support@Free-Braindumps.com
Register Login
Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
CrowdStrike
Anthropic
All Vendors
  1. Home
  2. Exams
  3. Microsoft
  4. SC-500

Free SC-500 Exam Braindumps
Implementing End-to-End Security Controls for Cloud and AI Workloads Questions 9–13 (page: 17)

Updated On: 23-Oct-2026
Page 17 of 43
PDF with 207 Questions
View Related Case Study

You have an Azure Storage account named storage1 that hosts a blob container named container1.
You have an Azure Functions app named app1 that uses a managed identity.
You need to configure app1 to read, write, and delete blobs in container1. The solution must follow the principle of least privilege.
What should you do?

  1. Assign the Storage Account Contributor role to the managed identity of app1 at the scope of storage1.
  2. Assign the Storage Blob Delegator role to the managed identity of App1 at the scope of container1.
  3. Assign the Owner role to the managed identity of App1 at the scope of container1.
  4. Assign the Storage Blob Data Contributor role to the managed identity of App1 at the scope of container1.

Answer(s): D

Explanation:

The Storage Blob Data Contributor role grants permissions to read, write, and delete blob data. Assigning it to the managed identity at the scope of container1 limits access to only the required container, satisfying the principle of least privilege.


Reference:

https://learn.microsoft.com/en-us/azure/storage/blobs/assign-azure-role-data-access?tabs=portal https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles



View Related Case Study

Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem.
After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.
You have an Azure subscription that contains two virtual machines named VM1 and VM2. Each virtual machine has system-assigned managed identity enabled.
You have an Azure Storage account named storage1. Public access from all networks is enabled for storage1.
You need to ensure that VM1 and VM2 can access storage1.
Solution: You create a private endpoint on storage1.
Does this meet the goal?

  1. Yes
  2. No

Answer(s): B

Explanation:

A private endpoint provides private network connectivity to storage1, but it does not authorize VM1 or VM2 to access storage data. Because public network access is already enabled, connectivity is already available. The managed identities of the virtual machines must be assigned an appropriate Azure Storage data-access role to meet the access requirement.


Reference:

https://learn.microsoft.com/en-us/azure/storage/common/storage-private-endpoints https://learn.microsoft.com/en-us/azure/private-link/private-endpoint-overview



View Related Case Study

Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem.
After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.
You have an Azure subscription that contains two virtual machines named VM1 and VM2. Each virtual machine has system-assigned managed identity enabled.
You have an Azure Storage account named storage1. Public access from all networks is enabled for storage1.
You need to ensure that VM1 and VM2 can access storage1.
Solution: You create a user-assigned managed identity, assign the identity to each virtual machine, and then add each managed identity to a role on storage1.
Does this meet the goal?

  1. Yes
  2. No

Answer(s): A

Explanation:

A user-assigned managed identity can be associated with both virtual machines and authorized to access storage1 by assigning it the appropriate Azure Storage data-access role. The applications running on VM1 and VM2 can then obtain Microsoft Entra tokens by using the shared managed identity and access the storage account without credentials. Public network access is already enabled, so no additional network configuration is required.


Reference:

https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/overview https://learn.microsoft.com/en-us/azure/storage/blobs/authorize-access-azure-active-directory



View Related Case Study

DRAG DROP (Drag and Drop is not supported)
You have a Bicep file for an Azure Storage account that stores regulated data.
You need to revise the file to meet the following requirements:
-Require HTTPS-only traffic.
-Prevent the storage account key from being exposed in deployment outputs.
How should you complete the Bicep code? To answer, drag the appropriate values to the correct targets. Each value may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
Note: Each correct selection is worth one point.
Select and Place:

  1. See Explanation section for answer.

Answer(s): A

Explanation:



Box 1: supportsHttpsTrafficOnly
Prevents HTTP requests entirely, ensuring data is encrypted in transit.
Box 2: @secure()
The @secure() decorator masks the output value in the Azure deployment history logs and prevents plaintext disclosure.list
Box 3: listKeys
Dynamically accesses the keys securely at runtime instead of hardcoding sensitive secrets in the template.


Reference:

https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/modules



View Related Case Study

HOTSPOT (Drag and Drop is not supported)
You have an Azure subscription that contains a storage account named storage1.
The storage1 account contains an Azure Blob Storage container named blob1 and an Azure Files share named share1.
You plan to enable Microsoft Defender for Storage on storage1.
You need to identify which Defender for Storage features can be used for blob1 and share1.
Which Defender for Storage features can be used? To answer, select the appropriate options in the answer area.
Note: Each correct selection is worth one point.
Hot Area:

  1. See Explanation section for answer.

Answer(s): A

Explanation:




blob1: Activity monitoring, Malware scanning, and Sensitive data discovery share1: Activity monitoring only
For Azure Blob Storage, Microsoft Defender for Storage supports activity monitoring, malware scanning, and sensitive data discovery. Azure Files is covered by Defender for Storage activity monitoring, while the standard Defender for Storage configuration in this scenario does not provide the blob-focused malware scanning and sensitive data discovery capabilities for the file share.


Reference:

https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-storage-introduction https://learn.microsoft.com/en-us/azure/defender-for-cloud/introduction-malware-scanning



  PDF
Viewing page 17 of 43
Viewing questions 81 - 85 out of 207 questions


Post your Comments and Discuss Microsoft SC-500 exam prep with other Community members:

AI Tutor AI Tutor 👋 I’m here to help!