Microsoft Cloud and AI Security Engineer Associate (SC-500)

B is correct.

Explanation: When the plan is on, Defender for Cloud automatically discovers all AKS clusters in the subscription. It uses Azure Resource Manager APIs to enumerate them, then autoprovisions the Defender sensor and Azure Policy add-on based on the plan's autoprovisioning settings. New clusters need no manual enrollment. It needs no separate agent install.

A is incorrect: Manual enrollment of clusters is not required, because Defender for Containers discovers clusters in the subscription automatically after you enable the plan.

C is incorrect: Manual DaemonSet installation is unnecessary because autoprovisioning deploys the Defender sensor as an AKS Security profile on discovered clusters.

D is incorrect: Disabling and re-enabling the plan is unnecessary because resources added to the subscription are included in coverage automatically with no more configuration.

D is correct.

Explanation: Storing the certificate in Key Vault and granting the API Management managed identity the Key Vault Secrets User role enables automated certificate management. Referencing the Key Vault certificate identifier ensures API Management retrieves renewed versions automatically, eliminating manual file uploads, configuration redeployment, and service downtime across multiple environments for outbound backend connections.

A is incorrect: Manually uploading renewed PFX files to multiple environments maintains an operational maintenance burden and does not achieve automated certificate rotation.

B is incorrect: The validate-client-certificate policy validates incoming certificates on inbound caller requests, rather than managing certificates presented outbound by the gateway to backend services.

C is incorrect: The role assignment must be granted to the API Management managed identity rather than external partner applications to access the vault.

A is correct.

Explanation: The Function app resolves Key Vault references at startup. Because the vault is restricted to a private endpoint, the app needs a network path to it, and virtual network integration provides that outbound path. Without it, the app can't resolve the reference and fails to start. Configure the integration before adding the references. The role assignment alone does not provide that path.

B is incorrect: A private endpoint controls inbound access. It does not give the app an outbound network path to the vault.

C is incorrect: Omitting the version makes the app resolve the latest secret version. It does not create a network path to the vault.

D is incorrect: EasyAuth controls who can invoke the function. It does not affect how the Function app reaches the vault when it resolves references.

A is correct.

Explanation: When Application Gateway forwards requests to App Service, the Host header must match the App Service hostname. Otherwise, App Service returns an HTTP 404 error or a certificate mismatch. Enabling Pick host name from backend target automatically sets the forwarded Host header to the App Service domain name, allowing App Service to route incoming requests correctly.

B is incorrect: Detection mode logs rule evaluations without blocking requests. It does not rewrite request Host headers, so App Service still returns HTTP 404 errors.

C is incorrect: Adding an allow rule for 0.0.0.0/0 exposes App Service directly to the public internet. It does not resolve the backend Host header mismatch.

D is incorrect: Selecting Use well-known CA certificate validates backend certificates. It does not adjust the forwarded Host header required by App Service to identify the host.

A is correct.

Explanation: Defender for Servers allows overriding subscription-level plan settings at the resource group level. Configuring Plan 2 at subscription scope ensures production workloads receive premium protections like File Integrity Monitoring. Applying Plan 1 to development and test resource groups provides Defender for Endpoint integration and agent-based vulnerability assessment while lowering costs across non-production environments.

B is incorrect: Configuring Plan 1 at the subscription while assigning Plan 2 to test environments unnecessarily inflates non-production costs while stripping production machines of File Integrity Monitoring.

C is incorrect: Excluding virtual machines removes all Defender for Servers protections entirely, eliminating vulnerability scanning, threat detection, and endpoint protection required by development environments.

D is incorrect: File Integrity Monitoring is an exclusive capability of Plan 2, so a Plan 1 subscription tier cannot provide it to production workloads.

A is correct.

Explanation: Defender for Cloud autoprovisions the Microsoft Defender for Endpoint extension by default when Defender for Servers is enabled. To deploy the sensor selectively via an alternative tool such as Microsoft Intune, you navigate to Environment Settings > Settings & Monitoring > Endpoint protection and toggle autoprovisioning to Off, assuming responsibility for manual deployment.

B is incorrect: Disabling agentless scanning disables offline snapshot analysis for vulnerabilities, secrets, and malware, but it does not prevent automatic provisioning of the Defender for Endpoint extension.

C is incorrect: Excluding virtual machines removes all Defender for Servers protections entirely, including threat detection and security recommendations, rather than merely allowing custom agent installation via Intune.

D is incorrect: Defender for Servers Plan 1 also includes Defender for Endpoint integration and autoprovisions the extension, so switching plan tiers will not stop automated sensor deployments.

D is correct.

Explanation: Configuring the extensions allow list with the special value Allow/None enables zero-extension mode on the Azure Connected Machine agent. In this configuration, the agent maintains ongoing connectivity to Azure to facilitate Extended Security Updates delivery, but it locally rejects all extension installation requests regardless of permissions granted to privileged Azure users.

A is incorrect: Monitor mode permits Microsoft-managed security and monitoring extensions to install on the machine, which contradicts the requirement to refuse all extension requests.

B is incorrect: Configuring a block list prohibits only the specified extension while permitting all other extensions to install, failing to enforce zero-extension mode.

C is incorrect: Specifying this allow list permits the Defender for Endpoint extension to install on the server, which fails to block every extension deployment attempt.

C is correct.

Explanation: In this architecture, Easy Auth validates the access token, and the Azure Functions runtime rejects requests lacking a valid token before they reach function code. However, Easy Auth does not verify required scopes. Therefore, your custom handler code must decode the token and ensure the scp claim contains the expected scope.

A is incorrect: Easy Auth is responsible for validating incoming access tokens, so adding redundant signature validation logic to handler code is unnecessary.

B is incorrect: While Easy Auth validates incoming access tokens, it does not validate required scopes, making scope verification inside the handler function mandatory.

D is incorrect: Listing scopes in the OpenAPI specification document is purely informational; the API implementation remains responsible for checking that tokens contain required scopes.

A is correct.

Explanation: File Integrity Monitoring in Plan 2 relies on two complementary data sources to provide comprehensive protection. The Microsoft Defender for Endpoint agent sensor monitors files continuously to detect changes in real time, while agentless scanning extends monitoring to custom file paths and supplies a daily validation layer that detects tampering even if the agent is disabled.

B is incorrect: Operating File Integrity Monitoring with the agent alone fails to provide the offline daily validation layer needed if an attacker disables the local sensor, and lacks custom path extension.

C is incorrect: Software inventory merely catalogs installed software components during daily snapshots; it does not provide real-time alerting or track unauthorized file modifications within custom application directories.

D is incorrect: The Microsoft Defender for Endpoint agent is a core prerequisite for File Integrity Monitoring and provides real-time detection, which cannot be achieved using once-daily agentless scanning alone.

A is correct.

Explanation: Enabling JIT from the Not configured tab in Defender for Cloud applies the full default Windows policy covering RDP port 3389 and WinRM ports 5985 and 5986. Enabling JIT from the individual VM Configuration page includes only port 3389 by default, so administrators must use the Defender for Cloud interface or programmatic methods.

B is incorrect: Enabling JIT repeatedly from the VM Configuration blade continues to apply only the single-port default configuration containing port 3389 for Windows machines.

C is incorrect: Azure Policy audits virtual machines lacking JIT protection using the AuditIfNotExists effect, but it does not enable JIT or customize port policies.

D is incorrect: Azure Bastion provides browser-based administrative access to virtual machines, but it does not configure JIT policies or add default WinRM protection.