support@Free-Braindumps.com
Register Login
Cisco
CompTIA
ISC
EC-Council
EXIN
Fortinet
ITIL
Juniper
Microsoft
VMware
Avaya
SAP
Google
NVIDIA
Salesforce
Amazon
Palo Alto Networks
ISC2
Splunk
ServiceNow
All Vendors
  1. Home
  2. Exams
  3. Microsoft
  4. SC-500

Microsoft SC-500 Exam Prep
Implementing End-to-End Security Controls for Cloud and AI Workloads (Page 6 )

Updated On: 13-Sep-2026
Page 3 of 16
PDF with 121 Questions

You have an Azure SQL Database logical server named Server1 that contains a database named DB1.
You need to configure authentication for Server1 to meet the following requirements:
-SQL authentication cannot be used for any databases on Server1.
-The solution must be enforced centrally at the server level.
What should you do?

  1. Configure a Microsoft Entra administrator for Server1.
  2. Enable a managed identity for Server1.
  3. Enable Microsoft Entra-only authentication for Server1.
  4. Remove SQL logins from DB1.

Answer(s): C

Explanation:

Enabling Microsoft Entra-only authentication on the Azure SQL logical server disables SQL authentication at the server level for every database hosted on Server1. Only Microsoft Entra-authenticated connections are permitted, centrally enforcing the required authentication policy.



You have a Microsoft Entra tenant that has the following configurations:
-User consent for applications is disabled.
-Only administrators can grant permissions to applications.
You register an application named App1 that uses delegated Microsoft Graph permissions.
You need to configure App1 to meet the following requirements:
-Enable user sign-ins without interactive consent prompts.
-Enable App1 to access Microsoft Graph on behalf of the signed-in user.
What should you do?

  1. Configure enterprise applications to require user assignment and assign users to App1.
  2. Modify the app registration to use application permissions instead of delegated permissions.
  3. Add the required delegated Microsoft Graph permissions to the app registration and rely on user consent during sign-in.
  4. Grant admin consent to App1 for the required delegated permissions.

Answer(s): D

Explanation:

Admin consent grants the required delegated Microsoft Graph permissions on behalf of the tenant. App1 can then call Microsoft Graph in the context of a signed-in user without requiring individual users to respond to consent prompts, which is necessary because user consent is disabled.



You have a Microsoft Entra tenant that uses Privileged Identity Management (PIM).
You need to modify the AI Administrator role settings to meet the following requirements:
-Elevated access must be evaluated by another administrator before it is granted.
-Privileged access must be removed automatically after a fixed period.
Which two settings should you configure? Each correct answer presents part of the solution.
Note: Each correct selection is worth one point.

  1. Expire active assignments after
  2. Require approval to activate
  3. Require justification on activation
  4. Expire eligible assignments after
  5. Activation maximum duration

Answer(s): B,E

Explanation:

Requiring approval to activate ensures that a designated administrator must evaluate and approve an eligible user’s elevation request before privileged access is granted. Setting an activation maximum duration makes each activated role assignment time-bound, automatically removing the elevated access when the configured activation period expires.



You have two management groups named MG1 and MG2 that contain multiple Azure subscriptions. The subscriptions are linked to a Microsoft Entra tenant.
You have a user named User1 and a global administrator named Admin1.
You are informed that User1 created an Azure subscription named Sub1 under the MG2 management group and is the only owner of the subscription.
You need to ensure that Admin1 can remove the Owner role from User1 for Sub1.
What should you do first?

  1. Move Sub1 to MG1.
  2. Assign Admin1 the User Access Administrator role for Sub1.
  3. Instruct Admin1 to use Privileged Identity Management (PIM) to request the Security Administrator role.
  4. Instruct Admin1 to enable Access management for Azure resources.

Answer(s): D

Explanation:

Enabling Access management for Azure resources allows a Microsoft Entra Global Administrator to elevate access and receive the User Access Administrator role at the root scope. This inherited access applies to Sub1 and enables Admin1 to remove User1’s Owner role assignment from the subscription.



You have a management group named MG1 that contains two subscriptions named Sub1 and Sub2.
Sub1 contains a resource group named RG-Exception and a resource group named RG1 that hosts Microsoft Foundry resources.
You need to assign an Azure policy to force new Foundry deployments in MG1 to use private endpoints. The solution must NOT restrict deployments in RG-Exception.
How should you configure the policy?

  1. Assign the policy to MG1 and exclude RG-Exception.
  2. Assign the policy to Sub1 and RG-Exception.
  3. Assign the policy to MG1 and RG-Exception.
  4. Assign the policy to Sub1 and exclude RG-Exception.

Answer(s): A

Explanation:

Assigning the policy at the MG1 scope enforces the private endpoint requirement for new Microsoft Foundry deployments in all subscriptions and resource groups beneath the management group. Configuring RG-Exception as an excluded scope prevents the policy from restricting deployments in that resource group while maintaining centralized enforcement everywhere else in MG1.



You have an Azure key vault named KV1 that uses role-based access control (RBAC) authorization. KV1 stores database connection strings for an Azure App Service web app named App1.
You enable a firewall on KV1 and allow access to KV1 from only the virtual network that contains App1.
You need to ensure that App1 can retrieve secrets from KV1 without using credentials stored in the application configuration.
What should you create?

  1. an access policy for KV1
  2. an app registration for App1
  3. a private endpoint for KV1
  4. a managed identity for App1

Answer(s): D

Explanation:

A managed identity enables App1 to authenticate to Azure Key Vault through Microsoft Entra ID without storing or managing application credentials. Because KV1 uses RBAC authorization, the identity must also be assigned an appropriate Key Vault data-plane role, such as Key Vault Secrets User, to retrieve the stored connection strings.



DRAG DROP (Drag and Drop is not supported)
You have a Microsoft Entra tenant.
You need to implement passwordless authentication. The solution must meet the following requirements:
-Users can sign in without a password by using a mobile device.
-New users that sign in for the first time must use a helpdesk-issued sign-in method that expires.
Which authentication method should you enable for each requirement? To answer, drag the appropriate methods to the correct requirements. Each method may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
Note: Each correct selection is worth one point.
Select and Place:

  1. See Explanation section for answer.

Answer(s): A

Explanation:





Passwordless sign-in: Microsoft Authenticator First-time sign-in for new users: Temporary Access Pass
Microsoft Authenticator supports passwordless phone sign-in, allowing users to authenticate from a registered mobile device without entering a password. Temporary Access Pass is a time-limited, helpdesk-issued passcode that enables new users to complete their initial sign-in and register passwordless authentication methods.



You have a Microsoft Entra tenant that has user consent for applications disabled.
You register an application named App1 that requests the following Microsoft Graph delegated permissions:
-User.Read
-Mail.Read
You need to configure tenant permissions to meet the following requirements:
-Enable users to grant consent for low-risk permissions without administrator interaction.
-Ensure that applications requesting higher-privilege permissions require administrator approval.
What should you do?

  1. Grant tenant-wide admin consent to App1.
  2. Configure application assignments for App1.
  3. Configure Privileged Identity Management (PIM) role assignments.
  4. Create an app consent policy.

Answer(s): D

Explanation:

An app consent policy defines the conditions under which users can consent to delegated permissions, such as permitting approved low-risk permissions while withholding consent rights for higher-privilege permissions. Permissions outside the allowed policy conditions require administrator consent or approval.



  PDF
Viewing page 6 of 16
Viewing questions 41 - 48 out of 121 questions


Post your Comments and Discuss Microsoft SC-500 exam prep with other Community members:

AI Tutor AI Tutor 👋 I’m here to help!