Free Practice Questions for Microsoft SC-500 Exam

The security team needs impact and lateral-movement exposure for an abused service principal. Defender XDR attack paths show the identity blast radius by connecting permissions, exposed resources, and reachable assets. Advanced hunting and audit logs can provide raw evidence, but they require more manual analysis. AI Observability and incident review do not directly answer which resources are affected by identity abuse across the environment. The compute domain tests whether protection is applied before deployment, during runtime, or through posture assessment. The selected answer matches the phase described in the requirement. Detection-only tools are not acceptable when the requirement says prevent, and local installation methods are inferior when Defender for Cloud, Azure Policy, or Azure Machine Configuration can enforce the control centrally. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > analyze blast radius by using Defender XDR; Microsoft Learn > attack paths for identity risk.

==============================================================

A Sentinel playbook is an Azure Logic Apps workflow used to automate response actions. For an unsupported external ITSM system, a playbook can call the system API and create a ticket when a new incident is generated. Workbooks visualize data, watchlists enrich detections, and analytics rules generate alerts or incidents. None of those directly integrate with a custom ITSM endpoint in the same way a playbook does. In Microsoft Sentinel and Defender scenarios, collection, detection, investigation, and automation are separate functions. The selected answer maps to the function requested by the question rather than a neighboring capability. This is why analytics, hunting, workbooks, connectors, automation rules, and playbooks must not be treated as interchangeable. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > Sentinel automation rules and playbooks; Microsoft Learn > playbooks for incident response.

==============================================================

Plan: Defender Cloud Security Posture Management (CSPM); Feature: Agentless machine scanning

The scenario asks for plaintext token and SSH private key discovery on virtual machines with minimal changes to the machines. Defender CSPM with agentless machine scanning is the correct combination because it scans disks without requiring an agent deployment to each VM. Defender for Key Vault protects secrets stored in the vault but does not detect developers placing credentials on VM file systems. Azure Monitor Agent would add operational overhead and still would not provide this secret scanning capability. This answer also follows operational scalability. Microsoft security architecture favors policy-driven deployment, agentless assessment, managed identities, and Defender workload plans where possible. Those mechanisms reduce manual configuration while keeping enforcement tied to the resource type, which is why the selected choice is stronger than manual or after-the-fact alternatives. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > Defender CSPM secret scanning; Microsoft Learn > agentless machine scanning.

==============================================================

Defender CSPM must be enabled because Microsoft Defender for Cloud ' s risk prioritization capability is part of the paid Defender CSPM plan and isn ' t included with Foundational CSPM. Foundational CSPM provides baseline posture-management functions and security recommendations, but recommendations can remain Not evaluated for risk when the resources aren ' t protected by Defender CSPM. Microsoft explicitly identifies Defender CSPM as the prerequisite for recommendation risk prioritization.

Defender CSPM enriches recommendations with contextual risk factors such as Internet exposure, resource sensitivity, exploitability, lateral-movement potential, and business impact . Those factors are used to classify recommendations into risk levels such as Critical, High, Medium, and Low.

Enabling Defender for Servers Plan 2 supplies workload protection capabilities for servers but doesn ' t enable CSPM risk prioritization across Azure and AWS recommendations. Azure Arc onboarding isn ' t required merely to obtain risk levels for an already connected AWS environment. Similarly, assigning the CIS AWS Foundations standard changes which compliance assessments are evaluated; it doesn ' t activate Defender for Cloud ' s recommendation risk-ranking engine.

Therefore, the required change is to upgrade from Foundational CSPM to Defender CSPM .

===============

A Global Administrator does not automatically have access to every Azure subscription. The first step is to enable Access management for Azure resources, which elevates the global administrator to manage Azure role assignments at the root scope. After that elevation, Admin1 can remove the Owner assignment from User1 on Sub1. Moving subscriptions or requesting Security Administrator would not provide the Azure RBAC authority needed to modify ownership. The exam objective emphasizes practical identity enforcement rather than cosmetic configuration. A valid answer must identify who authenticates, what permission is granted, where the scope is applied, and whether the method continues to work without passwords or secrets. That is why the selected answer is preferred over broader administrative roles or unrelated access settings. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > Azure role assignments; Microsoft Learn > elevate access to manage Azure resources.

==============================================================

The first step is to create a custom log table in Workspace1 . Microsoft Sentinel uses the underlying Log Analytics workspace as its data platform. When ingesting security events that have a custom JSON schema, the destination table must exist so Azure Monitor can map and store the incoming fields correctly. Microsoft documentation for custom tables explicitly states that custom schemas are used for data that does not fit predefined Azure tables, and the table is created before configuring the collection flow that sends records to it.

For modern custom ingestion, a Data Collection Rule (DCR) defines how incoming records are collected, optionally transformed, and routed to the custom table. Microsoft also documents that a custom table receiving JSON data must exist before the corresponding DCR is created in applicable collection scenarios.

A diagnostic setting is intended primarily for supported Azure resource platform logs and is not the prerequisite for ingesting arbitrary SaaS JSON events. A built-in Sentinel connector would contradict the requirement to build a custom connector . An analytics rule is configured only after data is being ingested because it queries stored events to detect suspicious activity.

Therefore, preparing the workspace begins by defining the custom log table and schema that will receive the SaaS security data.