Microsoft SC-500 : Implementing End-to-End Security Controls for Cloud and AI Workloads

Real comments from customers

If you cannot fully believe our SC-500 exam prep, you can refer to the real comments from our customers on our official website before making a decision. There are some real feelings after they have bought our study materials. Almost all of our customers have highly praised our SC-500 exam guide because they have successfully obtained the certificate. Generally, they are very satisfied with our SC-500 exam torrent. Also, some people will write good review guidance for reference. Maybe it is useful for your preparation of the SC-500 exam. In addition, you also can think carefully which kind of study materials suit you best. If someone leaves their phone number or email address in the comments area, you can contact them directly to get some useful suggestions.

High reliability

Customers always attach great importance to the quality of SC-500 exam torrent. We can guarantee that our study materials deserve your trustee. We have built good reputation in the market now. After about ten years'development, we have owned a perfect quality control system. All SC-500 exam prep has been inspected strictly before we sell to our customers. The inspection process is very strict and careful. Any small mistake can be tested clearly. So you can completely believe our SC-500 exam guide. What's more, all contents are designed carefully according to the exam outline. As you can see, the quality of our SC-500 exam torrent can stand up to the test. Your learning will be a pleasant process.

If you purchase our study materials to prepare the SC-500 exam, your passing rate will be much higher than others. Also, the operation of our study material is smooth and flexible and the system is stable and powerful. You can install the SC-500 exam guide on your computers, mobile phone and other electronic devices. There are no restrictions to the number equipment you install. In short, it depends on your own choice. We sincerely hope that you can enjoy the good service of our SC-500 exam prep.

Wide range of choice

Our company always lays great emphasis on offering customers more wide range of choice. Now, we have realized our promise. Our SC-500 exam guide almost covers all kinds of official test and popular certificate. So you will be able to find what you need easily on our website. Every SC-500 exam torrent is professional and accurate, which can greatly relieve your learning pressure. In the meantime, we have three versions of product packages for you. They are PDF version, windows software and online engine of the SC-500 exam prep. The three versions of the study materials packages are very popular and cost-efficient now. With the assistance of our study materials, you will escape from the pains of preparing the exam. Of course, you can purchase our SC-500 exam guide according to your own conditions. All in all, you have the right to choose freely. You will not be forced to buy the packages.

Microsoft SC-500 Exam Syllabus Topics:

Microsoft Implementing End-to-End Security Controls for Cloud and AI Workloads Sample Questions:

1. Drag and Drop Question
You have an Azure key vault named KV1 that uses role-based access control (RBAC) for data plane authorization.
You have a user named User1 and an Azure App Service web app named App1 that has a system-assigned managed identity.
You need to configure authorization to meet the following requirements:
- App1 must be able to retrieve secrets from KV1.
- User1 must manage the KV1 settings without accessing secret values.
The solution must follow the principle of least privilege.
Which role should you assign to each identity for KV1? To answer, drag the appropriate roles to the correct identities. Each role may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.

2. Case Study 2 - Fabrikam, Inc.
Overview
Fabrikam, Inc. is a consulting company. The company has a main office in New York City and branch offices in Amsterdam and Singapore.
Existing Environment. Network environment
The on-premises network contains a datacenter in each office.
Existing Environment. Cloud environment
Fabrikam has two Azure subscriptions named Sub1 and Sub2 and a Microsoft 365 subscription that includes Microsoft 365 E5 licenses.
All the subscriptions are linked to a Microsoft Entra tenant named fabrikam.com that contains the identities shown in the following table.

The tenant contains the groups shown in the following table.

All devices are enrolled in Microsoft Intune.
Existing Environment. Sub1 Resources
Sub1 contains a resource group named RG1 that contains the resources shown in the following table.

SQLServer1 uses Microsoft SQL Server authentication.
Sub1 has an Azure Web Application Firewall (WAF) named WAF1 that has the following types of rule sets:
- Bot Manager 1.1
- Azure-managed Default Rule Set (DRS)
Sub1 has the following compliance standards assigned in Microsoft Defender for Cloud:
- NIST SP 800-53 Rev. 4
- Microsoft cloud security benchmark (MCSB)
- System and Organization Controls (SOC) 2 Type 2
Existing Environment. Sub2 Resources
Sub2 contains a resource group named RG2.
Planned Changes and Requirements. Planned Changes
Fabrikam plans to implement the following changes:
- Deploy the following key vaults to RG1:
AKV2 in the West Europe Azure region

AKV3 in the Central US Azure region

AKV4 in the East US Azure region

- Deploy the following key vaults to RG2:
AKV5 in the East US region

- Configure VM1 to read data from storage1.
- Create function apps that have the following hosting plans:
Fa1: Flex Consumption hosting plan

Fa2: Consumption hosting plan

Fa3: Dedicated hosting plan

- For WAF1, implement rate limiting rules based on the request
location.
- Enable the NIST SP 800-53 Rev. 5 compliance standard in Defender for
Cloud.
- Create a new storage account named storage2 that supports Azure Table storage.
- Enforce multifactor authentication (MFA) when database administrators access SQLdb1.
- Implement ExpressRoute circuits to the on-premises network as shown
in the following table.

- For RG1, create a new Privileged Identity Management (PIM) eligible role assignment that assigns the Contributor role to supported groups.
Planned Changes and Requirements. Technical Requirements
Fabrikam has the following technical requirements:
- If VM1 is deleted, the permissions for VM1 must be removed
automatically.
- The AKS1 managed identity must only be able to pull images from
Registry1.
- The ID1 managed identity must be able to push images to and pull
images from Registry1.
- All the data in the storage accounts must be encrypted by using
Fabrikam-managed keys.
- All outbound traffic from the function apps to the on-premises
network must use ExpressRoute circuits.
- ExpressRoute connectivity between the on-premises network and the
Azure environment must be encrypted by using Layer 2 or Layer 3
encryption.
Hotspot Question
You need to configure the AKS1 and ID1 managed identities to meet the technical requirements.
The solution must follow the principle of least privilege.
Which role should you assign to each identity? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

3. You have a virtual network named VNet1 that contains a subnet named Subnet1. Azure App Service is integrated with VNet1. You have an Azure SQL Database logical server named Server1 that contains a database named DB1. Server1 is accessible only by using a public IP address.
You need to ensure that Server does NOT use a public IP address and Azure App Service can still access Server1.
What should you create?

A) a private endpoint
B) a service endpoint
C) a routing table
D) an Azure Private Link service

4. Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem.
After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.
You have an Azure subscription that contains two virtual machines named VM1 and VM2. Each virtual machine has system-assigned managed identity enabled.
You have an Azure Storage account named storage1. Public access from all networks is enabled for storage1.
You need to ensure that VM1 and VM2 can access storage1.
Solution: You add each virtual machine to a role on storage1.
Does this meet the goal?

A) No
B) Yes

5. Case Study 2 - Fabrikam, Inc.
Overview
Fabrikam, Inc. is a consulting company. The company has a main office in New York City and branch offices in Amsterdam and Singapore.
Existing Environment. Network environment
The on-premises network contains a datacenter in each office.
Existing Environment. Cloud environment
Fabrikam has two Azure subscriptions named Sub1 and Sub2 and a Microsoft 365 subscription that includes Microsoft 365 E5 licenses.
All the subscriptions are linked to a Microsoft Entra tenant named fabrikam.com that contains the identities shown in the following table.

The tenant contains the groups shown in the following table.

All devices are enrolled in Microsoft Intune.
Existing Environment. Sub1 Resources
Sub1 contains a resource group named RG1 that contains the resources shown in the following table.

SQLServer1 uses Microsoft SQL Server authentication.
Sub1 has an Azure Web Application Firewall (WAF) named WAF1 that has the following types of rule sets:
- Bot Manager 1.1
- Azure-managed Default Rule Set (DRS)
Sub1 has the following compliance standards assigned in Microsoft Defender for Cloud:
- NIST SP 800-53 Rev. 4
- Microsoft cloud security benchmark (MCSB)
- System and Organization Controls (SOC) 2 Type 2
Existing Environment. Sub2 Resources
Sub2 contains a resource group named RG2.
Planned Changes and Requirements. Planned Changes
Fabrikam plans to implement the following changes:
- Deploy the following key vaults to RG1:
AKV2 in the West Europe Azure region

AKV3 in the Central US Azure region

AKV4 in the East US Azure region

- Deploy the following key vaults to RG2:
AKV5 in the East US region

- Configure VM1 to read data from storage1.
- Create function apps that have the following hosting plans:
Fa1: Flex Consumption hosting plan

Fa2: Consumption hosting plan

Fa3: Dedicated hosting plan

- For WAF1, implement rate limiting rules based on the request
location.
- Enable the NIST SP 800-53 Rev. 5 compliance standard in Defender for
Cloud.
- Create a new storage account named storage2 that supports Azure Table storage.
- Enforce multifactor authentication (MFA) when database administrators access SQLdb1.
- Implement ExpressRoute circuits to the on-premises network as shown
in the following table.

- For RG1, create a new Privileged Identity Management (PIM) eligible role assignment that assigns the Contributor role to supported groups.
Planned Changes and Requirements. Technical Requirements
Fabrikam has the following technical requirements:
- If VM1 is deleted, the permissions for VM1 must be removed
automatically.
- The AKS1 managed identity must only be able to pull images from
Registry1.
- The ID1 managed identity must be able to push images to and pull
images from Registry1.
- All the data in the storage accounts must be encrypted by using
Fabrikam-managed keys.
- All outbound traffic from the function apps to the on-premises
network must use ExpressRoute circuits.
- ExpressRoute connectivity between the on-premises network and the
Azure environment must be encrypted by using Layer 2 or Layer 3
encryption.
You implement the planned changes for the key vaults. To which key vaults can you restore AKV1 backups?

A) AKV2, AKV3, AKV4, and AKV5
B) AKV3 and AKV4 only
C) AKV4 only
D) AKV2, AKV3, and AKV4 only
E) AKV4 and AKV5 only

Solutions: