Microsoft Cloud and AI Security Engineer Associate (SC-500)

B is correct.

Explanation: Enterprise Policy as Code (EPAC) is an open-source PowerShell module designed to manage Azure Policy definitions and assignments at management group scale. It enables teams to define policy assignments in JSON files, deploy them through a single CI/CD pipeline, and track desired state by detecting drift between source-controlled code and actual assigned Azure configurations.

A is incorrect: Template Analyzer and Checkov are static analysis engines that inspect IaC templates for misconfigurations, rather than deploying or reconciling Azure Policy assignments.

C is incorrect: Agentless scanning detects template vulnerabilities across repositories every 24 hours, but it cannot deploy policy assignments or monitor governance configuration drift.

D is incorrect: The Microsoft Security DevOps extension executes security scanners inside pipelines, but it does not orchestrate Azure Policy desired state across management groups.

A is correct.

Explanation: Microsoft Entra ID enforces stricter SSPR protections for administrators, requiring two authentication methods for password resets. For privileged groups, Microsoft recommends combining strong methods such as Microsoft Authenticator with phone-based verification while avoiding security questions, which are disallowed for administrator resets, and avoiding email verification to prevent escalation through mailbox compromise.

B is incorrect: Administrator accounts strictly require two authentication methods to complete a password reset, making a single-method policy configuration insufficient regardless of the method chosen.

C is incorrect: Security questions are not permitted for administrator reset scenarios, and email reset is not recommended because compromised mailboxes can lead to account takeover.

D is incorrect: FIDO2 security keys and passkeys serve strictly as sign-in credentials and are ineligible for use in self-service password reset verification challenges.

A is correct.

Explanation: Microsoft Security Copilot ensures that data provided by an organization remains accessible exclusively to that organization. Customer data is safeguarded by comprehensive enterprise compliance and security controls. Crucially, Microsoft does not use customer organizational data or prompt submissions to train foundation AI models, thereby satisfying enterprise governance, regulatory compliance, and organizational data privacy requirements.

B is incorrect: Copilot integrates threat intelligence feeds to inform its models, but it never publishes customer prompts or internal telemetry to external intelligence feeds.

C is incorrect: Customer data is strictly isolated to the customer organization rather than pooled or shared across tenant caches to train models for others.

D is incorrect: While data is protected, Copilot maintains session context rather than instantly discarding data, and model protection does not require immediate session deletion.

C is correct.

Explanation: The evidence supports C because implementing Azure Lighthouse provides the option to enable administrative access to customer tenants. Once Azure Lighthouse is successfully onboarded, authorized users sign in to the service provider's tenant and use the directory + subscription selector in the Azure portal to select and manage customer subscriptions without having to log in to separate accounts.

A is incorrect: Workspace manager centrally consolidates and publishes content items from a central workspace to member workspaces, but it does not enable multi-tenant portal delegation.

B is incorrect: Automation Contributor is a service-oriented role that allows Sentinel to add playbooks to automation rules, rather than granting multi-tenant user access.

D is incorrect: Assigning Microsoft Sentinel Reader in customer tenants still requires analysts to authenticate into each separate customer tenant account directly.

A is correct.

Explanation: Azure Container Apps provides built-in authentication middleware, commonly referred to as EasyAuth, which intercepts unauthenticated incoming requests and redirects users to sign in with Microsoft Entra ID. Because the platform middleware intercepts traffic before it reaches your container code, you enforce identity authentication at the platform layer without writing custom authentication logic in the application.

B is incorrect: IP security restrictions filter network requests based on client source IP addresses, but they do not enforce user identity verification or sign-in.

C is incorrect: A managed identity grants the Container App permissions to access Azure resources, but it does not authenticate incoming external API user traffic.

D is incorrect: Setting ingress to internal blocks public internet traffic, preventing external customer access rather than requiring user identity authentication for public API endpoints.

D is correct.

Explanation: Integrated agent routing is tenant-wide, so Defender XDR requests from all users route to the SOC workspace. Any user who lacks Contributor or Owner access to that specific workspace encounters an error. Assigning the analyst the Contributor role grants permission to use Security Copilot without modifying routing for other users and avoids granting unnecessary administrative privileges.

A is incorrect: Plugins determine data sources available within a workspace, but enabling them does not grant users permission to access the workspace.

B is incorrect: Overage SCUs help when provisioned capacity is exhausted, but utilization is normal here, so capacity exhaustion is not the cause.

C is incorrect: Agent routing is tenant-wide, so changing it affects all Defender XDR users, and the analyst could still lack access to that destination.

A is correct.

Explanation: Passkeys in Microsoft Authenticator provide mobile and cross-platform users with portable, phishing-resistant passwordless credentials. These credentials are hardware-backed on the mobile device and unlocked using local biometrics or a PIN. Administrators enable this method by configuring the Passkey (FIDO2) authentication method policy in Microsoft Entra ID and scoping it to the target user groups.

B is incorrect: Windows Hello for Business is recommended specifically for corporate Windows devices managed by Intune or Group Policy, rather than cross-platform mobile environments.

C is incorrect: Synced passkeys trade enterprise control for personal device convenience and are intended for lower-risk general users rather than managed corporate cross-platform deployments.

D is incorrect: Microsoft Authenticator push notifications represent an app-based multifactor authentication method paired with passwords, rather than a passwordless hardware-backed passkey credential.

C is correct.

Explanation: A ReadOnly lock prevents deletion and modification, and Azure treats listing storage keys as a write action, causing the operation to fail. A Delete lock prevents resource deletion while allowing all read and write operations. Replacing the ReadOnly lock with a Delete lock restores storage key access while keeping the storage account protected from accidental deletion.

A is incorrect: Resource locks override all RBAC role assignments, including Owner, so assigning Owner to the application identity still blocks key listing operations.

B is incorrect: Resource locks applied to a resource group are inherited by child resources, so moving the ReadOnly lock still blocks key listing.

D is incorrect: The Contributor role allows managing resources, but locks override RBAC roles, so key listing remains blocked until the ReadOnly lock is changed.

C is correct.

Explanation: A system-assigned managed identity gives the Function app a Microsoft Entra identity that Azure manages, so no connection string is stored or rotated. Assigning Cosmos DB Built-in Data Contributor grants the needed data access. DefaultAzureCredential in the code then picks up the Function app's managed identity at runtime, so the application setting can be removed.

A is incorrect: Function keys gate access to function endpoints for inbound callers. They do not provide outbound authentication to Cosmos DB database accounts.

B is incorrect: Key Vault Secrets User reads secrets from Key Vault. It is not the recommended role for granting Cosmos DB data plane access.

D is incorrect: EasyAuth controls who can invoke the function. It does not change how the function authenticates to Cosmos DB, so the string remains.

B is correct.

Explanation: An autonomous agent authenticates with the OAuth 2.0 client credentials flow, so the agent identity is the token subject. Conditional Access must target the agent service principal under Users, agents or workload identities. For these policies, Agent risk is the only condition and Block access is the only control. The policy evaluates at token issuance.

A is incorrect: A user-targeted policy that requires MFA misses the enforcement point, because no user is present and the agent is the token subject.

C is incorrect: A group policy applies to users, and device compliance cannot be enforced for autonomous agents because no device is registered.

D is incorrect: A user account assignment applies only when the agent authenticates as a user-type identity, not as a service principal with client credentials.