Free Practice Questions for Microsoft SC-500 Exam

The correct role is Security Reader. Microsoft Defender for Cloud uses Azure RBAC to control access to security information. The Security Reader role provides read-only access specifically to Defender for Cloud data, including security recommendations, security alerts, security policies, and security state, while preventing the user from modifying policies, dismissing alerts, or changing security configuration. Microsoft explicitly recommends assigning the least-permissive role required for the user ' s operational duties.

This scope is especially important for multicloud environments. When an AWS account is onboarded, Defender for Cloud represents that environment through an Azure security connector resource. Microsoft documents that permissions assigned at the resource group containing the AWS connector are inherited for multicloud recommendations and security alerts. Therefore, assigning Security Reader to Group1 at RG1 provides the analysts with the required visibility into the connected AWS environment.

Although Reader can also view recommendations and alerts, it grants broader read access to Azure resources within RG1 and is therefore less restrictive. Security Administrator permits security-policy changes and alert/recommendation management, while Owner provides extensive resource-management and access-control permissions.

Thus, Security Reader at RG1 satisfies the requirement with the least privilege.

Defender for Storage can be configured at the subscription level and overridden at the individual storage account level. Because the subscription cap is 10,000 GB but storage1 needs its own 2,000 GB monthly cap, the correct action is to enable the storage-account override and configure the account-specific malware scanning limit. Sentinel ingestion caps and DCR filtering affect logs, not the malware scanning volume cap. For this domain, least privilege means granting only the required data operation or allowing only the required network flow. The correct response avoids shared keys, broad peering, general contributor roles, or log-only controls when the scenario demands prevention, routing, event triggering, or account-specific configuration. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > Defender for Storage configurations; Microsoft Learn > override subscription-level Defender for Storage settings.

==============================================================

Microsoft Defender for SQL detects potential SQL injection attacks, making option C the correct answer. A sign-in value such as SELECT * FROM table1 is characteristic of an attempt to inject SQL syntax into an input field that should contain authentication data. Defender for SQL Advanced Threat Protection analyzes database activity and generates security alerts for suspicious patterns including SQL injection, anomalous database access, unusual query patterns, and brute-force authentication activity. Microsoft Learn

Deleting more than 100 rows or updating more than 50 percent of a table is not inherently malicious. Legitimate administrative, batch-processing, maintenance, and application operations can modify large numbers of records, so those thresholds alone are not defined Defender for SQL threat-detection categories.

Likewise, adding a user to db_owner can represent an important privileged administrative operation, but merely performing that legitimate role assignment is not, by itself, one of the threat patterns represented by the answers here.

The attempted username containing a SQL statement, however, maps directly to the SQL injection attack category that Defender for SQL is designed to identify. Microsoft describes potential SQL injection as one of the principal threat types continuously monitored by Advanced Threat Protection.

Statement

Answer

From VM1, you can access File1 by using a private IP address.

Yes

From VM2, you can access File1 by using a private IP address.

Yes

From VM2, you can access File2 by using a private IP address.

No

The private endpoint is configured for the blob sub-resource of contoso2024. Azure Storage private endpoints are created for individual storage services. Microsoft documents separate private endpoint targets for blob, file, queue, table, and other supported storage services. Therefore, PE1 provides private connectivity to Blob Storage, which contains File1, but it does not provide a private endpoint for the Azure Files service that contains File2. Microsoft Learn

VM1 → File1 = Yes. VM1 is in VNet1, and VNet1 is peered with VNet2. A private endpoint has an IP address in Subnet21, and private endpoint connectivity can be consumed from connected virtual networks, including peered VNets, provided DNS resolves the storage Blob endpoint to that private IP. Microsoft Learn

VM2 → File1 = Yes. VM2 resides directly in VNet2, where the blob private endpoint exists, so it can reach File1 through the endpoint ' s private IP.

VM2 → File2 = No. File2 resides in an Azure file share, which requires a separate private endpoint targeting the file sub-resource and normally uses the privatelink.file.core.windows.net private DNS zone. The existing blob private endpoint cannot provide private-IP connectivity to Azure Files.

To create a new Azure AD directory named 28681041.onmicrosoft.com that contains a new user named user1@28681041.onmicrosoft.com, you can follow these steps:

In the Azure portal, search for and select Azure Active Directory.

In the left pane, select Domains.

Select Add domain.

In the Add a custom domain pane, enter the following information:

Domain name: Enter the domain name you want to use. For example, 28681041.onmicrosoft.com.

Add domain: Select Add domain.

In the left pane, select Users.

Select New user.

In the New user pane, enter the following information:

User name: Enter the user name you want to use. For example, user1@28681041.onmicrosoft.com.

Name: Enter the name of the user.

Password: Enter a password for the user.

Groups: Select the groups you want the user to be a member of.

Select Create.

You can find more information on these topics in the following Microsoft documentation:

Add a custom domain name to Azure Active Directory

Create a new user in your organization - Azure Active Directory

To prevent HTTP connections to the rg1lod28681041n1 Azure Storage account, you can follow these steps:

In the Azure portal, search for and select the storage account named rg1lod28681041n1.

In the left pane, select Firewalls and virtual networks.

In the Firewalls and virtual networks pane, select Selected networks.

In the Selected networks pane, select Add existing virtual network.

In the Add existing virtual network pane, select the virtual network that does not allow HTTP connections.

Select Add.

To email an alert to a user named adminl@contoso.com if the average CPU usage of a virtual machine named VM1 is greater than 70 percent for a period of 15 minutes, you can follow these steps:

In the Azure portal, search for and select the virtual machine named VM1.

In the left pane, select Alerts.

Select New alert rule.

In the New alert rule pane, enter the following information:

Name: Enter a name for the alert rule.

Description: Enter a description for the alert rule.

Condition: Select Metric measurement.

Resource: Select the virtual machine named VM1.

Metric: Select Percentage CPU.

Operator: Select Greater than.

Threshold: Enter 70.

Aggregation type: Select Average.

Period: Select 15 minutes.

In the Actions pane, select Add action group.

In the Add action group pane, enter the following information:

Name: Enter a name for the action group.

Short name: Enter a short name for the action group.

Email recipient: Enter the email address of the user you want to receive the alert. For example, adminl@contoso.com.

Select OK.

To ensure that the rg1lod28681041n1 Azure Storage account is encrypted by using a key stored in the KeyVault28681041 Azure key vault, you can follow these steps:

In the Azure portal, search for and select the storage account named rg1lod28681041n1.

In the left pane, select Encryption.

In the Encryption pane, select Customer-managed key.

In the Customer-managed key pane, select Select from Key Vault.

In the Select from Key Vault pane, enter the following information:

Key vault: Select the KeyVault28681041 Azure key vault.

Key: Select the key you want to use.

Select Save.