SC-500 Practice Online

You have an Azure subscription named Sub1 that contains an Azure Kubernetes Service (AKS) cluster named cluster1 and an Azure container registry named ACR1 Sub1 has Microsoft Defender for Containers enabled, and runtime protection is active on cluster!

The developers at your company deploy pods that have elevated privileges, and the deployments are created

in cluster1

You need to prevent pods with elevated privileges from being accepted by cluster!

What should you do?

You use Azure Virtual Network Manager to manage multiple virtual networks in a network group named

Group1

You discover that the virtual machines in Group1 are accessible from the internet by using TCP port 3389.

You need to block inbound TCP 3389 from the internet across all the virtual networks in Group1 The solution

must minimize administrative effort.

What should you use?

Note: This section contains one or more sets of questions with the same scenario and problem. Each question

presents a unique solution to the problem. You must determine whether the solution meets the stated goals.

More than one solution in the set might solve the problem. It is also possible that none of the solutions in the

set solve the problem.

After you answer a question in this section, you will NOT be able to return. As a result, these questions do not

appear on the Review Screen.

You have an Azure subscription that contains two virtual machines named VM1 and VM2. Each virtual

machine has system-assigned managed identity enabled.

You have an Azure Storage account named storage1. Public access from all networks is enabled for storage1.

You need to ensure that VM1 and VM2 can access storage1.

Solution: You add each virtual machine to a security group, and then add the security group to a role on

storage1.

Does this meet the goal?

You have an Azure SQL Database logical server named Server1 that contains multiple databases.

The databases contain legacy SQL authentication logins that must no longer be usable for sign-in but must

NOT be removed from the databases.

You need to ensure that SQL authentication is denied for connections.

What should you do?

You have an Azure subscription that has Microsoft Defender for Cloud enabled.

You have an Amazon Web Services (AWS) account connected to Defender for Cloud that has the Defender

Cloud Security Posture Management (CSPM) plan enabled.

You need to identify the potential impact of security incidents that exploit multiple risks reported by Defender

CSPM.

What should you use?