SC-500 Free Practice Questions — Page 7

Question 30

You have a Microsoft Sentinel workspace. You need to collect Windows security events from 200 Azure virtual machines that run Windows Server. The solution must meet the following requirements: Use direct agent-based data collection from each virtual machine. Use a supported agent for new virtual machine deployments. Which Microsoft Sentinel connector should you use?

Question 30

You have an Azure virtual network named VNet1 that contains a subnet named Subnet1. You create a storage account named storage1. You need to ensure that access to storage1 can be managed only by a network security group (NSG) linked to Subnet1. What should you use?

Question 31

DRAG DROP You have an Azure subscription named Sub1 that contains a storage account named storage1. storage1 hosts a blob container named container1. Sub1 is linked to a Microsoft Entra tenant that contains a security group named Group1. You need to ensure that Group1 can use the Azure portal to view the blobs in container1. The solution must follow the principle of least privilege. Which roles should you assign to Group1. To answer, drag the appropriate roles to the correct objects. Each role may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point.

Question 31

HOTSPOT You have a Microsoft Entra tenant that contains the users shown in the following table. You use Microsoft Security Copilot. From Microsoft Security Store, User1 attempts to deploy a partner-built agent named Agent1 and reports that the Get agent option is unavailable. You need to identify whether Agent1 can run in Security Copilot successfully. The solution must follow the principle of least privilege. How should you complete the deployment? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Question 32

You have an Azure subscription that contains a virtual network named VNet1. VNet1 contains an Azure VPN gateway named Gateway1 that is configured for Point-to-Site (P2S) connections. You have a Microsoft 365 E5 subscription. You need to configure a VPN authentication method for Gateway1. The solution must enforce Conditional Access policies during VPN sign-ins. Which authentication method should you configure?

Question 32

You have an Azure subscription that contains a resource group named RG1. RG1 contains a Microsoft Security Copilot deployment that is integrated with a Microsoft Sentinel workspace named Workspace1. Analysts use the Security Copilot standalone experience to retrieve incidents by using the Microsoft Sentinel plugin. A user named User1 can sign in to Security Copilot but cannot retrieve incidents from Workspace1. You verify that User1 has only the Security Copilot Contributor role. You need to ensure that User1 can retrieve the incidents. The solution must follow the principle of least privilege and NOT require any configuration changes to Security Copilot. Which role should you assign to User1?

Question 33

You have a virtual network named VNet1 that contains a subnet named Subnet1. Azure App Service is integrated with VNet1. You have an Azure SQL Database logical server named Server1 that contains a database named DB1. Server1 is accessible only by using a public IP address. You need to ensure that Server does NOT use a public IP address and Azure App Service can still access Server1. What should you create?

Question 33

DRAG DROP You have a Microsoft Defender XDR environment. You have a Microsoft Power Platform environment where makers publish custom Microsoft Copilot Studio agents. You need to enable real-time protection so that suspicious tool invocations are blocked before an agent runs actions, and related alerts appear in the Microsoft Defender portal. What should you do? To answer, drag the appropriate actions to the correct services. Each action may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point.

Question 34

HOTSPOT You have a Microsoft Entra tenant that contains the users shown in the following table. You have a location named HQ-Trusted that contains the IP address of the corporate network. The tenant contains a Conditional Access policy named CA1 that has the following settings: • Assignments: o Users or agents: - Include: All users - Exclude: Group1 • Target resources: o Resources (formerly cloud apps): - Include: Office 365 • Conditions: o Client apps: Not configured • Access controls: o Grant: - Require multifactor authentication o Grant: - Require device to be marked as compliant o For multiple controls: - Require all the selected controls The tenant contains a Conditional Access policy named CA2 that has the following settings: • Assignments: o Users or agents: - Include: All users - Exclude: Group2 • Target resources: o Resources (formerly cloud apps): - Include: All resources • Conditions: o Locations: - Configure: Yes - Include: Any network or location - Exclude: HQ-Trusted • Access controls: o Grant: - Block access For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

Question 34

You have a hybrid environment that contains the following servers: 50 Azure virtual machines that run Windows Server 2019 20 physical, on-premises servers that run Windows Server 2019 All the servers use a third-party antivirus solution that must remain active during a phased security rollout. You need to onboard all the servers to Microsoft Defender for Endpoint by using a centralized deployment method. The solution must meet the following requirements: Endpoint detection and response (EDR) capabilities must be enabled. Antivirus conflicts must be prevented during onboarding. What should you do on the servers?