Microsoft Cloud and AI Security Engineer Associate (SC-500)

C is correct.

Explanation: Data storage location is immutable after workspace creation, so the existing US workspace cannot be changed to EU. You must create a new workspace and select Europe (EU) for data storage. Set prompt evaluation to Europe (EU) as well, so prompts are processed within European boundaries instead of routing globally through the Evaluate anywhere option.

A is incorrect: Owner settings manage capacity, data sharing, and file uploads, but data storage location is permanent after creation and cannot be edited there.

B is incorrect: Microsoft Support assists with renaming a workspace, but changing geographic storage requires creating a new workspace instead of opening a support ticket.

D is incorrect: Capacity association connects SCUs to the workspace and can be changed later, but it does not alter session data storage location.

D is correct.

Explanation: Routing intent in Virtual WAN specifies which traffic types must route through the Secured Virtual Hub firewall. Setting the private traffic next hop to Azure Firewall instructs the platform to automatically program route tables across all connected branches and spokes. This inspects branch-to-spoke, spoke-to-spoke, and branch-to-branch flows without requiring administrators to maintain manual user-defined routes.

A is incorrect: Deploying Azure Firewall into a virtual hub automatically manages the subnet, while manual UDR configuration applies to standard virtual network hub-and-spoke deployments.

B is incorrect: NSG rules evaluate packets by port and IP at the subnet level, but they cannot centrally route Virtual WAN traffic through firewalls.

C is incorrect: DNAT rules translate inbound public internet traffic to private workload IPs, rather than routing internal branch-to-spoke private traffic across the hub.

A is correct.

Explanation: Service endpoints do not enforce tenant boundaries, allowing a compromised virtual machine to communicate with any storage account across tenants. In contrast, a private endpoint provides targeted resource access. It connects solely to a specific resource instance, ensuring that traffic routes only to the authorized Contoso storage account rather than attacker-controlled accounts.

B is incorrect: Firewall IP restrictions on Contoso's account affect only that resource and do not prevent outbound data transfers to external accounts.

C is incorrect: Adding service endpoints across more subnets still allows connections to any Azure Storage account, leaving cross-tenant exfiltration paths wide open.

D is incorrect: Requiring multi-factor authentication secures identity access to Contoso's account but does not restrict outbound network connections to external tenant storage.

D is correct.

Explanation: When malware scanning reaches the monthly cap, scanning stops for the rest of the month, so later uploads are not scanned. The default cap is 10,000 GB per storage account. Set the cap based on actual upload volume and risk tolerance. You configure it in the Defender for Storage plan settings, and account-level settings take precedence over subscription defaults.

A is incorrect: Sensitive data threat detection prioritizes alerts for resources that contain sensitive data. It does not change the malware scanning cap.

B is incorrect: Activity monitoring already runs automatically and does not scan uploaded blobs for malware, so it cannot fill the gap.

C is incorrect: Disabling malware scanning removes scanning for all uploaded blobs, which creates a larger detection gap than the cap does.

B is correct.

Explanation: SQL Managed Instance uses the TO EXTERNAL_MONITOR clause to direct audit records into Azure's diagnostic pipeline. Completing the routing to Log Analytics requires navigating to Monitoring, opening Diagnostic settings on the managed instance, creating a diagnostic setting that enables the SQLSecurityAuditEvents log category, and selecting the target Log Analytics workspace.

A is incorrect: A SQL credential containing a SAS token is required only for blob storage destinations using TO URL, not for Log Analytics integration.

C is incorrect: Creating an audit with TO URL routes extended event files to blob storage, failing to send telemetry to the Log Analytics workspace.

D is incorrect: The portal auditing screen for SQL Managed Instance covers storage destinations; routing to Log Analytics requires T-SQL and portal diagnostic settings.

A is correct.

Explanation: Private endpoints need DNS configuration so the storage account name resolves to the private IP address. The Azure portal creates the private DNS zone automatically, but with Azure CLI, PowerShell, or Bicep you create the zone and records manually. For blob storage, use privatelink.blob.core.windows.net. Link the virtual network to the zone, as the portal does.

B is incorrect: A virtual network rule controls public endpoint access from a subnet. It does not change DNS resolution for the account name.

C is incorrect: A service endpoint uses the public IP address and DNS resolves to it. It does not provide private endpoint name resolution.

D is incorrect: Each storage service needs its own private endpoint. A file endpoint does not fix name resolution for the blob endpoint.

D is correct.

Explanation: Exportable certificates allow the private key to be retrieved as a PFX or PEM file, which workloads need when they can't call the Key Vault API. HSM-backed keys are nonexportable by design, so a software-backed RSA or EC key is required. Restrict access carefully, because anyone who can export the certificate can extract the private key from the vault.

A is incorrect: HSM-backed keys are nonexportable by design, so HSM protection and export are mutually exclusive for RSA and EC certificates.

B is incorrect: An HSM-backed nonexportable certificate keeps the private key in the vault, so the workload can't retrieve a PFX file as required.

C is incorrect: A nonexportable certificate keeps the private key in the vault. The workload can't call the API, so it can't use the certificate.

B is correct.

Explanation: Deploying a private endpoint assigns App Service a private IP address within a virtual network subnet. Setting Public network access to Disabled eliminates the internet-facing endpoint entirely. Application Gateway receives incoming public traffic, inspects requests with WAF, and securely forwards approved requests to the App Service private endpoint over the virtual network address space.

A is incorrect: Access restrictions filter inbound sources by IP or service tag, but the App Service public endpoint remains active and reachable from the internet.

C is incorrect: HTTPS Only and TLS 1.2 enforce secure transport protocols. They do not disable public network access or provide private connectivity through virtual networks.

D is incorrect: Regional VNet integration provides private outbound access to virtual network resources. It does not establish private inbound endpoints or remove public access.

A is correct.

Explanation: Azure evaluates network security group rules sequentially in priority order from lowest to highest number. When critical deny rules are placed at priority 200, administrators could later insert conflicting allow rules with lower numbers like 150. Reserving the 100 to 199 range strictly for deny rules guarantees that essential security boundaries evaluate before any allow rules.

B is incorrect: Placing allow rules in the 100 to 199 range causes Azure to evaluate and permit traffic before checking deny rules.

C is incorrect: Priority 4096 represents the highest possible custom priority number, meaning all earlier custom allow rules would be evaluated first.

D is incorrect: Stacking NIC-level NSGs adds troubleshooting complexity and conflicts, rather than establishing a predictable priority hierarchy on the subnet NSG.

C is correct.

Explanation: Azure Private Link Service exposes custom internal services rather than standard PaaS resources, so Azure provides no automatic DNS zone integration. The consumer organization must manually configure a private DNS A record for the FQDN used by their application. This record points directly to the private endpoint's IP address, directing application traffic to the private network interface.

A is incorrect: Automatic DNS zone registration applies only to standard Azure PaaS services, not to custom applications exposed through Azure Private Link Service.

B is incorrect: The alias serves strictly as a connection routing identifier; generating a new alias cannot create the necessary DNS resolution records.

D is incorrect: The NAT subnet is configured exclusively on the provider side to perform SNAT, not within the consumer's network to manage routing.