SC-500 Microsoft Certified: Cloud and AI Security Engineer Associate Questions and Answers

An automation rule is the native Sentinel control for applying actions automatically when incidents are created or updated. It can assign incidents to users or groups, change status/severity, add tags, and run playbooks. This directly matches the requirement to assign all new incidents immediately and flag them for triage. It is more direct than hunting queries and is intended for incident-handling automation. The posture and monitoring objective focuses on turning security data into usable operational outcomes. The correct answer either collects the right signal, grants the right security-operations role, or automates incident handling at the correct layer. Distractors often provide dashboards, queries, or broad permissions, but those do not create the requested workflow or least-privilege security capability. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > Sentinel automation rules; Microsoft Learn > automation rule actions for incident assignment.

==============================================================

For AKS1, assign the AcrPull role on Registry1. AcrPull provides the permissions required to download container images from an Azure Container Registry without granting permissions to push, modify, or delete images. Microsoft documents that when AKS is integrated with an Azure Container Registry, the appropriate pull-only role is assigned to the AKS identity used for image pulls. This satisfies the explicit requirement that AKS1 must only be able to pull images and follows least privilege. Microsoft Learn

For ID1, assign AcrPush. Microsoft defines AcrPush as the built-in Azure RBAC role for identities that require both push and pull permissions on a non-ABAC-enabled Azure Container Registry. It therefore allows ID1 to upload container images and retrieve existing images from Registry1 without granting broad resource-management capabilities such as Contributor or Owner. Microsoft Learn

Contributor and Owner would grant substantially more Azure management permissions than required. Reader does not provide container image pull/push data-plane permissions.

AKS1: AcrPull; ID1: Contributor

AKS1 needs to pull images from Azure Container Registry, so AcrPull is the least-privilege registry role for the cluster identity. ID1 requires Contributor in the visible answer area because the referenced technical requirement requires resource changes beyond a read-only or pull-only role. The important distinction is scope: AKS image retrieval should not receive Contributor, while the separate managed identity receives the broader role only for its implementation task. This domain is tested through precise scope control: tenant, subscription, resource, application, and data-plane authorization are not interchangeable. The correct choice applies the smallest identity or governance control that enforces the stated requirement. Options that only add users, create registrations, or provide broad administrator access fail because they do not directly enforce the requested access behavior. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > AKS and managed identities; Microsoft Learn > ACR pull role and Azure RBAC.

==============================================================

AKS workload protection is provided by Microsoft Defender for Containers. That plan covers Kubernetes posture, runtime threat detection, image risk signals, and container workload protections. Defender for Servers protects VMs and Arc servers, Defender for App Service protects web apps, Resource Manager protects control-plane operations, and Defender for Storage protects storage accounts. Because the applications are hosted on AKS1, Defender for Containers is the correct plan. The compute domain tests whether protection is applied before deployment, during runtime, or through posture assessment. The selected answer matches the phase described in the requirement. Detection-only tools are not acceptable when the requirement says prevent, and local installation methods are inferior when Defender for Cloud, Azure Policy, or Azure Machine Configuration can enforce the control centrally. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > Defender for Containers; Microsoft Learn > AKS workload protection.

==============================================================

A private endpoint changes network routing so clients reach the storage account over a private IP address, but it does not grant data-plane authorization. The scenario already allows public network access, so network reachability is not the missing component. VM1 and VM2 still need Azure RBAC assignments for their managed identities or another valid authentication path. Therefore, a private endpoint alone does not meet the goal. For this domain, least privilege means granting only the required data operation or allowing only the required network flow. The correct response avoids shared keys, broad peering, general contributor roles, or log-only controls when the scenario demands prevention, routing, event triggering, or account-specific configuration. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > private endpoints and storage access; Microsoft Learn > private endpoints provide network access, not authorization.

Choose Admin1 because the planned Defender for Cloud change is to enable the NIST SP 800-53 Rev. 5 regulatory compliance standard for Sub1. Defender for Cloud implements regulatory compliance standards through Azure Policy initiatives, and assigning a new standard requires permissions to create or manage policy assignments.

Microsoft states that assigning a regulatory compliance standard requires Owner or Policy Contributor permissions at the relevant scope. Microsoft Learn Admin1 has the Resource Policy Contributor Azure role on Sub1, which provides the policy-management permissions required to assign policy initiatives and therefore supports enabling the NIST standard without granting broader resource-management permissions.

Admin2 has User Access Administrator, which manages Azure RBAC assignments but does not provide the policy-management permissions required for this operation. Admin3 has Contributor, which can manage Azure resources but is restricted from performing certain Microsoft.Authorization operations, including policy assignment operations needed here. Admin4 is a Global Administrator in Microsoft Entra but has no Azure role assignment for Sub1; Microsoft Entra directory administration does not automatically provide subscription-level Defender for Cloud policy-management rights.

Because Admin1 already has the specific policy-management role required for the change, selecting Admin1 satisfies both the functional requirement and the principle of least privilege.

===============

Encryption type

ExpressRoute circuits

Layer 2 encryption

ER3 and ER4 only

Layer 3 encryption

ER1, ER2, ER3, and ER4

For Layer 2 encryption, Azure ExpressRoute uses MACsec (Media Access Control Security). Microsoft states that MACsec is available for ExpressRoute Direct connections because customers have dedicated physical ports connecting their edge routers directly to Microsoft Enterprise Edge routers. Therefore, both ER3 (ExpressRoute Direct) and ER4 (ExpressRoute Metro Direct) can use MACsec. Provider-based ExpressRoute circuits such as ER1 and ER2 do not expose dedicated ExpressRoute Direct ports to the customer and therefore do not support this native Layer 2 MACsec capability. Microsoft Learn

For Layer 3 encryption, ExpressRoute can use IPsec over ExpressRoute private peering. Unlike MACsec, IPsec is an end-to-end network-layer encryption mechanism and is not dependent on ExpressRoute Direct physical ports. Microsoft states that IPsec over ExpressRoute works with any ExpressRoute circuit, allowing encrypted connectivity between the on-premises network and Azure over private peering.

The first step is to enable a system-assigned managed identity on VM1. The scenario requires VM1 to read data from storage1 and also specifies that when VM1 is deleted, the permissions associated with VM1 must effectively cease automatically.

A system-assigned managed identity has a one-to-one lifecycle relationship with the Azure resource to which it belongs. Microsoft explicitly states that when the associated resource is deleted, its system-assigned managed identity is automatically deleted from Microsoft Entra ID. In contrast, a user-assigned identity such as ID1 exists independently and remains after the VM is deleted. Microsoft Learn

After enabling the identity, the appropriate storage data-plane role—such as Storage Blob Data Reader when VM1 requires read access to blobs—can be granted to VM1 ' s managed identity at the required scope. Microsoft documents this exact pattern for a Windows VM accessing Azure Storage: enable its managed identity and assign Storage Blob Data Reader to that identity. Microsoft Learn

Federated credentials are unnecessary for a VM ' s native managed identity. Assigning ID1 would violate the lifecycle requirement because ID1 is user-assigned and survives VM1 deletion. A role assignment cannot be created for VM1 ' s system identity until that identity exists.

Therefore, first enable VM1 ' s system-assigned managed identity.

Storage2 must be configured to use an account encryption key. The planned storage account must support Azure Table storage, while the technical requirement specifies that all storage data must be encrypted using Fabrikam-managed keys, meaning customer-managed keys (CMKs).

Azure Storage treats Table and Queue encryption differently from Blob Storage and Azure Files. Microsoft states that to encrypt Table Storage or Queue Storage with a customer-managed key, the storage account must be configured at creation time to use an encryption key scoped to the account rather than the default service-scoped key. After creation, this setting cannot be changed. Microsoft Learn

An encryption scope does not solve this requirement because encryption scopes apply to Blob Storage containers and individual blobs, not Azure Table data. Microsoft Learn

An Azure RBAC assignment may later be required so that the storage account ' s managed identity can access the customer-managed key in Key Vault, but it does not itself configure Table Storage to support account-level CMK encryption. Purge protection applies to Azure Key Vault rather than storage2.

Therefore, when storage2 is created, configure Table Storage to use the account encryption key.

===============

Add a custom WAF rule. The planned change requires WAF1 to implement rate limiting based on the geographic location of incoming requests. Azure Web Application Firewall supports this combination directly through custom rate-limit rules.

Microsoft documents that Application Gateway WAF rate-limit rules can group requests by GeoLocation, where requests are categorized based on the geographic location derived from the client IP address. The rule can then apply the configured rate threshold independently to traffic originating from each geographic location. Microsoft Learn Azure WAF custom rules also support the GeoMatch operator, which evaluates requests according to their country or region of origin. Microsoft Learn

This makes a single custom rule the most direct and administratively efficient implementation.

The Azure-managed Default Rule Set (DRS) provides predefined protections against common web application attacks, such as injection and protocol attacks; it is not where custom geographic rate limits are defined. Bot Manager 1.1 identifies and handles automated bot traffic but is not the appropriate mechanism for general location-based rate limiting. Azure Policy can enforce configuration standards across resources but does not itself process web requests or impose per-location request thresholds.

Therefore, configure a custom rate-limit rule with geographic matching/grouping.

===============

A managed identity lets App1 authenticate to Key Vault through Microsoft Entra ID without storing credentials in application settings. Because KV1 uses RBAC, the identity can then be granted an appropriate Key Vault data-plane role. An access policy is not used for RBAC-mode authorization. A private endpoint changes network reachability, and an app registration would still require credential management unless paired with a secret or certificate. The exam objective emphasizes practical identity enforcement rather than cosmetic configuration. A valid answer must identify who authenticates, what permission is granted, where the scope is applied, and whether the method continues to work without passwords or secrets. That is why the selected answer is preferred over broader administrative roles or unrelated access settings. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > managed identities and Key Vault; Microsoft Learn > managed identities for App Service with Key Vault.

==============================================================

The technical requirement states that all outbound traffic from the function apps to the on-premises network must use ExpressRoute circuits. To accomplish this, the Function App hosting plan must support outbound virtual network integration, because the application must send outbound traffic into an Azure virtual network from which routes learned through or directed toward the ExpressRoute gateway can reach the on-premises environment.

Fa1, which uses the Flex Consumption plan, supports virtual network integration. Microsoft documents that Flex Consumption provides outbound virtual network connectivity and can therefore reach resources accessible through the integrated virtual network. Microsoft Learn

Fa3, which uses a Dedicated App Service plan, also supports outbound virtual network integration. Microsoft further documents that VNet-integrated Functions can have outbound traffic affected by BGP routes learned from an ExpressRoute gateway, and route tables can direct traffic through that gateway. Microsoft Learn

Fa2, however, uses the legacy Consumption plan, which does not support outbound virtual network integration. Consequently, it cannot meet the requirement to route its outbound on-premises traffic through ExpressRoute using this architecture. Microsoft Learn

Therefore, only Fa1 and Fa3 support the required networking configuration.

A private endpoint is the appropriate mechanism because it exposes the Azure Storage service through a private IP address associated with Subnet1. Private endpoints support Azure virtual network network policies, including network security groups (NSGs). When private-endpoint network policies are enabled for the subnet, NSG rules can be applied to traffic destined for the private endpoint, allowing network access to be controlled through the NSG associated with Subnet1.

This differs materially from a service endpoint. Service endpoints continue to access Azure Storage through its public service endpoint and require service-side virtual network ACL/firewall configuration to restrict which subnets may access the storage account. Microsoft explicitly states that enabling a service endpoint alone is insufficient: the Azure service must also be configured with appropriate virtual-network access controls. Therefore, access would not be governed only by the NSG.

An Azure Private Link service is used to privately publish a customer-owned service, typically behind a load balancer; it is not required to consume Azure Storage privately. A UDR controls routing and does not establish private access to Storage.

For a complete private-access design, the storage account ' s public endpoint should also be restricted or disabled. Microsoft recommends private endpoints when private network access to Azure Storage is required.

Apply a Read-only lock directly to VNet1. Azure management locks operate independently of Azure RBAC and override permissions such as Owner. A ReadOnly lock prevents authorized users from both updating and deleting the locked resource, which exactly satisfies the protection requirement for VNet1. Microsoft documents that a ReadOnly lock effectively restricts authorized users to read operations for the locked resource.

The lock must be scoped specifically to VNet1, not RG1. Locks applied at a parent scope are inherited by child resources. Therefore, applying ReadOnly to RG1 would also prevent modifications to storage1 and other resources in RG1, violating the requirement that engineers must remain able to update those resources.

A Delete lock is insufficient because CanNotDelete permits users to modify a resource while preventing only deletion. The question explicitly requires preventing updates and deletions, so ReadOnly is necessary.

This aligns with the SC-500 governance objective covering enforcement of security controls for Azure resources. The current study guide places governance and security-control enforcement under Manage identity, access, and governance.

===============

A private endpoint is the correct solution because it assigns a private IP address from an Azure virtual network to the Azure SQL logical server connection, allowing clients with connectivity to that virtual network to reach SQL Database without traversing the public endpoint. After the private endpoint is configured, public network access can be disabled on Server1, ensuring that database connectivity occurs exclusively through Azure Private Link. Microsoft specifically documents that App Service applications using VNet Integration can connect to Azure SQL Database through a private endpoint, provided DNS resolves the SQL server name to the private endpoint address.

A service endpoint does not satisfy the requirement because Azure SQL still exposes and uses its public service endpoint; the service endpoint only identifies and secures traffic originating from an authorized subnet. A Private Link service is used to privately expose a customer-owned service, typically behind a Standard Load Balancer, rather than to consume an existing Azure PaaS service such as Azure SQL. A routing table cannot provide Server1 with private PaaS connectivity.

The SC-500 study guide explicitly includes configuring Azure private endpoints to secure access to Azure PaaS resources under the Secure storage, databases, and networking domain.

Authentication method: The Microsoft identity provider; Access control method: Enterprise app assignment required

Built-in authentication for App Service should use the Microsoft identity provider for Microsoft Entra sign-in. To restrict access to selected users and groups, require enterprise app assignment on the corresponding enterprise application. IP restrictions only filter network source and cannot identify assigned corporate users. Local authentication and broad admin consent do not implement assigned-user enforcement for the backend API. This domain is tested through precise scope control: tenant, subscription, resource, application, and data-plane authorization are not interchangeable. The correct choice applies the smallest identity or governance control that enforces the stated requirement. Options that only add users, create registrations, or provide broad administrator access fail because they do not directly enforce the requested access behavior. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > App Service authentication; Microsoft Learn > App Service built-in authentication and enterprise app assignment.

==============================================================

A Logic Apps Request trigger can be invoked through different authorization mechanisms. If all supported methods are enabled but only OAuth-based requests should be accepted, disabling shared access signature authentication removes the non-OAuth shared-secret URL model. Secure Inputs and Secure Outputs protect run-history data but do not control request authentication. API Management could enforce auth but adds cost and complexity, which the requirement says to minimize. The exam objective emphasizes practical identity enforcement rather than cosmetic configuration. A valid answer must identify who authenticates, what permission is granted, where the scope is applied, and whether the method continues to work without passwords or secrets. That is why the selected answer is preferred over broader administrative roles or unrelated access settings. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > Logic Apps security; Microsoft Learn > Request trigger SAS and OAuth authentication.

==============================================================

Microsoft Defender for Cloud provides native multicloud connectors for Amazon Web Services (AWS) and Google Cloud Platform (GCP). Therefore, both the AWS account and GCP environment can be connected to Defender for Cloud for cloud security posture management and supported workload-protection functionality. Microsoft ' s current multicloud support matrix explicitly covers Azure, AWS, and GCP and lists Defender CSPM, Defender for Servers, Defender for Containers, and several other capabilities across AWS and GCP. Microsoft Learn

For GCP, Defender for Cloud provides a dedicated onboarding workflow under Environment settings > Add environment > Google Cloud Platform, allowing projects or organizations to be connected and assessed. AWS has an equivalent native cloud connector mechanism. Microsoft Learn

Alibaba Cloud is not one of the native cloud environments that can be added through Defender for Cloud ' s multicloud connector model. Microsoft ' s documented supported multicloud environments are AWS and GCP in addition to Azure. Individual servers hosted elsewhere could potentially be onboarded through other mechanisms such as Azure Arc where supported, but that is different from connecting an Alibaba Cloud account as a cloud environment.

Therefore, the supported cloud accounts in the question are:

AWS and GCP only.

===============

Enable Microsoft Defender for Servers for Sub1. Defender for Servers integrates directly with Microsoft Defender for Endpoint, and Microsoft states that when Defender for Servers Plan 1 or Plan 2 is enabled, Defender for Endpoint integration is enabled by default and supported connected machines are automatically onboarded. This includes Azure Arc-enabled servers. Microsoft Learn

Microsoft ' s Defender for Endpoint documentation specifically lists a supported Azure VM or Azure Arc-enabled server in an enabled subscription as using automatic onboarding. The normal process is to enable Defender for Servers on the subscription containing the Arc resource; Defender for Cloud then provisions the Defender for Endpoint integration automatically. Microsoft Learn

This satisfies the requirement to protect both existing and future Arc-enabled servers while minimizing administrative effort. Manually onboarding every server through Group Policy or a local installation script introduces unnecessary per-server administration and doesn ' t take advantage of the Defender for Cloud integration.

Azure Policy can be used for granular or tag-based Defender for Servers deployments, but it is unnecessary when the requirement is to protect all servers in Sub1. Microsoft recommends enabling Defender for Servers at the subscription level for broad coverage.

The first step is to enable a managed identity for APIM1. Azure API Management uses a system-assigned or user-assigned managed identity to authenticate to Azure Key Vault when a named value references a Key Vault secret. Microsoft documents that APIM must have a managed identity and that this identity must then be granted the required Key Vault secret permissions before APIM can retrieve the secret.

After the identity is enabled, you grant that identity appropriate Key Vault access—typically secret Get and, depending on the configuration, List permissions—and then configure the APIM named value to reference the Key Vault secret. Microsoft specifically supports named values whose type is Key vault, allowing APIM policies to consume secrets without storing their plaintext values directly in the API Management configuration.

Merely marking the current named value as a secret only masks and encrypts the value inside APIM; it does not satisfy the Defender recommendation that the value be stored in Azure Key Vault. Defender for APIs is unrelated to establishing the Key Vault integration, and APIM subscription keys serve a different purpose from backend credentials.

This aligns with SC-500 objectives covering managed identities, Azure Key Vault, and securing application-platform services such as Azure API Management.

The correct configuration is the Secrets Store CSI Driver. The planned change requires AKS1 to integrate with Vault1, which is an Azure Key Vault. Microsoft provides the Azure Key Vault Provider for Secrets Store CSI Driver specifically for this scenario. It enables an AKS cluster to consume Key Vault objects—such as secrets, keys, and certificates—by mounting them into Kubernetes pods through a CSI volume. Microsoft explicitly describes this driver as providing integration between Azure Key Vault and AKS.

A workload identity can be used as an authentication mechanism that allows Kubernetes workloads to authenticate to Azure resources, including Key Vault, but it is not by itself the feature that performs the Key Vault integration requested by the question. In fact, Workload ID is one of several supported identity methods that can be used with the Secrets Store CSI Driver.

Application scaling controls workload capacity and does not provide secret-store integration. Kubernetes RBAC controls authorization to Kubernetes resources but does not connect AKS to Azure Key Vault.

This maps directly to the SC-500 Secure compute domain, which includes implementing and configuring security controls for Azure Kubernetes Service (AKS).

For a partner-built Security Copilot agent that accesses a Microsoft product such as Microsoft Intune, Microsoft requires a Global Administrator in the tenant to approve the permissions requested by the agent. After that approval is granted, users who are Security Copilot owners or contributors can complete the remaining agent configuration. User2 already holds the Global Administrator role, while User1 already has Security Copilot Contributor, so User2 should perform the required approval first.

This also satisfies the principle of least privilege. Assigning User1 the AI Administrator or Agent ID Administrator role would unnecessarily elevate User1 ' s Microsoft Entra privileges. The Agent ID Administrator role, for example, can manage the full lifecycle of agent identities, agent identity blueprints, blueprint principals, and agent users—far broader authority than is necessary merely to finish this Security Copilot agent deployment.

Creating an agent identity or configuring the Intune data source occurs during or after agent setup and does not replace the tenant-level consent requirement. Microsoft specifically distinguishes the initial administrator approval for partner agents requiring Microsoft product permissions from the subsequent configuration steps that Security Copilot contributors can perform.

Therefore, User2 must first approve Agent1 ' s requested permissions, after which User1 can continue the setup.

Virtual machine type

Plan

Windows Server

Microsoft Defender for Servers

Linux

Microsoft Defender for Servers

Microsoft Defender for Servers is the correct plan for both the Windows Server and Linux virtual machines because the requirement is to provide malware protection at the virtual-machine operating-system level. Defender for Servers protects both Windows and Linux VMs and integrates with Microsoft Defender for Endpoint to provide endpoint protection, including antimalware capabilities. Microsoft states that Defender for Servers supports Windows and Linux virtual machines across Azure and other supported environments.

For Linux systems, Defender for Servers deploys the Defender for Endpoint component that includes antimalware functionality. For Windows Server, Defender Antivirus is integrated with Defender for Endpoint and provides malware protection. In addition, Defender for Servers Plan 2 supports agentless malware scanning, which scans VM disks for malicious files without installing an additional scanning agent.

The fact that the Linux machines host databases does not make Microsoft Defender for Databases the correct answer. Defender for Databases protects supported database workloads against database-specific threats; it does not replace VM-level malware protection.

The SC-500 study guide places onboarding and configuring VMs with Defender for Servers under the Secure compute objective.

A user delegation SAS is the best choice because the requirement specifically calls for time-bound, least-privilege access to Azure Blob Storage. A SAS can be restricted to the exact resource, permissions, and validity period required. For example, the token can grant only the permissions needed to upload blobs and can be configured with a defined expiration time. Microsoft recommends using a user delegation SAS whenever possible because it is secured with Microsoft Entra credentials instead of the storage account key. Microsoft Learn

This is more secure than Shared Key authorization, which relies on storage account keys that provide broad access and are harder to constrain safely. Microsoft explicitly recommends avoiding Shared Key when more secure Microsoft Entra-based approaches are available. Microsoft Learn

A managed identity would be ideal for a workload hosted on an Azure service that supports managed identities, but the question describes a third-party workflow system and emphasizes temporary delegated access. A user delegation SAS directly satisfies that use case. Anonymous public access is inappropriate because it does not provide controlled authenticated upload access.

Therefore, the correct authorization mechanism is a user delegation SAS.

A hunting query is an investigation tool. It can find suspicious activity or support manual threat hunting, but it does not automatically assign every new incident to a group or flag it for triage. The requirement is an operational automation requirement on incident creation. Therefore, a hunting query alone does not meet the goal even though it may help analysts review incidents later. In Microsoft Sentinel and Defender scenarios, collection, detection, investigation, and automation are separate functions. The selected answer maps to the function requested by the question rather than a neighboring capability. This is why analytics, hunting, workbooks, connectors, automation rules, and playbooks must not be treated as interchangeable. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > Sentinel hunting and automation; Microsoft Learn > hunting queries versus incident automation.

==============================================================

Microsoft Entra authentication must be configured on the SQL server before Microsoft Entra identities and Conditional Access can govern database access. A Conditional Access policy then enforces the planned access control for SQLdb1. A compliance policy does not authenticate SQL connections. Federated client identity and a user-assigned managed identity are used for workload identity scenarios, not for enforcing user sign-in requirements against Azure SQL in this case. The exam objective emphasizes practical identity enforcement rather than cosmetic configuration. A valid answer must identify who authenticates, what permission is granted, where the scope is applied, and whether the method continues to work without passwords or secrets. That is why the selected answer is preferred over broader administrative roles or unrelated access settings. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > Azure SQL authentication and conditional access; Microsoft Learn > Microsoft Entra authentication for Azure SQL.

==============================================================

An analytics rule creates alerts and incidents from detection logic. It is not a global mechanism for assigning every new incident from all sources or adding triage flags after incident creation. While a specific analytics rule can set some incident details for incidents it generates, it does not meet the stated goal for all new incidents in the workspace. Sentinel automation rules or playbooks are the correct tools. In Microsoft Sentinel and Defender scenarios, collection, detection, investigation, and automation are separate functions. The selected answer maps to the function requested by the question rather than a neighboring capability. This is why analytics, hunting, workbooks, connectors, automation rules, and playbooks must not be treated as interchangeable. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > Sentinel analytics rules; Microsoft Learn > analytics rules create incidents, not global assignment handling.

==============================================================

To email an alert to a user named adminl@contoso.com if the average CPU usage of a virtual machine named VM1 is greater than 70 percent for a period of 15 minutes, you can follow these steps:

In the Azure portal, search for and select the virtual machine named VM1.

In the left pane, select Alerts.

Select New alert rule.

In the New alert rule pane, enter the following information:

Name: Enter a name for the alert rule.

Description: Enter a description for the alert rule.

Condition: Select Metric measurement.

Resource: Select the virtual machine named VM1.

Metric: Select Percentage CPU.

Operator: Select Greater than.

Threshold: Enter 70.

Aggregation type: Select Average.

Period: Select 15 minutes.

In the Actions pane, select Add action group.

In the Add action group pane, enter the following information:

Name: Enter a name for the action group.

Short name: Enter a short name for the action group.

Email recipient: Enter the email address of the user you want to receive the alert. For example, adminl@contoso.com.

Select OK.

To add the network interface of a virtual machine named VM1 to an application security group named ASG1, you can follow these steps:

In the Azure portal, search for and select the virtual machine named VM1.

In the left pane, select Networking.

In the Networking pane, select the network interface that you want to add to the application security group named ASG1.

In the network interface pane, select Application security groups.

In the Application security groups pane, select Add.

In the Add application security group pane, select the application security group named ASG1.

Select Save.

You can find more information on this topic in the following Microsoft documentation: Add a network interface to an application security group using the Azure portal.

To create a new Azure AD directory named 28681041.onmicrosoft.com that contains a new user named user1@28681041.onmicrosoft.com, you can follow these steps:

In the Azure portal, search for and select Azure Active Directory.

In the left pane, select Domains.

Select Add domain.

In the Add a custom domain pane, enter the following information:

Domain name: Enter the domain name you want to use. For example, 28681041.onmicrosoft.com.

Add domain: Select Add domain.

In the left pane, select Users.

Select New user.

In the New user pane, enter the following information:

User name: Enter the user name you want to use. For example, user1@28681041.onmicrosoft.com.

Name: Enter the name of the user.

Password: Enter a password for the user.

Groups: Select the groups you want the user to be a member of.

Select Create.

You can find more information on these topics in the following Microsoft documentation:

Add a custom domain name to Azure Active Directory

Create a new user in your organization - Azure Active Directory

To ensure that a user named user2-28681041 can manage the properties of the virtual machines in the RG1lod28681041 resource group using the principle of least privilege, you can follow these steps:

In the Azure portal, search for and select the resource group named RG1lod28681041.

In the left pane, select Access control (IAM).

Select Add.

In the Add role assignment pane, enter the following information:

Role: Select the appropriate role for your scenario. For example, Virtual Machine Contributor.

Assign access to: Select User, group, or service principal.

Select: Enter the name of the user you want to assign the role to. For example, user2-28681041.

Select Save.

https://docs.microsoft.com/en-us/azure/role-based-access-control/role-assignments-portal

To ensure that only devices connected to a 131-107.0.0/16 subnet can access data in the rg1lod28681041 Azure Storage account, you can follow these steps:

In the Azure portal, search for and select the storage account named rg1lod28681041.

In the left pane, select Firewalls and virtual networks.

In the Firewalls and virtual networks pane, select Selected networks.

In the Selected networks pane, select Add existing virtual network.

In the Add existing virtual network pane, select the virtual network that contains the 131-107.0.0/16 subnet.

Select Add.

https://docs.microsoft.com/en-us/azure/storage/common/storage-network-security

To register App28681041 to Azure AD and generate a password for it, you can follow these steps:

In the Azure portal, search for and select Azure Active Directory.

In the left pane, select App registrations.

Select New registration.

In the Register an application pane, enter the following information:

Name: App28681041

Supported account types: Select the appropriate account types for your scenario.

Redirect URI: Leave this field blank.

Select Register.

In the App registrations pane, select the newly created App28681041 application.

In the left pane, select Certificates & secrets.

Select New client secret.

In the Add a client secret pane, enter the following information:

Description: Enter a description for the client secret.

Expires: Select an appropriate expiration date for the client secret.

Select Add.

In the Certificates & secrets pane, copy the value of the newly created client secret.

You can find more information on this topic in the following Microsoft documentation: Quickstart: Register an application with the Microsoft identity platform.

To collect all the audit failure data from the security log of a virtual machine named VM1 to an Azure Storage account, you can follow these steps:

In the Azure portal, search for and select the virtual machine named VM1.

In the left pane, select Diagnostic settings.

Select Add diagnostic setting.

In the Add diagnostic setting pane, enter the following information:

Name: Enter a name for the diagnostic setting.

Destination: Select Storage account.

Storage account: Select the storage account you want to use.

Logs: Select Windows Event Logs.

Categories: Select Security.

Event types: Select Audit Failure.

Select Save.

To prevent HTTP connections to the rg1lod28681041n1 Azure Storage account, you can follow these steps:

In the Azure portal, search for and select the storage account named rg1lod28681041n1.

In the left pane, select Firewalls and virtual networks.

In the Firewalls and virtual networks pane, select Selected networks.

In the Selected networks pane, select Add existing virtual network.

In the Add existing virtual network pane, select the virtual network that does not allow HTTP connections.

Select Add.

To ensure that the rg1lod28681041n1 Azure Storage account is encrypted by using a key stored in the KeyVault28681041 Azure key vault, you can follow these steps:

In the Azure portal, search for and select the storage account named rg1lod28681041n1.

In the left pane, select Encryption.

In the Encryption pane, select Customer-managed key.

In the Customer-managed key pane, select Select from Key Vault.

In the Select from Key Vault pane, enter the following information:

Key vault: Select the KeyVault28681041 Azure key vault.

Key: Select the key you want to use.

Select Save.

To configure Azure to allow RDP connections from the Internet to a virtual machine named VM1, you can follow the steps below:

Create a new inbound security rule in the network security group (NSG) that is associated with the virtual network subnet that contains VM1. The rule should allow RDP traffic from the Internet to the virtual network subnet. You can use the Azure portal, Azure PowerShell, or Azure CLI to create the rule.

Configure the network security group (NSG) to associate it with the virtual network subnet that contains VM1.

Configure the virtual machine to allow RDP traffic. You can use the Azure portal, Azure PowerShell, or Azure CLI to configure the virtual machine.

To minimize the attack surface of VM1, you can use the following best practices:

Use a strong password for the local administrator account on the virtual machine.

Use Network Security Groups (NSGs) to restrict traffic to only the necessary ports and protocols.

Use Azure Security Center to monitor and protect your virtual machines.