Microsoft SC-500 Actual Tests : Implementing End-to-End Security Controls for Cloud and AI Workloads

You have a Microsoft Entra tenant that contains a user named User1.
You have an Azure Arc-enabled server named SRV1 that runs Windows Server. SRV1 is configured for Microsoft Entra sign-in.
User1 reports that when they use their Microsoft Entra credentials to sign in to SRV1 over RDP, they receive the following message:
"Your account is configured to prevent you from using this device."
You need to ensure that User1 can sign in to SRV1 over RDP. The solution must follow the principle of least privilege.
What should you do?

• A. Assign User1 the Virtual Machine Administrator Login role for SRV1.
• B. Assign User1 the Virtual Machine User Login role for SRV1.
• C. Create a Conditional Access policy that requires multifactor authentication (MFA).
• D. Add User1 to the local Remote Desktop Users group on SRV1.

You have an Azure Storage account named storage1 that hosts a blob container used by an internal application. You plan to enable a third-party workflow system to upload blobs to storage1. You need to provide time-bound, least-privilege upload access to the third-party system.
Which authorization method should you use?

• A. Enable a managed identity for the workflow system and assign a role for storage1.
• B. Enable anonymous public read access for the blob container.
• C. Configure the workflow system to use a user delegation shared access signature (SAS).
• D. Configure the workflow system to use Shared Key authorization.

You have an Azure subscription that contains the virtual networks shown in the following table.

NSG1 and NSG2 both have default rules only.
The subscription contains the virtual machines shown in the following table.

You need to configure Server1 to meet the technical requirements.
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

You have an Azure subscription named Sub1 that contains a resource group named RG1.
RG1 contains a virtual network named VNet1 and a storage account named storage1. Several engineers are assigned the Owner role for Sub1.
You need to prevent updates to and deletions from VNet1. The solution must ensure that engineers can continue updating other resources in RG1.
Which lock should you apply?

• A. a Delete resource lock at the RG1 scope
• B. a Read-only resource lock at the VNet1 scope
• C. a Read-only resource lock at the RG1 scope
• D. a Delete resource lock at the VNet1 scope