Microsoft Implementing End-to-End Security Controls for Cloud and AI Workloads - SC-500 Exam Practice Test
You have an Azure subscription.
You need to deploy an Azure virtual WAN to meet the following requirements:
*Create three secured virtual hubs located in the East US. West US, and North Europe Azure regions.
*Ensure that security rules sync between the regions.
What should you use?
You need to deploy an Azure virtual WAN to meet the following requirements:
*Create three secured virtual hubs located in the East US. West US, and North Europe Azure regions.
*Ensure that security rules sync between the regions.
What should you use?
Correct Answer: A
Vote an answer
Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).
You have an Azure subscription named Sub1 that contains a storage account named storage1. Sub1 has Microsoft Defender for Storage enabled. Defender for Storage has malware scanning enabled.
You need to configure a solution that automates the remediation of malware detected in storage1.
What should you include in the solution?
You need to configure a solution that automates the remediation of malware detected in storage1.
What should you include in the solution?
Correct Answer: C
Vote an answer
Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).
You have an Azure virtual network named VNet1 that contains a subnet named Subnet! A network security group named NSG1 is associated with Subnet1.
Vou have a storage account named storage1.
You need to ensure that access from Subnet1 to storage! uses a private IP address in Subnet1 and ran be filtered by NSG1 Public network access to storage1 must be disabled.
What should you create?
Vou have a storage account named storage1.
You need to ensure that access from Subnet1 to storage! uses a private IP address in Subnet1 and ran be filtered by NSG1 Public network access to storage1 must be disabled.
What should you create?
Correct Answer: A
Vote an answer
You have an Azure subscription that has the Microsoft Defender for Cloud Foundational Cloud Security Posture Management (CSPM) plan enabled.
You have an Amazon Web Services (AWS) account connected to Defender for Cloud for posture management.
In Defender for Cloud, security recommendations for the resources in Azure and AWS have a risk level of Not evaluated.
You need to ensure that Defender for Cloud assigns a risk level to the recommendations.
What should you do?
You have an Amazon Web Services (AWS) account connected to Defender for Cloud for posture management.
In Defender for Cloud, security recommendations for the resources in Azure and AWS have a risk level of Not evaluated.
You need to ensure that Defender for Cloud assigns a risk level to the recommendations.
What should you do?
Correct Answer: B
Vote an answer
Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).
You have an Azure subscription named Sub1. Sub1 contains 60 virtual machines that run either Window Server or Linux.
All the Windows Server virtual machines host line-of-business (LOB) applications and all the Linux virtual machines host backend databases.
You need to enable malware protection for the virtual machines.
Which Microsoft Defender for Cloud plan should you enable for each type of virtual machine? To answer, drag the appropriate plans to the correct virtual machine types. Each plan may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
All the Windows Server virtual machines host line-of-business (LOB) applications and all the Linux virtual machines host backend databases.
You need to enable malware protection for the virtual machines.
Which Microsoft Defender for Cloud plan should you enable for each type of virtual machine? To answer, drag the appropriate plans to the correct virtual machine types. Each plan may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Correct Answer:
Explanation:
Virtual machine type
Plan
Windows Server
Microsoft Defender for Servers
Linux
Microsoft Defender for Servers
Microsoft Defender for Servers is the correct plan for both the Windows Server and Linux virtual machines because the requirement is to provide malware protection at the virtual-machine operating-system level .
Defender for Servers protects both Windows and Linux VMs and integrates with Microsoft Defender for Endpoint to provide endpoint protection, including antimalware capabilities. Microsoft states that Defender for Servers supports Windows and Linux virtual machines across Azure and other supported environments.
For Linux systems, Defender for Servers deploys the Defender for Endpoint component that includes antimalware functionality. For Windows Server, Defender Antivirus is integrated with Defender for Endpoint and provides malware protection. In addition, Defender for Servers Plan 2 supports agentless malware scanning , which scans VM disks for malicious files without installing an additional scanning agent.
The fact that the Linux machines host databases does not make Microsoft Defender for Databases the correct answer. Defender for Databases protects supported database workloads against database-specific threats; it does not replace VM-level malware protection.
The SC-500 study guide places onboarding and configuring VMs with Defender for Servers under the Secure compute objective.
You use Azure Virtual Network Manager to manage multiple virtual networks organized into two network groups named Production and Development.
You need to configure Virtual Network Manager to meet the following requirements:
Allow traffic between all the virtual networks in Production.
Block traffic between Development and Production.
What should you use for each requirement? To answer, drag the components to the correct requirements. Each component may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
You need to configure Virtual Network Manager to meet the following requirements:
Allow traffic between all the virtual networks in Production.
Block traffic between Development and Production.
What should you use for each requirement? To answer, drag the components to the correct requirements. Each component may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Correct Answer:
Explanation:
Requirement
Component
To allow traffic between all the virtual networks in Production
A connectivity configuration
To block traffic between Development and Production
A security admin configuration
An Azure Virtual Network Manager connectivity configuration defines how virtual networks within network groups communicate. For the Production network group, a connectivity configuration can implement a mesh topology , which establishes connectivity among the virtual networks in that group without requiring administrators to create and maintain individual VNet peerings. Microsoft documents connectivity configurations as the mechanism for establishing managed connectivity patterns such as mesh and hub-and- spoke across virtual networks.
To prevent communication between the Development and Production environments, use a security admin configuration . Security admin configurations contain centrally managed security admin rule collections that can Allow, Always Allow, or Deny network traffic. These rules can be applied across targeted network groups and are specifically suitable for enforcing network segmentation. Microsoft identifies blocking traffic between virtual networks or subnets as a supported security-admin-rule scenario. A Deny security admin rule terminates traffic evaluation and prevents the traffic from reaching the destination, independently of ordinary NSG permissions.
A routing configuration controls routing behavior rather than organizational security segmentation. IPAM manages address-space planning and allocation, while a scope defines which resources Virtual Network Manager can manage; neither directly satisfies these two traffic-control requirements.
You have an Azure key vault named Vault1 that stores the resources shown in the following table.
Which resources support the creation of a rotation policy?
Which resources support the creation of a rotation policy?
Correct Answer: F
Vote an answer