SC-500 Free Practice Questions — Page 3

Question 21

You have a Microsoft Sentinel-enabled Log Analytics workspace named Workspace1. Your company receives JSON security events from a software as a service (SaaS) application. You plan to create a custom Microsoft Sentinel data connector. You need to prepare Workspace1 for the incoming JSON data. What should you do first?

Question 22

DRAG DROP You have a Microsoft Defender External Attack Surface Management (Defender EASM) resource that discovers internet-facing assets for a company named Contoso, Ltd. You need to classify the assets to meet the following requirements: • Third-party infrastructure assets must be tracked separately from assets owned by Contoso. • Assets with unconfirmed ownership must remain outside the owned inventory until ownership is verified. How should you classify the assets? To answer, drag the appropriate asset states to the correct assets. Each state may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point.

Question 23

You create a new Microsoft Sentinel workspace named Workspace1. Workspace1 ingests Azure Firewall logs that are used only occasionally during investigations. You need to retain the logs for seven years at the lowest cost. The solution must ensure that investigators can search the retained data when needed. What should you do?

Question 24

HOTSPOT You need to deploy the Phishing Triage Agent in Microsoft Security Copilot to manage phishing incidents in Microsoft Defender XDR. The solution must meet the following requirements: • Manage the phishing incidents. • Enable the Phishing Triage Agent. • Follow the principle of least privilege. Which roles should you assign? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Question 25

You have a Microsoft Security Copilot workspace named Workspace1 that is used by Security Operations Center (SOC) analysts and security administrators. The SOC analysts use only the Security Copilot standalone experience, and the security administrators access Security Copilot from the Microsoft Defender portal. A new Security Copilot workspace named Workspace2 is created for the security administrators. Workspace2 is assigned a capacity of five security compute units. You need to ensure that Security Copilot usage for the SOC analysts is allocated to Workspace1 and Security Copilot usage for the security administrators is allocated to Workspace2. What should you do?

Question 26

DRAG DROP You use Azure Virtual Network Manager to manage multiple virtual networks organized into two network groups named Production and Development. You need to configure Virtual Network Manager to meet the following requirements: • Allow traffic between all the virtual networks in Production. • Block traffic between Development and Production. What should you use for each requirement? To answer, drag the components to the correct requirements. Each component may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point.

Question 27

You have an Azure subscription that contains a resource group named RG1 and has Microsoft Defender for Cloud enabled. You connect an Amazon Web Services (AWS) account to Defender for Cloud by creating the AWS connector in RG1. You have a Microsoft Entra group named Group1 that contains the user accounts of the security analysts at your company. You need to ensure that the members of Group1 can view multicloud recommendations and security alerts for the connected AWS account. The solution must follow the principle of least privilege. Which role should you assign to Group1 for RG1?

Question 28

HOTSPOT You have three on-premises apps named App1, App2, and App3 that are configured in Microsoft Entra Private Access as shown in the following table. You have the users shown in the following table. The Global Secure Access client is deployed to all user devices. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

Question 29

You have an Azure subscription that contains the resources shown in the following table. VM1 contains an application that accesses storage1. Another application accesses storage1 from a public IP address of xxx.xxx.xx.xx. For storage1, you set Public network access to Enabled from selected virtual networks and IP addresses. You add an IP network rule for xxx.xxx.xx.xx. After the configuration, only connections from xxx.xxx.xx.xx succeed. You need to ensure that both VM1 and xxx.xxx.xx.xx.can access storage1 over the public endpoint, while preventing all other access. What should you do?

Question 30

You have an Azure virtual network named VNet1 that contains a subnet named Subnet1. You create a storage account named storage1. You need to ensure that access to storage1 can be managed only by a network security group (NSG) linked to Subnet1. What should you use?