SC-500 — frequently asked questions

Global Admin does not automatically become a mandatory PIM approver; the role's Require approval setting is disabled, so eligible users activate without an approval request.

No. Activation maximum controls how long an activated role session lasts; Expire active assignments is a separate setting and can be shortened to two days.

An Entra admin enables Microsoft Entra logins, but SQL logins and SQL authentication remain available unless Entra-only authentication is enabled on the logical server.

Yes. It is a logical-server-level setting that blocks SQL authentication for all databases on Server1, rather than requiring a per-database change in DB1.

Encryption scopes apply to Blob containers and Azure Files, not Azure Table storage, so table data would not be covered by the Fabrikam-managed key.

Yes. At the storage-account level you select customer-managed keys stored in Azure Key Vault, which makes the account encryption key Fabrikam-managed.

It is a control-plane role for managing the storage account itself, not a data-plane role for blob contents, so it does not grant the required read/write/delete blob actions.

Container scope grants only the needed data access on that container, while account scope would also cover every other container and violate least privilege.

VNet1 is the provider VNet that owns VM1 and VM2, so it publishes them through a Private Link service. The consumer VNet2 then creates the private endpoint that VM3 uses.

No. Peering connects the VNets broadly and does not provide per-service scoping, whereas Private Link exposes only the specific service behind the Private Link service.

They can coexist; adding a shared user-assigned identity does not remove the existing system-assigned identities, and that shared identity can be granted an RBAC role on storage1.

Yes. To let the managed identity read blob data, assign a data-plane role like Storage Blob Data Reader; management-plane roles such as Reader do not grant blob data access.

Azure RBAC assigns roles to security principals; a system-assigned managed identity is a separate service principal tied to the VM, not the VM resource object itself.

No. Network access only makes the storage endpoint reachable; managed identity authentication still requires a data-plane role such as Storage Blob Data Reader on storage1.

The VM resource is not a security principal. To grant access, assign the storage role to the VM's system-assigned managed identity service principal, or add that service principal to the group.

No. Public network access only affects connectivity; authentication and authorization still require a valid identity and an appropriate Azure RBAC role assignment.

App Service protection monitors Azure App Service web apps and API apps; it has no Kubernetes control-plane or node visibility, so it cannot protect AKS1.

No. It also covers node and workload runtime threats, vulnerability assessment, container registry images, and Kubernetes posture recommendations.

Bastion accepts HTTPS sessions from the Azure portal or Internet on 443 and proxies RDP; 3389 is used outbound from the Bastion subnet to the target VM, not inbound from the Internet.

Only if you need SSH access to Linux VMs; for RDP the outbound rule is TCP 3389. Microsoft's Bastion NSG guidance also includes other required rules such as Gateway Manager access.

Containers in the same ACI container group share localhost, so internal traffic to port 5000 does not depend on the group's public port list.

No. ACI publishes only the ports declared for the container group's public IP, so omitting TCP 5000 removes external reachability without an NSG rule.

NSG rules are static: once created they stay in effect until edited or deleted, so they cannot automatically expire RDP access after four hours the way a JIT request does.

No. Bastion removes the public RDP endpoint by brokering connections over TLS, but it does not automatically close or expire the underlying access after a set period; you would still need a time-bound control such as JIT.

Global Administrator does not grant Azure resource RBAC permissions by default. Admin4 would need to elevate access or hold Owner/User Access Administrator at RG1; Admin2 already has the required role.

No. PIM eligible Azure resource role assignments require security groups, so among the listed groups only Group1 and Group2 are valid targets.

Contributor has full control over resources but lacks the Microsoft.Authorization/roleAssignments/write permission required to assign RBAC roles.

Yes, but assigning it at the Management Group scope (MG1) is more efficient as it automatically covers all current and future linked subscriptions.

Diagnostic settings are better for logging and long-term analysis. They do not provide the low-latency, event-driven architecture needed for immediate serverless automation.

Yes, but indirectly via Event Grid. You configure an Event Grid subscription to send the Defender event to a Logic App webhook or function app.

No. Passive Mode allows Microsoft Defender Antivirus to run without actively scanning or remediating threats, but it still collects telemetry and supports EDR functionality.

Windows Server 2019 does not automatically detect third-party AV and switch to Passive Mode like Windows 10/11 client OS versions do; manual configuration is required.

No, when configuring auditing via the Azure portal, the storage account must be in the same region as the SQL server.

Yes, but it primarily targets General Purpose v2 accounts. The key constraint here is region, not just tier.

The Secrets Officer role allows managing secrets but not reading their values directly in some contexts, whereas the Secrets Manager role typically has broader read/write access. However, for this exam, focus on the strict separation between Officer roles.

Yes, the Key Vault Administrator role has Full access to all operations in the vault, including Keys, Secrets, and Certificates, regardless of other specific role assignments.

No, owning the application registration does not allow granting tenant-wide admin consent. Only specific privileged roles like Global Administrator or Application Administrator can perform this action.

The roles are Global Administrator, Privileged Role Administrator, Cloud Application Administrator, and Application Administrator.

No. A Container SAS allows listing blobs or managing the container. To write a blob, you need an Object SAS or a Container SAS with explicit permissions that somehow cover blobs, but standard practice distinguishes these scopes.

Yes. If RBAC denies access (e.g., no role assigned), the user cannot perform the action even if they have a valid SAS token. Both must allow the operation.

Administrators still access the shares with storage account keys, so disabling shared key access would break their access unless they first migrate to Microsoft Entra ID.

Storage File Data Privileged Reader grants read access to Azure Files data; assign it to App1's managed identity at the share or storage-account scope.

Network rules filter by IP address, port, and protocol, so they cannot enforce an HTTP/HTTPS URL allowlist. Azure Firewall application rules are the correct control for FQDN-based filtering.

Yes, when no other allow rule matches, Azure Firewall's default deny behavior blocks the remaining outbound traffic. The application rule permits only updates.contoso.com.

Hunting queries only run KQL searches over log data for proactive investigation; they do not create or modify incident records, so they cannot set an owner or add a triage tag.

Create an automation rule triggered by "When incident is created" that assigns the owner to the Tier 1 analysts group and adds a triage tag or changes the status.

A playbook is a Logic App workflow with no incident-created trigger of its own; it runs only when an automation rule or an analyst invokes it.

Use the "When incident is created" trigger with an "Assign owner" action pointing to the Tier 1 group, plus an action that adds a triage tag.

Agent ID Administrator can create and manage agent identities, but it does not grant the tenant-wide Intune/Microsoft Graph consent that this partner-built agent requires.

No. The Get agent option is blocked by missing admin consent for Agent1's Intune access; an existing Global Administrator can approve it without assigning User1 a broader role.

It also grants encrypt, decrypt, sign, verify, update, backup/restore, and purge key actions, which exceed the Get, List, Wrap, Unwrap set.

Yes. The Microsoft.KeyVault/vaults/keys/read data action covers both Get and List key metadata in the Key Vault RBAC model.

No. Azure Key Vault requires the target vault to be in the same subscription and same geography as KV1 for both secret and key backups.

No. The target must be in KV1's subscription and geography, but it can be a different region within that geography.

Both configurations are necessary to establish a trusted identity path. Power Platform identifies the agent, while Defender uses that same identity to apply security policies and intercept signals in real-time.

No, the M365 app connector does not provide the specific identity-based tracing and real-time interception capabilities required for Copilot Studio agent safety frameworks.

No, DeployIfNotExists allows the resource to be created. It then triggers a remediation task to update the resource to comply with the policy.

Check if a DeployIfNotExists policy for TDE is assigned to the resource group or subscription and if remediation tasks are enabled.

Yes, both system-assigned and user-assigned managed identities can be members of Microsoft Entra security groups, allowing them to inherit role assignments through the group.

While direct assignment works, it is less scalable and harder to manage. Using a security group allows you to update permissions for multiple VMs by modifying the group membership once.

The Basic v2 pricing tier has limited configuration capabilities compared to higher tiers. Advanced protocol settings, including specific SSL/TLS versions, are often restricted or unavailable in lower tiers.

No. SSL 3.0 is deprecated due to significant security vulnerabilities like POODLE. Modern best practices mandate using TLS 1.2 or TLS 1.3. Exam questions may test legacy configurations for historical knowledge.

You can define up to five stored access policies per blob container. These policies help manage permissions without exposing the account key.

No. You can only configure one time-based retention policy per container. This policy defines how long blobs must be retained before they can be deleted.

While using VM3's IP works technically, ASGs are preferred for managing security at the application level. If VM3's IP changes or if other VMs join ASG2, the rule adapts automatically, whereas static IPs require manual updates.

No. VM2 is in ASG1 and VM3 is in ASG2. To allow communication from VM2 to VM3, the source must be ASG1 and the destination must be ASG2.

User scope applies to custom plugins created for an individual's own sessions, while tenant scope applies to plugins managed and available across the entire organization.

Yes, as long as the user scope settings allow Contributors to manage plugins for their own sessions, they retain this ability even if tenant scope is restricted to Owners only.

Yes, but creating a Playbook in Sentinel provides a managed experience and simplifies linking the logic app to specific incident types via Automation Rules.

Watchlists store static reference data (like trusted IPs) used in analytics queries, whereas Playbooks are automated workflows triggered by events to perform actions.

Attack Path Analysis automatically identifies and visualizes how multiple security issues can be chained into an attack path. Cloud Security Explorer allows you to manually create and run graph queries to explore your environment.

Yes, Attack Path Analysis works for Azure, AWS, and GCP subscriptions connected to Defender for Cloud when the CSPM plan is enabled.

No. The Security Copilot Contributor role only grants permissions to manage the Copilot platform itself. It does not provide access to the underlying data sources like Microsoft Sentinel. You must assign separate Azure RBAC roles to the data source.

The Contributor role at the Resource Group level grants management-plane access to all resources in the group, which is overly broad. It allows creating, updating, and deleting resources, violating the principle of least privilege. A workspace-specific Reader role is more precise.

Security Copilot uses on-behalf-of authentication. This means it accesses Sentinel data using the identity and permissions of the signed-in user. If the user lacks permissions in Sentinel, Copilot cannot retrieve the data either.

An App Registration is the definition of the application (including its metadata and permissions), while a Service Principal is the instance of that application within a specific tenant, used for authentication and authorization.

No, the service principal is automatically created when you register the application in the tenant. You only manage it if you need to configure specific access policies or secrets.

No. Azure SQL Server Entra Admin assignments only recognize direct members of the specified Microsoft Entra group. Nested group memberships are not resolved for this specific role.

If User2 were a direct member of Group1, they would gain the same management privileges as User1 for sqlsvr2, as the permission is tied to the group itself.

Global Secure Access is designed for zero-trust network access for users and devices, not for application-level telemetry and protection of AI agents within the Microsoft 365 ecosystem.

No. While the Entra app establishes trust, the Microsoft 365 app connector must be actively connected in the Defender portal to ingest the necessary telemetry for real-time analysis.