Online Access Free SC-500 Exam Questions

You have an Azure subscription named Sub1. Sub1 contains 60 virtual machines that run either Window Server or Linux.
All the Windows Server virtual machines host line-of-business (LOB) applications and all the Linux virtual machines host backend databases.
You need to enable malware protection for the virtual machines.
Which Microsoft Defender for Cloud plan should you enable for each type of virtual machine? To answer, drag the appropriate plans to the correct virtual machine types. Each plan may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.

Correct Answer:

Explanation:
Virtual machine type
Plan
Windows Server
Microsoft Defender for Servers
Linux
Microsoft Defender for Servers
Microsoft Defender for Servers is the correct plan for both the Windows Server and Linux virtual machines because the requirement is to provide malware protection at the virtual-machine operating-system level .
Defender for Servers protects both Windows and Linux VMs and integrates with Microsoft Defender for Endpoint to provide endpoint protection, including antimalware capabilities. Microsoft states that Defender for Servers supports Windows and Linux virtual machines across Azure and other supported environments.
For Linux systems, Defender for Servers deploys the Defender for Endpoint component that includes antimalware functionality. For Windows Server, Defender Antivirus is integrated with Defender for Endpoint and provides malware protection. In addition, Defender for Servers Plan 2 supports agentless malware scanning , which scans VM disks for malicious files without installing an additional scanning agent.
The fact that the Linux machines host databases does not make Microsoft Defender for Databases the correct answer. Defender for Databases protects supported database workloads against database-specific threats; it does not replace VM-level malware protection.
The SC-500 study guide places onboarding and configuring VMs with Defender for Servers under the Secure compute objective.

User1 has requested to use the AI Administrator role.
Which approvers can approve the request, and how long will User1 be an AI administrator after the role is approved? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Correct Answer:

Explanation:
Eligible approvers: Admin1 and Admin3 only; Maximum active duration of the role: 1 day

The answer area indicates that Admin1 and Admin3 are the eligible approvers and that the active AI Administrator role duration is one day. This is consistent with PIM role settings: approvers are explicitly configured for a role activation policy, and maximum active duration controls how long the activated role remains available. Other administrators who are not configured as approvers cannot approve the request merely because they hold unrelated roles. This domain is tested through precise scope control: tenant, subscription, resource, application, and data-plane authorization are not interchangeable. The correct choice applies the smallest identity or governance control that enforces the stated requirement. Options that only add users, create registrations, or provide broad administrator access fail because they do not directly enforce the requested access behavior. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > PIM activation approval and duration; Microsoft Learn > role settings in PIM.

You have a Microsoft Entra tenant that contains a group named Group1.
You plan to target Group1 to use the Microsoft Authenticator authentication method.
You need to ensure that the members in Group1 can use the Authenticator app as their primary authentication method.
What should you do?

• A.Revoke the sessions for the Group1 members.
• B.Enable the Authenticator passwordless authentication method for Group1.
• C.Enable one-time passcodes in Authenticator for Group1.
• D.Enable Authenticator push authentication mode for Group1.

You have an Azure subscription named Sub1 that is linked to a Microsoft Entra tenant named contoso.com.
Sub1 contains a Recovery Services vault named RSVault1 that stores virtual machine backups.
Your company's security team maintains a dedicated Microsoft Entra tenant named security.contoso.com.
You need to ensure that modifying the backup settings of RSVault1 requires approval from an approver in security.contoso.com.
What should you do in contoso.com?

• A.Configure Privileged Identity Management (PIM) activation for the Backup Operator role.
• B.Create a private endpoint for RSVault1 on the virtual network.
• C.Enable Multi-user authorization (MUA) for RSVault1.
• D.Enable immutability for RSVault1 and lock the immutability setting.

You have three on-premises apps named App1, App2, and App3 that are configured in Microsoft Entra Private Access as shown in the following table.

You have the users shown in the following table.

The Global Secure Access client is deployed to all user devices.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.

Correct Answer:

Explanation:
Statement
Answer
User2 can connect to https://10.20.30.40.
No
User3 can connect to https://intranet.corp.contoso.com.
Yes
User1 can connect to https://intranet.corp.contoso.com:8443.
No
Microsoft Entra Private Access applies access at the application-segment level , and an application segment is defined by attributes including the destination FQDN or IP address and the destination port . Users must be assigned to the corresponding enterprise application to access its defined segments. Microsoft specifically documents that Private Access supports precise per-app segmentation using FQDNs, IP addresses, ports, and user/group assignments.
User2 = No. User2 is assigned only to App2, which permits 10.20.30.40 on port 8443 . https://10.20.30.40 without an explicit port uses HTTPS default TCP 443 , so it does not match App2 ' s segment.
User3 = Yes. User3 is assigned to App1, whose wildcard FQDN *.corp.contoso.com on port 443 matches intranet.corp.contoso.com. Microsoft supports wildcard FQDN segments such as *.contoso.com with explicitly configured ports.
User1 = No. Although intranet.corp.contoso.com matches App1 ' s wildcard FQDN, User1 is authorized only for port 443 . Specifying :8443 causes the connection to fall outside App1 ' s configured segment.