Free SC-500 practice test: 30 questions with answers

Microsoft Sentinel is a cloud SIEM that collects logs from many sources, runs analytics rules, and creates incidents for investigation. Cost management, storage lifecycle policies and work-tracking boards do not provide security correlation.

A scheduled analytics rule uses a KQL query with thresholds to detect the pattern and create incidents. Workbooks visualize data, playbooks respond to incidents, and watchlists store reference lists rather than detection logic.

Sentinel playbooks run Logic Apps workflows triggered by incidents or alerts, which can disable accounts and send notifications. Spreadsheets, workbook refreshes and retention policies do not perform response actions.

Defender for Cloud provides threat protection, security posture recommendations and workload protections across subscriptions, including AI workloads. Defender for Office 365 covers email and collaboration, eDiscovery is for legal review, and Azure Policy enforces configuration without alerting on threats.

Advanced hunting in Defender XDR runs KQL queries across endpoint, identity and email telemetry to find related activity. The cost, call quality and site logs do not provide threat hunting data.

Identity sign-in logs and the AI service's diagnostic and network logs show who accessed the service and how. Calendars, office equipment and marketing material have no investigative value for this attack.

A managed identity with a narrow Key Vault data-plane role lets the app authenticate without any stored credential. Client secrets, embedded tokens and subscription-wide Owner rights each create credentials or privileges that are unnecessary.

Conditional Access can require phishing-resistant authentication strength and a compliant device before granting access. Shared accounts, IP rules alone and periodic log reviews do not enforce identity and device requirements at sign-in.

PIM provides just-in-time, time-bound role activation with approval and audit, which limits standing privilege. Permanent roles, shared passwords and anonymous access violate the requirement.

Certificate or federated credentials avoid long-lived secrets, and narrow role assignments limit what a stolen identity can reach. Owner rights, wiki-shared secrets and disabled logging all increase exposure.

Single sign-on through Entra ID lets users sign in once for several apps, and Conditional Access applies policies to each sign-in. Separate passwords, anonymous access and shared accounts reduce control and accountability.

The authorization code flow with PKCE avoids handling user passwords in the application and issues tokens scoped to the required permissions. Password grants, shared keys and disabled authentication each fail the requirement.

A private endpoint gives the service a private address inside the virtual network, and disabling public access prevents internet exposure. Home IP lists are fragile, secret URLs are not a control, and laptop VPNs do not restrict the service itself.

Azure Web Application Firewall inspects HTTP traffic and applies managed rules against common web attacks such as SQL injection and cross-site scripting. Port filtering in a network security group does not inspect application payloads, and DNS settings and bare public IPs provide no inspection.

Network policies restrict which pods can communicate with which others, limiting lateral movement inside the cluster. A flat network, open ports and disabled logging each widen the exposure.

Vulnerability scanning of container images, integrated with the registry and pipeline, detects known issues before deployment. File size, trust alone and running as root do not assess vulnerabilities and increase risk.

Azure Firewall is a managed network firewall with central rules and threat intelligence for traffic between networks and to the internet. The other services are a database, an automation platform and a visualization tool.

A private endpoint with private DNS keeps traffic on the private network and removes public exposure. An all-addresses firewall rule, a public IP without a firewall and personal VPNs do not meet the requirement.

DSPM for AI in Microsoft Purview identifies sensitive data and shows how AI interactions use it, which supports risk reduction. Mailbox quotas, cost recommendations and attendance reports do not assess data exposure in AI.

Sensitivity labels with encryption and usage rights travel with the file and restrict what recipients can do, even outside the company. Public links, file names and personal copies do not provide persistent protection.

Customer-managed keys in Key Vault or Managed HSM give the company control over key lifecycle and rotation. Platform-managed keys offer less control, and plain-text or emailed keys are insecure.

Defender for SQL threat detection raises alerts for suspicious activity, including SQL injection patterns and unusual access. Cost recommendations, antivirus extensions and DNS locks do not detect database threats.

Least-privilege access with private networking limits who and what can reach the data, and customer-managed encryption protects it at rest. Public containers, removed logs and emailed attachments all expose the data.

Sensitivity labels and their usage rights are enforced by the services that process the content, including AI experiences that respect them. Removing labels, bypassing them and public links all defeat the protection.

The regulatory compliance dashboard in Defender for Cloud maps resources to benchmarks and shows gaps with recommended actions. Budget pages, spreadsheets and the home page do not assess compliance against regulatory standards.

Azure Policy with a deny effect blocks deployments that do not meet the rules, which enforces the standard at creation time. Documents, tags and reminder emails do not prevent non-compliant deployments.

Management groups organize subscriptions into a hierarchy where policies and role assignments are inherited. Tags are metadata, separate tenants add complexity without inheritance, and resource locks prevent deletion or change rather than organizing policy.

A delete lock blocks deletion of the resource group until the lock is removed, even for users with delete rights. Tags are descriptive, budgets report spend, and diagnostic settings record logs.

Compliance Manager assessments record control status and evidence against a standard, which supports audit responses. A printed policy, an email thread and an advisor score do not record control-level evidence.

Retention policies enforce the period, and immutable storage prevents deletion before it ends where legal rules require it. Tags are descriptive, reminders do not enforce retention, and early deletion violates the requirement.