID1 must be able to perform deployment automation tasks that modify Azure
resources.
Permissions must follow the principle of least privilege.
Azure SQL Database
SQLdb1 must support Microsoft Entra-based authentication.
Access to SQLdb1 must be controlled by Conditional Access.
SQL authentication must not be used for the planned access model.
Azure Storage
storage2 must support granular encryption for selected application data.
The encryption change must not force all data in storage2 to use the same account-level encryption
configuration.
The solution must support future separation of encrypted data by workload.
Azure Functions
Only Function Apps that process production workload data must be included in the implementation.
Fa1 processes production AI transaction events and must be included.
Fa2 is used only for diagnostics and test jobs and must not be included.
Fa3 processes production security automation events and must be included.
Microsoft Defender for Cloud
Applications hosted on AKS1 must be protected by the appropriate Defender for Cloud workload
plan.
The Defender for Cloud planned change must be delegated to the user with the least privilege
required.
Azure Arc and Monitoring
Server1 must be onboarded to Azure.
Security telemetry from Server1 must be collected centrally.
The solution must support security monitoring through Azure-native tooling.
You need to delegate a user to implement the planned change for Defender for Cloud. The solution
must follow the principle of least privilege.
Which user should you choose?
Select the answer
1 correct answer
A.
Admin1
B.
Admin2
C.
Admin3
D.
Admin4

Quiz

6/10
Topic 1, Contoso Ltd.
Case Study: Contoso, Ltd.
Company Background
Contoso, Ltd. is a financial analytics company that is modernizing its cloud security architecture in
Microsoft Azure. Contoso uses Azure Kubernetes Service, Azure Functions, Azure SQL Database,
Azure Storage, Microsoft Defender for Cloud, Microsoft Entra Privileged Identity Management, and
Azure Arc to secure production workloads and AI-based services.
Contoso has one Azure subscription named Sub1 that is linked to a Microsoft Entra tenant named
contoso.com.
Existing Azure Environment
Subscription and Resource Groups
Sub1 contains the following resource groups:
Resource Group Purpose
RG-App Hosts production application workloads
RG-Data Hosts storage and database services
RG-Security Hosts monitoring and security resources
RG-AI Hosts AI and agent-related workloads
Compute Resources
Contoso has the following compute resources:
Resource Type Description
AKS1 Azure Kubernetes Service cluster Hosts production containerized applications
ACR1 Azure Container Registry Stores container images used by AKS1
Fa1 Azure Function App Processes production AI transaction events
Fa2 Azure Function App Runs test and diagnostic jobs only
Fa3 Azure Function App Processes production security automation events
Server1 On-premises server Hosts a legacy security processing workload
AKS1 uses a managed identity. A separate user-assigned managed identity named ID1 is used by the
deployment automation process.
Data Resources
Contoso has the following data resources:
Resource Type Description
SQLServer1 Azure SQL logical server Hosts production SQL databases
SQLdb1 Azure SQL Database Stores sensitive application data
storage2 Azure Storage account Stores AI output files and security processing artifacts
Current Security Configuration
Microsoft Defender for Cloud is enabled for Sub1. Defender Cloud Security Posture Management is
also enabled.
Contoso has not yet enabled a Defender workload protection plan for AKS1.
Server1 is not currently connected to Azure. The security team wants Server1 to be visible in Azure
for monitoring, compliance, and security operations.
Users and Administrators
The Microsoft Entra tenant contains the following users:
User Current Role / Responsibility
User1 AI engineering user who requests privileged access when required
Admin1 Security administrator for Sub1 and approved Defender for Cloud delegate
Admin2 General application administrator
Admin3 Privileged Role Administrator for Microsoft Entra roles
Admin4 Helpdesk administrator
Privileged Identity Management Configuration
Contoso uses Microsoft Entra Privileged Identity Management.
The following PIM role settings are configured:
Role Approval Required Eligible Approvers Maximum Active Duration
AI Administrator Yes Admin1 and Admin3 only 1 day
Agent ID Developer Yes Admin1 only 2 days
Admin3 has permission to manage eligible and active assignments for Microsoft Entra roles.
Admin2 is not configured as an approver for the AI Administrator role.
Planned Changes
Contoso plans to implement the following changes:
Configure AKS1 so that it can pull images from ACR1 without granting unnecessary permissions.
Configure ID1 so that the deployment automation process can modify Azure resources required by
the application deployment.
Configure SQLdb1 so that access is controlled by Microsoft Entra authentication and Conditional
Access.
Configure storage2 so that selected blobs can use a separate encryption boundary without changing
encryption for the entire storage account.
Implement the production Function App security changes only for Function Apps that process
production workload data.
Enable the correct Microsoft Defender for Cloud plan to protect applications running on AKS1.
Delegate the Defender for Cloud planned change to the least-privileged administrator.
Configure Server1 so that it can be monitored and managed through Azure security tooling.
Technical Requirements
Contoso has the following technical requirements:
AKS and Container Registry
AKS1 must pull container images from ACR1.
AKS1 must receive only the minimum role required to pull images.
The managed identity ID1 must be able to perform deployment automation tasks that modify Azure
resources.
Permissions must follow the principle of least privilege.
Azure SQL Database
SQLdb1 must support Microsoft Entra-based authentication.
Access to SQLdb1 must be controlled by Conditional Access.
SQL authentication must not be used for the planned access model.
Azure Storage
storage2 must support granular encryption for selected application data.
The encryption change must not force all data in storage2 to use the same account-level encryption
configuration.
The solution must support future separation of encrypted data by workload.
Azure Functions
Only Function Apps that process production workload data must be included in the implementation.
Fa1 processes production AI transaction events and must be included.
Fa2 is used only for diagnostics and test jobs and must not be included.
Fa3 processes production security automation events and must be included.
Microsoft Defender for Cloud
Applications hosted on AKS1 must be protected by the appropriate Defender for Cloud workload
plan.
The Defender for Cloud planned change must be delegated to the user with the least privilege
required.
Azure Arc and Monitoring
Server1 must be onboarded to Azure.
Security telemetry from Server1 must be collected centrally.
The solution must support security monitoring through Azure-native tooling.
You need to protect the applications hosted on AKS1. The solution must meet the technical
requirements.
Which Defender for Cloud plan should you enable?
Select the answer
1 correct answer
A.
Microsoft Defender for Servers
B.
Microsoft Defender for App Service
C.
Microsoft Defender for Containers
D.
Microsoft Defender for Resource Manager
E.
Microsoft Defender for Storage

Quiz

7/10
Topic 1, Contoso Ltd.
Case Study: Contoso, Ltd.
Company Background
Contoso, Ltd. is a financial analytics company that is modernizing its cloud security architecture in
Microsoft Azure. Contoso uses Azure Kubernetes Service, Azure Functions, Azure SQL Database,
Azure Storage, Microsoft Defender for Cloud, Microsoft Entra Privileged Identity Management, and
Azure Arc to secure production workloads and AI-based services.
Contoso has one Azure subscription named Sub1 that is linked to a Microsoft Entra tenant named
contoso.com.
Existing Azure Environment
Subscription and Resource Groups
Sub1 contains the following resource groups:
Resource Group Purpose
RG-App Hosts production application workloads
RG-Data Hosts storage and database services
RG-Security Hosts monitoring and security resources
RG-AI Hosts AI and agent-related workloads
Compute Resources
Contoso has the following compute resources:
Resource Type Description
AKS1 Azure Kubernetes Service cluster Hosts production containerized applications
ACR1 Azure Container Registry Stores container images used by AKS1
Fa1 Azure Function App Processes production AI transaction events
Fa2 Azure Function App Runs test and diagnostic jobs only
Fa3 Azure Function App Processes production security automation events
Server1 On-premises server Hosts a legacy security processing workload
AKS1 uses a managed identity. A separate user-assigned managed identity named ID1 is used by the
deployment automation process.
Data Resources
Contoso has the following data resources:
Resource Type Description
SQLServer1 Azure SQL logical server Hosts production SQL databases
SQLdb1 Azure SQL Database Stores sensitive application data
storage2 Azure Storage account Stores AI output files and security processing artifacts
Current Security Configuration
Microsoft Defender for Cloud is enabled for Sub1. Defender Cloud Security Posture Management is
also enabled.
Contoso has not yet enabled a Defender workload protection plan for AKS1.
Server1 is not currently connected to Azure. The security team wants Server1 to be visible in Azure
for monitoring, compliance, and security operations.
Users and Administrators
The Microsoft Entra tenant contains the following users:
User Current Role / Responsibility
User1 AI engineering user who requests privileged access when required
Admin1 Security administrator for Sub1 and approved Defender for Cloud delegate
Admin2 General application administrator
Admin3 Privileged Role Administrator for Microsoft Entra roles
Admin4 Helpdesk administrator
Privileged Identity Management Configuration
Contoso uses Microsoft Entra Privileged Identity Management.
The following PIM role settings are configured:
Role Approval Required Eligible Approvers Maximum Active Duration
AI Administrator Yes Admin1 and Admin3 only 1 day
Agent ID Developer Yes Admin1 only 2 days
Admin3 has permission to manage eligible and active assignments for Microsoft Entra roles.
Admin2 is not configured as an approver for the AI Administrator role.
Planned Changes
Contoso plans to implement the following changes:
Configure AKS1 so that it can pull images from ACR1 without granting unnecessary permissions.
Configure ID1 so that the deployment automation process can modify Azure resources required by
the application deployment.
Configure SQLdb1 so that access is controlled by Microsoft Entra authentication and Conditional
Access.
Configure storage2 so that selected blobs can use a separate encryption boundary without changing
encryption for the entire storage account.
Implement the production Function App security changes only for Function Apps that process
production workload data.
Enable the correct Microsoft Defender for Cloud plan to protect applications running on AKS1.
Delegate the Defender for Cloud planned change to the least-privileged administrator.
Configure Server1 so that it can be monitored and managed through Azure security tooling.
Technical Requirements
Contoso has the following technical requirements:
AKS and Container Registry
AKS1 must pull container images from ACR1.
AKS1 must receive only the minimum role required to pull images.
The managed identity ID1 must be able to perform deployment automation tasks that modify Azure
resources.
Permissions must follow the principle of least privilege.
Azure SQL Database
SQLdb1 must support Microsoft Entra-based authentication.
Access to SQLdb1 must be controlled by Conditional Access.
SQL authentication must not be used for the planned access model.
Azure Storage
storage2 must support granular encryption for selected application data.
The encryption change must not force all data in storage2 to use the same account-level encryption
configuration.
The solution must support future separation of encrypted data by workload.
Azure Functions
Only Function Apps that process production workload data must be included in the implementation.
Fa1 processes production AI transaction events and must be included.
Fa2 is used only for diagnostics and test jobs and must not be included.
Fa3 processes production security automation events and must be included.
Microsoft Defender for Cloud
Applications hosted on AKS1 must be protected by the appropriate Defender for Cloud workload
plan.
The Defender for Cloud planned change must be delegated to the user with the least privilege
required.
Azure Arc and Monitoring
Server1 must be onboarded to Azure.
Security telemetry from Server1 must be collected centrally.
The solution must support security monitoring through Azure-native tooling.
User1 has requested to use the AI Administrator role.
Which approvers can approve the request, and how long will User1 be an AI administrator after the
role is approved? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Certification Exam SC-500: Microsoft Implementing End-to-End Security Controls for Cloud and AI Workloads Microsoft Microsoft-SC-500 3-646095548
Select the answer
1 correct answer
Eligible approvers: Admin1 and Admin3 only; Maximum active duration of the role: 1 day

Certification Exam SC-500: Microsoft Implementing End-to-End Security Controls for Cloud and AI Workloads Microsoft Microsoft-SC-500 4-563061173

The answer area indicates that Admin1 and Admin3 are the eligible approvers and that the active AI
Administrator role duration is one day. This is consistent with PIM role settings: approvers are
explicitly configured for a role activation policy, and maximum active duration controls how long the
activated role remains available. Other administrators who are not configured as approvers cannot
approve the request merely because they hold unrelated roles. This domain is tested through precise
scope control: tenant, subscription, resource, application, and data-plane authorization are not
interchangeable. The correct choice applies the smallest identity or governance control that enforces
the stated requirement. Options that only add users, create registrations, or provide broad
administrator access fail because they do not directly enforce the requested access behavior. The
result is a direct exam-style implementation choice: it changes the required security behavior
without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft
source/topic: SC-500 Study Guide > PIM activation approval and duration; Microsoft Learn > role
settings in PIM.
==============================================================

Quiz

8/10
Topic 1, Contoso Ltd.
Case Study: Contoso, Ltd.
Company Background
Contoso, Ltd. is a financial analytics company that is modernizing its cloud security architecture in
Microsoft Azure. Contoso uses Azure Kubernetes Service, Azure Functions, Azure SQL Database,
Azure Storage, Microsoft Defender for Cloud, Microsoft Entra Privileged Identity Management, and
Azure Arc to secure production workloads and AI-based services.
Contoso has one Azure subscription named Sub1 that is linked to a Microsoft Entra tenant named
contoso.com.
Existing Azure Environment
Subscription and Resource Groups
Sub1 contains the following resource groups:
Resource Group Purpose
RG-App Hosts production application workloads
RG-Data Hosts storage and database services
RG-Security Hosts monitoring and security resources
RG-AI Hosts AI and agent-related workloads
Compute Resources
Contoso has the following compute resources:
Resource Type Description
AKS1 Azure Kubernetes Service cluster Hosts production containerized applications
ACR1 Azure Container Registry Stores container images used by AKS1
Fa1 Azure Function App Processes production AI transaction events
Fa2 Azure Function App Runs test and diagnostic jobs only
Fa3 Azure Function App Processes production security automation events
Server1 On-premises server Hosts a legacy security processing workload
AKS1 uses a managed identity. A separate user-assigned managed identity named ID1 is used by the
deployment automation process.
Data Resources
Contoso has the following data resources:
Resource Type Description
SQLServer1 Azure SQL logical server Hosts production SQL databases
SQLdb1 Azure SQL Database Stores sensitive application data
storage2 Azure Storage account Stores AI output files and security processing artifacts
Current Security Configuration
Microsoft Defender for Cloud is enabled for Sub1. Defender Cloud Security Posture Management is
also enabled.
Contoso has not yet enabled a Defender workload protection plan for AKS1.
Server1 is not currently connected to Azure. The security team wants Server1 to be visible in Azure
for monitoring, compliance, and security operations.
Users and Administrators
The Microsoft Entra tenant contains the following users:
User Current Role / Responsibility
User1 AI engineering user who requests privileged access when required
Admin1 Security administrator for Sub1 and approved Defender for Cloud delegate
Admin2 General application administrator
Admin3 Privileged Role Administrator for Microsoft Entra roles
Admin4 Helpdesk administrator
Privileged Identity Management Configuration
Contoso uses Microsoft Entra Privileged Identity Management.
The following PIM role settings are configured:
Role Approval Required Eligible Approvers Maximum Active Duration
AI Administrator Yes Admin1 and Admin3 only 1 day
Agent ID Developer Yes Admin1 only 2 days
Admin3 has permission to manage eligible and active assignments for Microsoft Entra roles.
Admin2 is not configured as an approver for the AI Administrator role.
Planned Changes
Contoso plans to implement the following changes:
Configure AKS1 so that it can pull images from ACR1 without granting unnecessary permissions.
Configure ID1 so that the deployment automation process can modify Azure resources required by
the application deployment.
Configure SQLdb1 so that access is controlled by Microsoft Entra authentication and Conditional
Access.
Configure storage2 so that selected blobs can use a separate encryption boundary without changing
encryption for the entire storage account.
Implement the production Function App security changes only for Function Apps that process
production workload data.
Enable the correct Microsoft Defender for Cloud plan to protect applications running on AKS1.
Delegate the Defender for Cloud planned change to the least-privileged administrator.
Configure Server1 so that it can be monitored and managed through Azure security tooling.
Technical Requirements
Contoso has the following technical requirements:
AKS and Container Registry
AKS1 must pull container images from ACR1.
AKS1 must receive only the minimum role required to pull images.
The managed identity ID1 must be able to perform deployment automation tasks that modify Azure
resources.
Permissions must follow the principle of least privilege.
Azure SQL Database
SQLdb1 must support Microsoft Entra-based authentication.
Access to SQLdb1 must be controlled by Conditional Access.
SQL authentication must not be used for the planned access model.
Azure Storage
storage2 must support granular encryption for selected application data.
The encryption change must not force all data in storage2 to use the same account-level encryption
configuration.
The solution must support future separation of encrypted data by workload.
Azure Functions
Only Function Apps that process production workload data must be included in the implementation.
Fa1 processes production AI transaction events and must be included.
Fa2 is used only for diagnostics and test jobs and must not be included.
Fa3 processes production security automation events and must be included.
Microsoft Defender for Cloud
Applications hosted on AKS1 must be protected by the appropriate Defender for Cloud workload
plan.
The Defender for Cloud planned change must be delegated to the user with the least privilege
required.
Azure Arc and Monitoring
Server1 must be onboarded to Azure.
Security telemetry from Server1 must be collected centrally.
The solution must support security monitoring through Azure-native tooling.
You need to configure Server1 to meet the technical requirements.
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Certification Exam SC-500: Microsoft Implementing End-to-End Security Controls for Cloud and AI Workloads Microsoft Microsoft-SC-500 6-1996291069
Select the answer
1 correct answer
Install on Server1: The Azure Connected Machine agent; Deploy to Sub1: A Log Analytics workspace

Certification Exam SC-500: Microsoft Implementing End-to-End Security Controls for Cloud and AI Workloads Microsoft Microsoft-SC-500 5-2069758618

The Azure Connected Machine agent is required to onboard a non-Azure server as an Azure Arc-
enabled server. Once the server is represented in Azure, telemetry and security data can be directed
to a Log Analytics workspace in the subscription. This combination supports Defender for Cloud and
Sentinel-style monitoring without treating the server as a native Azure VM. Deploying only a
workspace would not onboard Server1; installing only the agent would not provide the analytics
destination. This answer also follows operational scalability. Microsoft security architecture favors
policy-driven deployment, agentless assessment, managed identities, and Defender workload plans
where possible. Those mechanisms reduce manual configuration while keeping enforcement tied to
the resource type, which is why the selected choice is stronger than manual or after-the-fact
alternatives. The result is a direct exam-style implementation choice: it changes the required security
behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official
Microsoft source/topic: SC-500 Study Guide > Azure Arc and Sentinel data collection; Microsoft Learn
> Connected Machine agent and Log Analytics workspace.
==============================================================

Quiz

9/10
Topic 1, Contoso Ltd.
Case Study: Contoso, Ltd.
Company Background
Contoso, Ltd. is a financial analytics company that is modernizing its cloud security architecture in
Microsoft Azure. Contoso uses Azure Kubernetes Service, Azure Functions, Azure SQL Database,
Azure Storage, Microsoft Defender for Cloud, Microsoft Entra Privileged Identity Management, and
Azure Arc to secure production workloads and AI-based services.
Contoso has one Azure subscription named Sub1 that is linked to a Microsoft Entra tenant named
contoso.com.
Existing Azure Environment
Subscription and Resource Groups
Sub1 contains the following resource groups:
Resource Group Purpose
RG-App Hosts production application workloads
RG-Data Hosts storage and database services
RG-Security Hosts monitoring and security resources
RG-AI Hosts AI and agent-related workloads
Compute Resources
Contoso has the following compute resources:
Resource Type Description
AKS1 Azure Kubernetes Service cluster Hosts production containerized applications
ACR1 Azure Container Registry Stores container images used by AKS1
Fa1 Azure Function App Processes production AI transaction events
Fa2 Azure Function App Runs test and diagnostic jobs only
Fa3 Azure Function App Processes production security automation events
Server1 On-premises server Hosts a legacy security processing workload
AKS1 uses a managed identity. A separate user-assigned managed identity named ID1 is used by the
deployment automation process.
Data Resources
Contoso has the following data resources:
Resource Type Description
SQLServer1 Azure SQL logical server Hosts production SQL databases
SQLdb1 Azure SQL Database Stores sensitive application data
storage2 Azure Storage account Stores AI output files and security processing artifacts
Current Security Configuration
Microsoft Defender for Cloud is enabled for Sub1. Defender Cloud Security Posture Management is
also enabled.
Contoso has not yet enabled a Defender workload protection plan for AKS1.
Server1 is not currently connected to Azure. The security team wants Server1 to be visible in Azure
for monitoring, compliance, and security operations.
Users and Administrators
The Microsoft Entra tenant contains the following users:
User Current Role / Responsibility
User1 AI engineering user who requests privileged access when required
Admin1 Security administrator for Sub1 and approved Defender for Cloud delegate
Admin2 General application administrator
Admin3 Privileged Role Administrator for Microsoft Entra roles
Admin4 Helpdesk administrator
Privileged Identity Management Configuration
Contoso uses Microsoft Entra Privileged Identity Management.
The following PIM role settings are configured:
Role Approval Required Eligible Approvers Maximum Active Duration
AI Administrator Yes Admin1 and Admin3 only 1 day
Agent ID Developer Yes Admin1 only 2 days
Admin3 has permission to manage eligible and active assignments for Microsoft Entra roles.
Admin2 is not configured as an approver for the AI Administrator role.
Planned Changes
Contoso plans to implement the following changes:
Configure AKS1 so that it can pull images from ACR1 without granting unnecessary permissions.
Configure ID1 so that the deployment automation process can modify Azure resources required by
the application deployment.
Configure SQLdb1 so that access is controlled by Microsoft Entra authentication and Conditional
Access.
Configure storage2 so that selected blobs can use a separate encryption boundary without changing
encryption for the entire storage account.
Implement the production Function App security changes only for Function Apps that process
production workload data.
Enable the correct Microsoft Defender for Cloud plan to protect applications running on AKS1.
Delegate the Defender for Cloud planned change to the least-privileged administrator.
Configure Server1 so that it can be monitored and managed through Azure security tooling.
Technical Requirements
Contoso has the following technical requirements:
AKS and Container Registry
AKS1 must pull container images from ACR1.
AKS1 must receive only the minimum role required to pull images.
The managed identity ID1 must be able to perform deployment automation tasks that modify Azure
resources.
Permissions must follow the principle of least privilege.
Azure SQL Database
SQLdb1 must support Microsoft Entra-based authentication.
Access to SQLdb1 must be controlled by Conditional Access.
SQL authentication must not be used for the planned access model.
Azure Storage
storage2 must support granular encryption for selected application data.
The encryption change must not force all data in storage2 to use the same account-level encryption
configuration.
The solution must support future separation of encrypted data by workload.
Azure Functions
Only Function Apps that process production workload data must be included in the implementation.
Fa1 processes production AI transaction events and must be included.
Fa2 is used only for diagnostics and test jobs and must not be included.
Fa3 processes production security automation events and must be included.
Microsoft Defender for Cloud
Applications hosted on AKS1 must be protected by the appropriate Defender for Cloud workload
plan.
The Defender for Cloud planned change must be delegated to the user with the least privilege
required.
Azure Arc and Monitoring
Server1 must be onboarded to Azure.
Security telemetry from Server1 must be collected centrally.
The solution must support security monitoring through Azure-native tooling.
For each of the following statements, select Yes if the statement is true Otherwise, select No.

Certification Exam SC-500: Microsoft Implementing End-to-End Security Controls for Cloud and AI Workloads Microsoft Microsoft-SC-500 7-1086602063
Select the answer
1 correct answer
Yes; 2) No; 3) Yes

Certification Exam SC-500: Microsoft Implementing End-to-End Security Controls for Cloud and AI Workloads Microsoft Microsoft-SC-500 8-637083047

The visible PIM settings indicate that Admin1 must approve Agent ID Developer activations, Admin2
is not an approver for the AI Administrator role, and Admin3 can assign User1 a two-day active
assignment for Agent ID Developer. The controlling factors are the configured approver list and active
assignment duration policy for each role. PIM evaluates those settings per role, so approval authority
or duration for one role cannot be assumed for another role. For SC-500, the decisive distinction is
whether the control authenticates an identity, grants authorization, or merely changes configuration
visibility. The incorrect choices generally either grant excessive privilege, change the application
model, or operate at the wrong scope. Microsoft expects the least-privilege identity path that
satisfies the scenario without introducing shared secrets or unnecessary tenant-wide rights. The
result is a direct exam-style implementation choice: it changes the required security behavior
without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft
source/topic: SC-500 Study Guide > PIM role settings and Agent ID governance; Microsoft Learn >
approvers and maximum activation duration.
==============================================================

Quiz

10/10
Topic 1, Contoso Ltd.
Case Study: Contoso, Ltd.
Company Background
Contoso, Ltd. is a financial analytics company that is modernizing its cloud security architecture in
Microsoft Azure. Contoso uses Azure Kubernetes Service, Azure Functions, Azure SQL Database,
Azure Storage, Microsoft Defender for Cloud, Microsoft Entra Privileged Identity Management, and
Azure Arc to secure production workloads and AI-based services.
Contoso has one Azure subscription named Sub1 that is linked to a Microsoft Entra tenant named
contoso.com.
Existing Azure Environment
Subscription and Resource Groups
Sub1 contains the following resource groups:
Resource Group Purpose
RG-App Hosts production application workloads
RG-Data Hosts storage and database services
RG-Security Hosts monitoring and security resources
RG-AI Hosts AI and agent-related workloads
Compute Resources
Contoso has the following compute resources:
Resource Type Description
AKS1 Azure Kubernetes Service cluster Hosts production containerized applications
ACR1 Azure Container Registry Stores container images used by AKS1
Fa1 Azure Function App Processes production AI transaction events
Fa2 Azure Function App Runs test and diagnostic jobs only
Fa3 Azure Function App Processes production security automation events
Server1 On-premises server Hosts a legacy security processing workload
AKS1 uses a managed identity. A separate user-assigned managed identity named ID1 is used by the
deployment automation process.
Data Resources
Contoso has the following data resources:
Resource Type Description
SQLServer1 Azure SQL logical server Hosts production SQL databases
SQLdb1 Azure SQL Database Stores sensitive application data
storage2 Azure Storage account Stores AI output files and security processing artifacts
Current Security Configuration
Microsoft Defender for Cloud is enabled for Sub1. Defender Cloud Security Posture Management is
also enabled.
Contoso has not yet enabled a Defender workload protection plan for AKS1.
Server1 is not currently connected to Azure. The security team wants Server1 to be visible in Azure
for monitoring, compliance, and security operations.
Users and Administrators
The Microsoft Entra tenant contains the following users:
User Current Role / Responsibility
User1 AI engineering user who requests privileged access when required
Admin1 Security administrator for Sub1 and approved Defender for Cloud delegate
Admin2 General application administrator
Admin3 Privileged Role Administrator for Microsoft Entra roles
Admin4 Helpdesk administrator
Privileged Identity Management Configuration
Contoso uses Microsoft Entra Privileged Identity Management.
The following PIM role settings are configured:
Role Approval Required Eligible Approvers Maximum Active Duration
AI Administrator Yes Admin1 and Admin3 only 1 day
Agent ID Developer Yes Admin1 only 2 days
Admin3 has permission to manage eligible and active assignments for Microsoft Entra roles.
Admin2 is not configured as an approver for the AI Administrator role.
Planned Changes
Contoso plans to implement the following changes:
Configure AKS1 so that it can pull images from ACR1 without granting unnecessary permissions.
Configure ID1 so that the deployment automation process can modify Azure resources required by
the application deployment.
Configure SQLdb1 so that access is controlled by Microsoft Entra authentication and Conditional
Access.
Configure storage2 so that selected blobs can use a separate encryption boundary without changing
encryption for the entire storage account.
Implement the production Function App security changes only for Function Apps that process
production workload data.
Enable the correct Microsoft Defender for Cloud plan to protect applications running on AKS1.
Delegate the Defender for Cloud planned change to the least-privileged administrator.
Configure Server1 so that it can be monitored and managed through Azure security tooling.
Technical Requirements
Contoso has the following technical requirements:
AKS and Container Registry
AKS1 must pull container images from ACR1.
AKS1 must receive only the minimum role required to pull images.
The managed identity ID1 must be able to perform deployment automation tasks that modify Azure
resources.
Permissions must follow the principle of least privilege.
Azure SQL Database
SQLdb1 must support Microsoft Entra-based authentication.
Access to SQLdb1 must be controlled by Conditional Access.
SQL authentication must not be used for the planned access model.
Azure Storage
storage2 must support granular encryption for selected application data.
The encryption change must not force all data in storage2 to use the same account-level encryption
configuration.
The solution must support future separation of encrypted data by workload.
Azure Functions
Only Function Apps that process production workload data must be included in the implementation.
Fa1 processes production AI transaction events and must be included.
Fa2 is used only for diagnostics and test jobs and must not be included.
Fa3 processes production security automation events and must be included.
Microsoft Defender for Cloud
Applications hosted on AKS1 must be protected by the appropriate Defender for Cloud workload
plan.
The Defender for Cloud planned change must be delegated to the user with the least privilege
required.
Azure Arc and Monitoring
Server1 must be onboarded to Azure.
Security telemetry from Server1 must be collected centrally.
The solution must support security monitoring through Azure-native tooling.
Note. This section contains one or more sets of questions with the same scenario and problem. Each
question presents a unique solution to the problem You must determine whether the solution meets
the stated goals. More than one solution in the set might solve the problem. It is also possible that
none of the solutions in the set solve the problem
After you answer a question in this section, you will NOT be able to return. As a result these
questions do not appear on the Review Screen.
You have a Microsoft Sentinel workspace
You have a multi-tier Security Operations Center (SOC) team.
You need to ensure that all new security incidents are assigned immediately to the Tier 1 analysts
group and flagged for triage.
Solution You create a hunting query.
Does this meet the goal’
Select the answer
1 correct answer
A.
Yes
B.
No
Looking for more questions?Buy now

SC-500: Microsoft Implementing End-to-End Security Controls for Cloud and AI Workloads Practice test unlocks all online simulator questions

Thank you for choosing the free version of the SC-500: Microsoft Implementing End-to-End Security Controls for Cloud and AI Workloads practice test! Further deepen your knowledge on Microsoft Simulator; by unlocking the full version of our SC-500: Microsoft Implementing End-to-End Security Controls for Cloud and AI Workloads Simulator you will be able to take tests with over 68 constantly updated questions and easily pass your exam. 98% of people pass the exam in the first attempt after preparing with our 68 questions.

BUY NOW

What to expect from our SC-500: Microsoft Implementing End-to-End Security Controls for Cloud and AI Workloads practice tests and how to prepare for any exam?

The SC-500: Microsoft Implementing End-to-End Security Controls for Cloud and AI Workloads Simulator Practice Tests are part of the Microsoft Database and are the best way to prepare for any SC-500: Microsoft Implementing End-to-End Security Controls for Cloud and AI Workloads exam. The SC-500: Microsoft Implementing End-to-End Security Controls for Cloud and AI Workloads practice tests consist of 68 questions and are written by experts to help you and prepare you to pass the exam on the first attempt. The SC-500: Microsoft Implementing End-to-End Security Controls for Cloud and AI Workloads database includes questions from previous and other exams, which means you will be able to practice simulating past and future questions. Preparation with SC-500: Microsoft Implementing End-to-End Security Controls for Cloud and AI Workloads Simulator will also give you an idea of the time it will take to complete each section of the SC-500: Microsoft Implementing End-to-End Security Controls for Cloud and AI Workloads practice test . It is important to note that the SC-500: Microsoft Implementing End-to-End Security Controls for Cloud and AI Workloads Simulator does not replace the classic SC-500: Microsoft Implementing End-to-End Security Controls for Cloud and AI Workloads study guides; however, the Simulator provides valuable insights into what to expect and how much work needs to be done to prepare for the SC-500: Microsoft Implementing End-to-End Security Controls for Cloud and AI Workloads exam.

BUY NOW

SC-500: Microsoft Implementing End-to-End Security Controls for Cloud and AI Workloads Practice test therefore represents an excellent tool to prepare for the actual exam together with our Microsoft practice test . Our SC-500: Microsoft Implementing End-to-End Security Controls for Cloud and AI Workloads Simulator will help you assess your level of preparation and understand your strengths and weaknesses. Below you can read all the quizzes you will find in our SC-500: Microsoft Implementing End-to-End Security Controls for Cloud and AI Workloads Simulator and how our unique SC-500: Microsoft Implementing End-to-End Security Controls for Cloud and AI Workloads Database made up of real questions:

Info quiz:

  • Quiz name:SC-500: Microsoft Implementing End-to-End Security Controls for Cloud and AI Workloads
  • Total number of questions:68
  • Number of questions for the test:50
  • Pass score:80%

You can prepare for the SC-500: Microsoft Implementing End-to-End Security Controls for Cloud and AI Workloads exams with our mobile app. It is very easy to use and even works offline in case of network failure, with all the functions you need to study and practice with our SC-500: Microsoft Implementing End-to-End Security Controls for Cloud and AI Workloads Simulator.

Use our Mobile App, available for both Android and iOS devices, with our SC-500: Microsoft Implementing End-to-End Security Controls for Cloud and AI Workloads Simulator . You can use it anywhere and always remember that our mobile app is free and available on all stores.

Our Mobile App contains all SC-500: Microsoft Implementing End-to-End Security Controls for Cloud and AI Workloads practice tests which consist of 68 questions and also provide study material to pass the final SC-500: Microsoft Implementing End-to-End Security Controls for Cloud and AI Workloads exam with guaranteed success. Our SC-500: Microsoft Implementing End-to-End Security Controls for Cloud and AI Workloads database contain hundreds of questions and Microsoft Tests related to SC-500: Microsoft Implementing End-to-End Security Controls for Cloud and AI Workloads Exam. This way you can practice anywhere you want, even offline without the internet.

BUY NOW