The SC-500: Implementing End-to-End Security Controls for Cloud and AI Workloads exam is Microsoft's new certification for Cloud and AI Security Engineers. It focuses on securing identities, infrastructure, data, applications, networks, and AI workloads across Azure and hybrid environments. Braindump2go has assembled to take you through 80 Q&As to your SC-500 Exam preparation: https://www.braindump2go.com/sc-500.html
QUESTION
You have an Azure subscription named Sub1 that contains a storage account named storage1.
Sub1 has Microsoft Defender for Storage enabled. Defender for Storage has on-upload malware scanning enabled for a monthly cap of 10,000 GB per storage account.
You use a Microsoft Sentinel workspace to monitor security events on all Azure resources.
You need to configure storage1 to use a malware scanning cap of 2,000 GB per month.
What should you do?
A. Enable the Override Defender for Storage subscription-level settings for storage1.
B. From Microsoft Sentinel, modify the data collection rule (DCR) to restrict log ingestion from storage1.
C. Modify the malware scanning configuration of Sub1.
D. From the Microsoft Sentinel workspace, modify the daily cap.
Answer: A
QUESTION
You have an Azure subscription named Sub1 that contains multiple virtual machines. Sub1 has the Microsoft Defender Cloud Security Posture Management (CSPM) plan enabled.
You discover that Defender for Cloud fails to identify plaintext connection strings and SSH keys stored on the virtual machines.
You need to ensure that secrets can be identified on the virtual machines.
What should you do?
A. Configure the Defender for Cloud data connector in Microsoft Sentinel.
B. Enable agentless machine scanning.
C. Deploy the Azure Monitor Agent to all the virtual machines.
D. Enable Microsoft Defender for Key Vault.
Answer: B
QUESTION
You have an Azure subscription named Sub1. Sub1 contains 20 virtual machines that run Windows Server.
Sub1 has the Microsoft Defender for Cloud Defender Cloud Security Posture Management (CSPM) plan enabled.
You need to ensure that all the virtual machines are scanned automatically for known security flaws and misconfigurations.
What should you use?
A. attack path analysis
B. Microsoft cloud security benchmark (MCSB)
C. cloud security explorer
D. just-in-time (JIT) VM access
E. vulnerability assessment on the virtual machines
Answer: E
QUESTION
You have multiple Microsoft Security Copilot workspaces.
A user named User1 accesses Security Copilot by using the default workspace.
You create a new workspace named Workspace1 and assign a capacity to Workspace1.
You plan to route Security Copilot agent traffic to Workspace1.
You need to ensure that User1 can use embedded experiences without errors.
What should you do before switching to Workspace1?
A. Add User1 to Workspace1.
B. Assign User1 the Security Operator role in Microsoft Entra.
C. Disassociate the capacity from the default workspace.
D. Create a new capacity for Workspace1.
Answer: A
QUESTION
You use Microsoft Security Copilot.
Security Copilot contributors currently create custom plugins for their own sessions and manage organization-wide custom plugins.
You need to prevent the contributors from managing the organization-wide custom plugins. The solution must NOT affect the contributors' ability to create custom plugins for their own sessions.
What should you select in the Plugin settings?
A. Contributors and Owners at the tenant scope
B. Owners only at the user scope
C. Contributors and Owners at the user scope
D. Owners only at the tenant scope
Answer: D
QUESTION
You are configuring a new Microsoft Sentinel workspace named Workspace1.
You have an external IT Service Management (ITSM) system that is NOT supported by any Microsoft Sentinel solutions in Azure Marketplace.
You need to ensure that Workspace1 creates service tickets in the ITSM system for all new security incidents.
What should you create?
A. a playbook
B. a workbook
C. a watchlist
D. an analytics rule
Answer: A
QUESTION
You have an Azure subscription that has Microsoft Defender for Cloud enabled.
You have an Amazon Web Services (AWS) account connected to Defender for Cloud that has the Defender Cloud Security Posture Management (CSPM) plan enabled.
You need to identify the potential impact of security incidents that exploit multiple risks reported by Defender CSPM.
What should you use?
A. regulatory compliance
B. cloud security explorer
C. security recommendations
D. attack path analysis
Answer: D
QUESTION
You have an Azure subscription that contains a resource group named RG1.
RG1 contains a Microsoft Security Copilot deployment that is integrated with a Microsoft Sentinel workspace named Workspace1.
Analysts use the Security Copilot standalone experience to retrieve incidents by using the Microsoft Sentinel plugin.
A user named User1 can sign in to Security Copilot but cannot retrieve incidents from Workspace1. You verify that User1 has only the Security Copilot Contributor role.
You need to ensure that User1 can retrieve the incidents. The solution must follow the principle of least privilege and NOT require any configuration changes to Security Copilot.
Which role should you assign to User1?
A. the Security Reader role in Microsoft Entra
B. the Microsoft Sentinel Reader role for Workspace1
C. the Security Copilot Owner role
D. the Security Administrator role in Microsoft Entra
E. the Contributor role in Azure for RG1
Answer: B
QUESTION
You have a Microsoft Sentinel workspace named Workspace1.
You have 100 on-premises servers that run Linux and have the Azure Monitor Agent installed.
You need to collect Syslog events from the Linux servers. The solution must meet the following requirements:
- Ensure that filtering occurs before data is written to Workspace1.
- Reduce ingestion costs by excluding low-value Syslog messages.
What should you include in the solution?
A. an Advanced Security Information Model (ASIM) parser
B. a data collection rule (DCR)
C. an analytics rule
D. a table-level filter and split transformation
Answer: B