SC-500 Exam Dumps and Practice Questions

Configure just-in-time (JIT) VM access in Microsoft Defender for Cloud. JIT is specifically designed to keep management ports such as TCP 3389 for RDP closed and open them temporarily only after an authorized user requests access. Microsoft states that administrators can configure each protected port with its protocol, permitted source addresses, and a maximum request time. A 60-minute RDP access window therefore maps directly to the JIT mechanism. Microsoft Learn

Defender for Cloud manages the underlying network controls so that management access is restricted when it is not needed. When an authorized request is approved, Defender temporarily modifies the effective access rules for the requested source and duration. After the approved interval expires, access is closed again. This minimizes the VM's exposure to RDP scanning and brute-force attempts. Microsoft Learn

Microsoft Entra PIM controls privileged role activation, but it does not dynamically modify NSG rules for RDP. Azure Policy evaluates and enforces resource configuration but is not intended to grant temporary user-requested port access. Azure Bastion avoids exposing RDP directly but does not implement the stated 60-minute request-based NSG workflow.

SC-500 specifically requires candidates to enable and enforce just-in-time VM access.

Agentless scanning in Microsoft Defender for Servers needs to access managed disks that are encrypted with customer-managed keys. To decrypt these disks during scanning, the agentless scanning mechanism requires access to the keys stored in Key Vault. The solution involves:

• Granting Reader role to managed identities: Each VM's system-assigned managed identity needs Reader permissions on KV1 so the agentless scanner can access the encryption keys.
• Configuring Key Vault firewall: The Key Vault firewall must allow access from Azure services (which includes the Defender for Servers agentless scanning infrastructure) to permit key retrieval during scanning operations.

Without these configurations, the agentless scanner cannot access the customer-managed keys needed to decrypt and analyze the disks.

App1 can use private connectivity to SQL1 and storage1, but not to Function1 in the specified hosting plan.

Azure SQL Managed Instance supports Azure Private Link and private endpoints. Microsoft documents that a private endpoint exposes the managed instance through a private IP address in a selected virtual network, providing isolated connectivity to SQL Managed Instance without requiring its public endpoint. Microsoft Learn Azure Storage also supports private endpoints for its individual storage services, enabling applications with appropriate VNet connectivity and DNS resolution to reach storage over private IP addresses.

The differentiating resource is Function1. It runs on the legacy Azure Functions Consumption plan. Microsoft explicitly states that private endpoints for a Function App are supported on Flex Consumption, Elastic Premium, and Dedicated/App Service plans, but not on the Consumption plan. Microsoft Learn

App1 itself is hosted on a Premium App Service plan, which supports outbound virtual network integration. With that integration configured, App1 can route outbound connections through a virtual network to services exposed through private endpoints.

A private endpoint is the correct solution because it assigns a private IP address from an Azure virtual network to the Azure SQL logical server connection, allowing clients with connectivity to that virtual network to reach SQL Database without traversing the public endpoint. After the private endpoint is configured, public network access can be disabled on Server1, ensuring that database connectivity occurs exclusively through Azure Private Link. Microsoft specifically documents that App Service applications using VNet Integration can connect to Azure SQL Database through a private endpoint, provided DNS resolves the SQL server name to the private endpoint address.

A service endpoint does not satisfy the requirement because Azure SQL still exposes and uses its public service endpoint; the service endpoint only identifies and secures traffic originating from an authorized subnet. A Private Link service is used to privately expose a customer-owned service, typically behind a Standard Load Balancer, rather than to consume an existing Azure PaaS service such as Azure SQL. A routing table cannot provide Server1 with private PaaS connectivity.

The SC-500 study guide explicitly includes configuring Azure private endpoints to secure access to Azure PaaS resources under the Secure storage, databases, and networking domain.

Assign Key Vault Crypto Service Encryption User. This built-in Azure RBAC role is specifically designed for workloads that need to read key metadata and perform key wrap and unwrap operations. Microsoft describes the role as allowing an identity to read metadata for Key Vault keys and perform cryptographic wrap/unwrap operations. This matches the existing KeyVault1 permissions---Get, List, Wrap, and Unwrap---without providing unnecessary key-management privileges. Microsoft Learn

Microsoft also provides an explicit mapping from legacy Key Vault access policies to Azure RBAC roles. The access-policy combination Get, List, Wrap Key, and Unwrap Key maps to Key Vault Crypto Service Encryption User. Microsoft Learn

Key Vault Reader provides metadata-reading permissions but cannot perform the required wrap and unwrap operations. Key Vault Crypto User grants a broader collection of cryptographic operations than required. Key Vault Crypto Officer is significantly overprivileged because it can perform key-management operations such as creating, importing, deleting, and updating keys.