Cloud and AI Security Engineer (SC-500) Exam Questions

Correct answer: B
PIM role settings let administrators require justification, multifactor authentication, and approver sign-off before an eligible assignment can be activated, enforcing just-in-time access with governance controls.

Why other options are incorrect
A. Access reviews periodically recertify who still needs an assignment; they don’t gate the activation process itself.
C. A permanent eligible assignment only changes whether the assignment expires — it adds no activation requirements.
D. Conditional Access App Control governs session monitoring for cloud apps and has no connection to PIM role activation.

Source: What is Privileged Identity Management? - Microsoft Entra ID Governance

Correct answer: C
Authentication strength is a Conditional Access grant control that lets administrators specify which exact combinations of authentication methods satisfy the policy; the built-in “Phishing-resistant MFA” strength only accepts methods like FIDO2 security keys, Windows Hello for Business, and certificate-based authentication.

Why other options are incorrect
A. A generic “require MFA” control accepts any registered MFA method, including weaker options like SMS or voice call.
B. Device compliance validates the device’s configuration state but says nothing about which authentication method was used.
D. Sign-in frequency controls how often a session must re-authenticate; it doesn’t restrict which authentication method is acceptable.

Source: Overview of Conditional Access authentication strengths

Correct answer: B
Consenting to a multi-tenant app creates a service principal — visible as an enterprise application — in the consenting tenant; this local service principal references the app and holds the permissions granted in that tenant, while the app registration object itself continues to exist only in the publisher’s home tenant.

Why other options are incorrect
A. App registrations are not duplicated across tenants; only a service principal is created locally.
C. Consent does not automatically create any Conditional Access policy.
D. Managed identities let Azure resources authenticate to Entra ID; they have nothing to do with a third party’s multi-tenant app consent.

Source: Applications and service principal objects in Microsoft Entra ID

Correct answer: B
User consent settings in Microsoft Entra ID directly control whether end users can grant consent on their own; setting this to “Do not allow user consent,” or allowing consent only for permissions classified as low-risk, stops a non-admin from single-handedly authorizing an app that requests high-privilege permissions.

Why other options are incorrect
A. The admin consent workflow only comes into play after user consent has already been restricted — it lets a blocked user submit a request, it doesn’t itself block anything.
C. Security defaults enforce baseline sign-in protections like MFA; they don’t govern application consent behavior.
D. An access review recertifies existing assignments after the fact; it doesn’t stop the initial consent grant.

Source: Overview of user and admin consent - Microsoft Entra ID

Correct answer: B
A user-assigned managed identity is created as its own standalone Azure resource with a lifecycle independent of any single resource it’s attached to, so it can be assigned to many resources at once and reused, and deleting one resource does not delete or affect the identity.

Why other options are incorrect
A. A system-assigned identity’s lifecycle is tied directly to its resource — it would require 20 separate identities and role assignments, and deleting any Automation account deletes its identity.
C. A service principal with a client secret reintroduces the exact credential-storage and rotation burden that managed identities are designed to eliminate.
D. Managing certificates per Automation account adds operational overhead and isn’t a managed identity mechanism at all.

Source: Managed identities for Azure resources - Overview

Correct answer: B
Switching Key Vault to the Azure RBAC permission model provides granular, built-in data-plane roles scoped to a specific object type (such as Key Vault Secrets User for secrets only), supports Azure RBAC conditions, and — unlike vault access policies — records role assignment changes in the Azure Activity Log.

Why other options are incorrect
A. Vault access policies remain an all-or-nothing grant per object type (keys, secrets, or certificates); they cannot restrict access to secrets alone with the same granularity, and assignment changes aren’t tracked the same way in Activity Log.
C. SAS tokens are an Azure Storage concept and don’t apply to Key Vault at all.
D. Conditional Access governs sign-in conditions, not fine-grained authorization to specific secrets inside a vault.

Source: Azure role-based access control (Azure RBAC) vs. access policies

Correct answer: B
Key Vault’s firewall includes an explicit trusted-services exception: enabling it lets specific first-party Microsoft services on Microsoft’s trusted list reach the vault even when the default action is Deny, without opening the vault to arbitrary public traffic.

Why other options are incorrect
A. Allowing 0.0.0.0/0 opens the vault to the entire internet, defeating the purpose of the firewall.
C. Disabling the firewall removes all network protection, not just the block on trusted services.
D. A private endpoint alone doesn’t restore the service-to-service trust relationship these first-party services rely on, and removing all rules is unnecessary and overly permissive.

Source: Configure network security for Azure Key Vault

Correct answer: A
A “list secrets” call immediately followed by “get secret” calls against most or all of the returned secrets is a hallmark of an attacker enumerating and exfiltrating as many credentials as possible after compromising a principal that has vault access; Defender for Key Vault specifically raises an alert for this listing-and-query anomaly pattern.

Why other options are incorrect
B. Key Vault authorizes callers using Microsoft Entra tokens, not passwords checked against access policies, so this isn’t a brute-force scenario.
C. A backup operation doesn’t produce a mass list-then-get-everything pattern and wouldn’t trigger this anomaly detection.
D. A DDoS attack is characterized by high-volume network requests intended to exhaust resources, not targeted, sequential secret retrieval.

Source: Alerts for Azure Key Vault - Microsoft Defender for Cloud

Correct answer: C
The DeployIfNotExists effect evaluates a resource and, when the required related configuration (such as an auditing setting) is missing, uses the managed identity assigned to the policy to deploy it — all without blocking or altering the original resource creation request.

Why other options are incorrect
A. Deny would block the resource from being created at all if it doesn’t already meet the condition, which isn’t the desired outcome here.
B. Audit only records a non-compliance flag for reporting; it never deploys or remediates anything.
D. Disabled means the policy definition doesn’t get evaluated at all.

Source: Azure Policy definitions - the deployIfNotExists effect

Correct answer: B
A ReadOnly lock restricts every authorized user — regardless of their RBAC role — to Reader-level behavior on the control plane; because List Keys is implemented as a POST operation, a ReadOnly lock blocks it, whereas a CanNotDelete lock would still allow it.

Why other options are incorrect
A. Resource locks add a separate restriction layer on top of RBAC; they never modify or remove role assignments.
C. ReadOnly locks block both modification and deletion operations, not just deletes — CanNotDelete is the lock type limited to blocking deletion.
D. Storage firewall rules govern data-plane network access to blob/file/queue/table endpoints, not the control-plane management API call used to list account keys.

Source: Lock your Azure resources to protect your infrastructure

Correct answer: B
Microsoft Entra custom roles are built from directory-level allowed resource actions (such as managing applications or Conditional Access policies) and are assigned at the Microsoft Entra tenant scope, governing directory administrative tasks rather than Azure Resource Manager resources.

Why other options are incorrect
A. Azure custom roles are built from Actions/DataActions against Azure Resource Manager providers (VMs, storage, networking, etc.) and are scoped to management groups, subscriptions, or resource groups — they cannot grant permissions over directory objects like app registrations or Conditional Access policies.
C. Owner scoped to a resource group grants broad Azure resource management rights, not Microsoft Entra directory administration, and is far more permissive than required.
D. Key Vault access policies only control access to keys, secrets, and certificates inside a specific vault.

Source: Overview of Microsoft Entra role-based access control (RBAC)

Correct answer: B
Multi-user authorization, enforced through a Resource Guard deployed in a subscription or tenant separate from the vault, requires approval from an independent security administrator — via Microsoft Entra PIM — before critical operations such as disabling soft delete, removing MUA protection, or deleting backup data can succeed, enforcing separation of duties.

Why other options are incorrect
A. Cross Region Restore is a disaster-recovery capability for restoring backups in a secondary region; it provides no approval workflow.
C. Immutable storage for blobs prevents deletion of blob data but doesn’t provide the cross-tenant approval gate that MUA does for Recovery Services vault operations.
D. Customer-managed keys protect control over the encryption key, not the ability of an admin to disable soft delete or delete backups.

Source: Configure Multi-user authorization using Resource Guard - Azure Backup

Correct answer: B
A stored access policy defines shared constraints (start time, expiry, permissions) for a container, queue, table, or file share; when a service SAS is tied to that policy, revoking access is as simple as modifying or deleting the policy — instantly invalidating every SAS associated with it, without needing to regenerate the storage account keys.

Why other options are incorrect
A. Issuing a new account SAS doesn’t revoke the tokens that were already handed out to partners.
C. Firewall IP rules control network-level reachability of the storage account, not the validity of already-issued SAS tokens.
D. A private endpoint changes how the storage account is reached over the network; it has no effect on outstanding SAS token validity.

Source: Grant limited access to data with shared access signatures (SAS)

Correct answer: A
Before any network rules are configured, an Azure Storage account allows connections from any network over its public endpoint; configuring network rules is what switches the account to a default-deny posture where only explicitly allowed sources (IP rules, virtual network rules, or trusted service exceptions) can connect.

Why other options are incorrect
B. This describes the account’s behavior only after network rules have been configured, not the default state.
C. Storage account network access isn’t restricted by region by default.
D. Virtual network access to a storage account requires an explicitly enabled service endpoint or private endpoint — it isn’t automatic for peered networks, and it isn’t the account’s default state either.

Source: Azure Storage firewall rules and network access

Correct answer: A
On-upload malware scanning automatically scans a blob using the Microsoft Defender Antivirus engine as soon as it’s uploaded or modified, and by default writes two blob index tags — the scan result (such as “No threats found” or “Malicious”) and the scan time — directly on the blob.

Why other options are incorrect
B. On-demand scanning is for scanning existing blobs on request (for baselines, investigations, or compliance), not for automatically scanning newly uploaded files in near real time.
C. Activity monitoring alerts flag anomalous access patterns; they don’t perform content-level malware scanning of individual blobs.
D. Azure Policy guest configuration applies to VM operating system settings — storage accounts don’t have a guest configuration extension.

Source: Malware scanning in Microsoft Defender for Storage

Correct answer: A
TDE is enabled by default on all newly created Azure SQL databases and performs real-time encryption/decryption of the database files, transaction log, and associated backups at rest; the TDE protector (encryption key) is managed at the logical server level and inherited by every database on that server unless overridden.

Why other options are incorrect
B. Always Encrypted protects specific sensitive columns end-to-end (including in memory and in transit) using client-side keys — it’s a separate, opt-in feature from at-rest database encryption, not a prerequisite for it.
C. Dynamic Data Masking only obscures values in query results for non-privileged users; it never encrypts or changes the underlying stored data.
D. TDE with a Microsoft-managed key is on by default; a customer-managed key is an optional enhancement (bring your own key), not a prerequisite for encryption to exist at all.

Source: Transparent Data Encryption for SQL Database, SQL Managed Instance, and Azure Synapse Analytics

Correct answer: B
Server-level and database-level auditing policies are independent: if server auditing is enabled, it always applies to the database regardless of the database-level setting, so enabling both results in the database being audited twice in parallel, each writing to its own configured destination. Microsoft recommends enabling only server-level auditing unless a database genuinely needs a distinct destination or event scope.

Why other options are incorrect
A. Database-level auditing does not override or replace server-level auditing — both remain active simultaneously.
C. Enabling database-level auditing has no effect on the server-level policy or other databases.
D. Azure does not block combining both policies; it explicitly supports running them together, even though Microsoft advises against it unless there’s a specific need.

Source: Auditing policy at the server and database level - Azure SQL Database

Correct answer: A
SQL vulnerability assessment, part of Defender for Databases protection for Azure SQL, runs recurring scans that surface deviations from security best practices (such as excessive permissions, missing auditing, or vulnerable configurations) and provides remediation scripts and guidance for each finding.

Why other options are incorrect
B. Dynamic Data Masking only limits what non-privileged users see in query results; it performs no configuration or vulnerability assessment.
C. Auditing records what activity occurred; it does not proactively assess configuration for known vulnerabilities.
D. Conditional Access controls sign-in conditions for Microsoft Entra identities; Azure SQL’s native authentication and configuration weaknesses aren’t evaluated by it.

Source: Scan your Azure SQL databases for vulnerabilities

Correct answer: B
Application security groups let you group VM network interfaces by application role (for example, “WebServers” or “DbServers”) and then reference those groups directly as the source or destination of an NSG rule, so rules stay valid even as the underlying VM IP addresses change.

Why other options are incorrect
A. Azure Virtual Network Manager network groups operate at the virtual network level for centralized security admin rules and connectivity configurations — they aren’t the mechanism used inside a single NSG’s own rules.
C. Azure Firewall DNAT rules translate and forward inbound traffic through a centralized firewall; they don’t group VMs for NSG rule authoring.
D. Private Link provides private connectivity to a service; it has nothing to do with grouping VMs for NSG rules.

Source: Network security groups and application security groups

Correct answer: A
Security admin rules are evaluated before NSG rules and have higher priority; an “Always Allow” action terminates evaluation immediately once matched, meaning the traffic is allowed and is never subsequently evaluated — or blocked — by any NSG rule.

Why other options are incorrect
B. Security admin rules are evaluated first, not NSG rules; NSGs only get a chance to evaluate traffic that a security admin rule’s “Allow” (not “Always Allow” or “Deny”) action left open.
C. There is a deterministic outcome — Azure Virtual Network Manager’s admin rules define a strict priority order, not an unresolved conflict.
D. Security admin rules apply regardless of whether an NSG is present on the subnet; they operate at the virtual network level independently of subnet-level NSGs.

Source: Security admin rules in Azure Virtual Network Manager

Correct answer: A
A secured virtual hub is a Virtual WAN hub with Azure Firewall (or a supported third-party security provider) deployed directly inside it and managed through Azure Firewall Manager, allowing centralized routing and inspection of both internet and inter-spoke traffic without a separate firewall VNet.

Why other options are incorrect
B. A secured hub virtual network is the equivalent pattern for a traditional (non-Virtual WAN) hub-and-spoke topology, where Azure Firewall sits in a standard hub VNet — not a Virtual WAN hub.
C. TLS inspection is a Premium SKU feature of Azure Firewall itself; it isn’t the concept that describes hub placement within Virtual WAN.
D. NSG flow logs record traffic hitting an NSG; they’re unrelated to firewall placement architecture in Virtual WAN.

Source: What is a secured virtual hub?

Correct answer: A
Azure VPN Gateway supports configuring a custom IPsec/IKE policy on a specific S2S or VNet-to-VNet connection, letting you specify exact IKE (Main Mode/Phase 1) and IPsec (Quick Mode/Phase 2) encryption, integrity, PFS group, and SA lifetime parameters so both ends of the tunnel can successfully negotiate a match.

Why other options are incorrect
B. Upgrading the Gateway SKU changes throughput and connection limits; it doesn’t change which cryptographic algorithms are proposed during negotiation.
C. Threat intelligence filtering on Azure Firewall inspects traffic for known-malicious indicators; it has no role in IKE/IPsec algorithm negotiation.
D. Opening UDP 500/4500 addresses reachability for IKE traffic, but doesn’t change or align the actual cryptographic policy being negotiated.

Source: Configure custom IPsec/IKE connection policies for S2S VPN & VNet-to-VNet connections

Correct answer: A
Microsoft Entra Private Access lets administrators define specific internal FQDNs and IP ranges as private resources through Quick Access, and the lightweight Global Secure Access Client on the device tunnels only the traffic to those defined resources — quietly and selectively — while Conditional Access policies can be applied to that access, unlike an all-or-nothing traditional VPN tunnel.

Why other options are incorrect
B. A traditional VPN, even with split tunneling, is a heavier, less granular solution that doesn’t natively integrate Conditional Access the way Entra Private Access does.
C. Azure Bastion provides browser-based RDP/SSH access to specific VMs through the Azure portal; it isn’t designed for general internal application access and should never be published directly to the public internet.
D. A Private Link service exposes a specific service to consumers via private endpoints inside Azure virtual networks; it isn’t a remote-user access solution for employees’ home networks.

Source: Learn about Microsoft Entra Private Access

Correct answer: A
An Azure private endpoint is a network interface that receives a private IP address from the consumer’s own virtual network address space and connects privately, over the Microsoft backbone, to a specific PaaS resource such as Azure SQL Database — making the resource appear to reside inside the VNet and removing the need for a public endpoint.

Why other options are incorrect
B. A service endpoint keeps the destination service’s IP address public and only changes the source IP of the traffic leaving the subnet; it doesn’t give the database a private IP within the consumer’s VNet.
C. A firewall rule based on a NAT gateway’s public IP still routes traffic over Azure SQL Database’s public endpoint; it doesn’t remove public exposure.
D. Effective security rules is a diagnostic tool for reviewing NSG/admin rule outcomes on a network interface; it doesn’t provide private connectivity to a PaaS resource.

Source: What is a private endpoint? - Azure Private Link

Correct answer: A
A Private Link service is created by the provider on top of their own Standard Load Balancer, allowing many separate consumer virtual networks — belonging to different customers or tenants — to connect to it privately by creating a private endpoint in each consumer’s own VNet, without VNet peering or public exposure.

Why other options are incorrect
B. A private endpoint is the consumer-side object used to connect to a Private Link–enabled service; the vendor providing the service configures a Private Link service, not a private endpoint, to publish it.
C. A service endpoint extends a subnet’s identity to reach a specific Azure PaaS service publicly over the Microsoft backbone; it isn’t a mechanism for one organization to publish a custom service to other tenants.
D. Azure Virtual Network Manager governs connectivity and security policy across an organization’s own virtual networks; it doesn’t provide a mechanism for exposing a service to external customer tenants.

Source: What is Azure Private Link?

Correct answer: A
Azure Firewall’s threat intelligence-based filtering defaults to “Alert only” mode, which logs and raises alerts on matches but allows the traffic through; switching the mode to “Alert and Deny” is required for the firewall to actually block traffic matching the threat intelligence feed.

Why other options are incorrect
B. Threat intelligence filtering has a built-in “Alert and Deny” mode for blocking; a DNAT rule (used for inbound destination NAT) is unrelated to enforcing threat intelligence matches.
C. Threat intelligence-based filtering is available on Standard and Premium SKUs, not restricted to Premium only.
D. Alerts are generated regardless of mode, but actual traffic blocking only occurs when the mode is explicitly set to “Alert and Deny.”

Source: Azure Firewall threat intelligence-based filtering

Correct answer: A
Effective security rules aggregates and displays the combined inbound and outbound rules that actually apply to a network interface — including NIC-level NSG rules, subnet-level NSG rules, and Azure Virtual Network Manager admin rules — in a single view, which is exactly what’s needed to understand the net effect of multiple overlapping rule sets.

Why other options are incorrect
B. IP flow verify tests whether a specific packet (given source/destination/port/protocol) would be allowed or denied; it doesn’t show the full aggregated rule set applied to the NIC.
C. Connection monitor tracks reachability and latency between endpoints over time; it doesn’t enumerate the security rules in effect.
D. NSG flow logs traffic analytics visualizes traffic patterns captured in flow logs; it doesn’t compute or display the combined effective rule set from NSGs and admin rules.

Source: Effective security rules overview - Azure Network Watcher

Correct answer: C
Microsoft Purview DSPM for AI includes data risk assessments and reports that specifically identify oversharing and overexposed sensitive data in SharePoint (and other Microsoft 365 content) that AI apps such as Copilot could access, letting admins remediate permissions before rollout.

Why other options are incorrect
A. Microsoft Entra Permissions Management governs cloud infrastructure entitlements (Azure, AWS, GCP identity permissions), not SharePoint content oversharing for AI.
B. The Azure Policy compliance dashboard evaluates Azure resource configuration against policy definitions; it has no visibility into SharePoint file-level sharing.
D. Defender for Cloud Apps app governance focuses on OAuth app risk and behavior, not on identifying overexposed SharePoint data for AI consumption.

Source: Considerations for deploying Microsoft Purview DSPM for AI

Correct answer: B
Microsoft Defender for Cloud Apps now provides real-time, session-level protection for Copilot Studio (and Microsoft Foundry) agents during runtime, inspecting prompts and responses as the conversation happens and taking action such as blocking the session.

Why other options are incorrect
A. Communication Compliance reviews messages for policy violations after the fact across communication channels; it isn’t runtime protection for agent conversations.
C. The Copilot Studio analytics dashboard reports usage metrics and session outcomes; it doesn’t provide real-time blocking.
D. Sentinel scheduled analytics rules run periodically against ingested logs and detect after the fact, not in real time during the live conversation.

Source: Protect your agents in real-time during runtime (Preview)

Correct answer: C
Microsoft Entra treats agent identities, an agent’s user account, and human users as distinct principal types for Conditional Access purposes. A policy must explicitly target agent identities (or agents’ user accounts) — “All users” scoping does not automatically pull them in — and a tenant with no such policy has no enforcement boundary on agent token issuance.

Why other options are incorrect
A. “All users” policies do not automatically cover agent identities or agents’ user accounts; this is a common oversight that leaves agents unprotected.
B. Conditional Access can consume signals such as agent risk level (from Identity Protection) to block token issuance to high-risk agents.
D. Security defaults actually take precedence over custom Conditional Access policies when enabled, and are not a prerequisite for targeting agent identities.

Source: Conditional Access for Microsoft Entra Agent ID (Preview)

Correct answer: B
Microsoft Defender XDR’s detection and investigation experience for AI agents correlates alerts, entities, and relationships in an incident graph so analysts can trace the root cause and understand the full blast radius of an AI agent threat before remediating.

Why other options are incorrect
A. Raw sign-in log queries show individual authentication events but don’t correlate relationships or visualize the scope of impact across entities.
C. A single conversation transcript only shows one session and doesn’t reveal what else the agent identity accessed across the environment.
D. Azure Advisor provides cost, performance, and reliability recommendations; it has no security incident investigation capability.

Source: Detect and investigate threats to AI agents using Microsoft Defender (Preview)

Correct answer: B
The AI gateway capabilities in Azure API Management include the llm-token-limit policy, which enforces token-based limits (tokens per minute or token quota) per API consumer/subscription, preventing one application from exhausting the shared backend’s capacity.

Why other options are incorrect
A. rate-limit-by-key throttles based on request counts, not on actual token consumption, so a few token-heavy requests could still exhaust capacity.
C. Front Door WAF rate limiting protects against volumetric web attacks at the edge; it has no awareness of LLM token usage.
D. Increasing PTUs adds backend capacity but doesn’t stop one consumer from monopolizing the shared quota; it also increases cost rather than governing consumption.

Source: AI gateway capabilities in Azure API Management

Correct answer: A
Defender for AI Services (part of Defender for Cloud’s threat protection for AI workloads) generates alerts such as jailbreak attempts and ASCII smuggling prompt injection by analyzing prompts and responses, correlating with signals like Azure AI Content Safety Prompt Shields.

Why other options are incorrect
B. Insider Risk Management analyzes user activity signals across Microsoft 365 for insider risk indicators; it doesn’t inspect AI model prompts for jailbreak attempts.
C. DDoS Protection Standard mitigates network-layer volumetric attacks, not prompt-level content threats.
D. Entra ID Protection evaluates sign-in and user risk for identities; it doesn’t analyze the content of prompts sent to an AI model.

Source: Alerts for AI workloads - Microsoft Defender for Cloud

Correct answer: B
Encryption at host encrypts data at the Azure Storage layer, including the VM’s temporary disk and OS/data disk caches, is OS-agnostic, requires no in-guest extension, and doesn’t depend on the VM being powered on — unlike Azure Disk Encryption, which relies on in-guest BitLocker or DM-Crypt.

Why other options are incorrect
A. Azure Disk Encryption encrypts the OS and data disks using in-guest BitLocker/DM-Crypt; it does not, by itself, cover temp disk and cache encryption the way encryption at host does.
C. Server-side (Storage Service) encryption with platform-managed keys encrypts managed disks at rest but doesn’t specifically address temp disk and cache encryption without host-level encryption enabled.
D. Double encryption at rest adds a second infrastructure-level encryption layer for managed disks but is a separate, additional control layered on top of, not a replacement for, encryption at host’s cache/temp disk coverage.

Source: Server-side encryption of Azure Disk Storage

Correct answer: B
Just-in-time VM access locks down inbound NSG rules for management ports by default and only opens them, for a specified source IP and time window, when a user with sufficient permissions requests access, automatically reverting once the window expires.

Why other options are incorrect
A. Azure Bastion provides browser-based RDP/SSH without exposing a public IP on the VM, but by itself it doesn’t implement the time-boxed, request-based opening of NSG rules that JIT provides.
C. Azure Firewall DNAT rules can forward traffic to a VM but don’t provide time-limited, request-based access approval.
D. NSG flow logs record traffic metadata for auditing and analysis; they don’t control or restrict access to ports.

Source: Just-in-time virtual machine access in Microsoft Defender for Cloud

Correct answer: A and D
Agentless scanning copies a snapshot of the disk and analyzes it externally, so it has no performance impact on the workload and no dependency on the VM being powered on or having an agent installed, and it’s supported for Azure, AWS, and GCP machines onboarded to Defender for Servers Plan 2.

Why other options are incorrect
B. Agentless scanning specifically avoids any dependency on an installed agent — that’s the point of the “agentless” name.
C. Agentless scanning also covers AWS and GCP virtual machines connected through Defender for Cloud’s multicloud connectors, not just Azure.

Source: Agentless machine scanning in Microsoft Defender for Cloud

Correct answer: B
Defender for Containers deploys a Defender sensor to AKS nodes that monitors runtime behavior (such as process execution and suspicious commands) and generates threat alerts, which is distinct from the build-time/deploy-time misconfiguration checks done through Azure Policy.

Why other options are incorrect
A. ACR vulnerability scanning assesses container images for known CVEs before or after push; it doesn’t observe runtime process behavior inside running pods.
C. Azure Policy’s Kubernetes misconfiguration definitions evaluate cluster and pod configuration against best practices; they don’t detect live runtime attack behavior.
D. Container insights collects performance and resource-utilization metrics/logs; it isn’t a threat-detection engine.

Source: Defender for Containers deployment overview

Correct answer: B
Azure Functions runs on the App Service platform, which provides built-in authentication and authorization (often called “Easy Auth”). When enabled with an identity provider such as Microsoft Entra ID, the platform authenticates every incoming request before it reaches the function code — no custom auth code required.

Why other options are incorrect
A. Function/host keys are shared secrets that authorize the call, not identity-based authentication against Entra ID, and they don’t validate a caller’s identity.
C. A managed identity lets the Function App authenticate outbound to other Azure resources; it doesn’t authenticate inbound callers of the function.
D. VNet integration and private endpoints control network reachability, not caller identity/authentication.

Source: Securing Azure Functions

Correct answer: C
In Detection mode, the WAF logs matching threats for monitoring but takes no blocking action; Prevention mode actively blocks requests that match the rule set, which is required to stop the payloads from reaching the application.

Why other options are incorrect
A. Adding the app’s own IP to an exclusion list would exempt fields from inspection and doesn’t relate to enabling blocking behavior.
B. Raising the anomaly scoring threshold makes the WAF less sensitive (more permissive), which would let more malicious traffic through, not less.
D. Disabling the OWASP managed rule set removes broad, maintained protections and would leave the app more exposed unless equivalent custom rules replace every covered attack pattern.

Source: What is Azure Web Application Firewall on Azure Application Gateway?

Correct answer: B
Attack path analysis, part of Defender CSPM, uses graph-based contextual analysis to chain together individually minor risks (internet exposure, a vulnerability, and excessive permissions) into a single exploitable path to a sensitive resource, helping teams prioritize the combination rather than each finding in isolation.

Why other options are incorrect
A. Secure score recommendations list individual hardening actions and their score impact; they don’t chain multiple risks into a single exploitable path.
C. The regulatory compliance dashboard measures configuration against specific compliance standards, not exploitable attack chains.
D. Workload protection alerts (from Defender plans like Defender for Servers) detect active threats/anomalous behavior, not posture-based attack path modeling.

Source: Identify and remediate attack paths in Microsoft Defender for Cloud

Correct answer: B
The regulatory compliance dashboard maps assessments to controls of built-in standards like PCI DSS and shows pass/fail status per control; when a needed standard isn’t built in, you can assign a custom regulatory compliance standard backed by a custom Azure Policy initiative so it also appears in the dashboard.

Why other options are incorrect
A. Secure Score is a general hardening score across recommendations; it isn’t structured as a per-control pass/fail mapping to a named framework like PCI DSS.
C. Azure Advisor recommendations aren’t mapped to compliance framework controls and manually mapping them is not the supported mechanism Defender for Cloud provides.
D. Defender for Cloud’s regulatory compliance dashboard does track compliance standards for Azure resources; Purview Compliance Manager is a separate, complementary tool but isn’t the only option.

Source: Assign regulatory compliance standards in Microsoft Defender for Cloud

Correct answer: B
When connecting AWS, choosing the “Management account” option onboards an entire AWS Organization at once, deploying the required CloudFormation StackSet so member accounts (current and new) are automatically covered without a per-account connector.

Why other options are incorrect
A. Configuring a “Single account” connector per account works but doesn’t scale automatically to new accounts and requires repeating onboarding for each one — exactly what the team wants to avoid.
C. Manually installing an agent on every EC2 instance doesn’t onboard the accounts to Defender for Cloud and isn’t how the native connector works.
D. Azure Lighthouse delegates management of Azure resources across tenants; it isn’t the mechanism used to connect AWS accounts to Defender for Cloud.

Source: Connect your AWS account to Microsoft Defender for Cloud

Correct answer: B
Defender EASM uses discovery technology that starts from known seeds and recursively maps connected infrastructure (domains, IP blocks, hosts, certificates) to uncover previously unknown or unmonitored internet-facing assets, giving an outside-in view without requiring prior inventory or credentials.

Why other options are incorrect
A. Defender for Cloud’s asset inventory only lists resources already known within connected Azure/multicloud subscriptions; it can’t discover assets outside that inventory.
C. Azure Resource Graph queries Azure resources you already have visibility into via subscriptions; it has no capability to discover unknown external assets.
D. Purview Data Map catalogs and classifies data sources for governance; it doesn’t discover internet-facing infrastructure.

Source: Microsoft Defender EASM overview

Correct answer: B
Microsoft Sentinel Responder includes all Reader permissions (viewing data, incidents, workbooks) plus the ability to manage incidents (assign, tag, close), without granting the ability to create/edit analytics rules or manage Content hub solutions, which is reserved for Contributor.

Why other options are incorrect
A. Reader can only view data and incidents; it cannot assign, tag, or close incidents.
C. Contributor includes everything Responder can do plus the ability to create/edit resources and install Content hub solutions — more than this requirement calls for.
D. Playbook Operator only allows listing, viewing, and manually running playbooks; it doesn’t grant incident management or general Sentinel access on its own.

Source: Roles and permissions in Microsoft Sentinel

Correct answer: B
Content hub solutions bundle related content — data connectors, analytics rule templates, workbooks, playbooks, and hunting queries — for a specific product or scenario, so deploying a solution installs the whole coordinated set in one action instead of building each piece separately.

Why other options are incorrect
A. A custom DCR only defines how raw data is collected/transformed; it doesn’t provide the matching analytics rules, workbook, or playbook that a packaged solution includes.
C. Importing standalone KQL queries gives you hunting queries only, not a coordinated connector plus workbook plus playbook bundle.
D. Building a workbook from scratch addresses only the visualization piece, not the connector or analytics rules.

Source: Discover and deploy Microsoft Sentinel out-of-the-box content from Content hub

Correct answer: B
The current supported method ingests Syslog/CEF by installing the Azure Monitor Agent on a Linux machine acting as a log forwarder, with a data collection rule defining what to collect and forward to the Sentinel workspace — replacing the legacy Log Analytics agent-based CEF connector.

Why other options are incorrect
A. The HTTP Data Collector API is a generic custom-log ingestion path and isn’t how syslog/CEF appliances are onboarded through the supported connector.
C. UEBA is an analytics capability within Sentinel that consumes already-ingested data; it isn’t a log forwarding agent for appliances.
D. Defender for Cloud Apps governs SaaS app access and discovery; it has no role in forwarding on-premises syslog/CEF traffic.

Source: Ingest syslog and CEF messages to Microsoft Sentinel with the AMA

Correct answer: B
Because the WEC/WEF collector already aggregates events from all source servers, installing the Azure Monitor Agent on just that collector and configuring the Windows Security Events via AMA connector (with an appropriate data collection rule) ingests the forwarded events into Sentinel without touching every individual source server.

Why other options are incorrect
A. The legacy agent-based connector is deprecated, and enabling it on every source server also defeats the purpose of using the existing WEF aggregation.
C. Manually exporting and uploading .evtx files isn’t a supported, scalable ingestion path and wouldn’t populate the Windows Security Events table.
D. Defender for Endpoint provides its own endpoint telemetry, but it’s not a substitute for ingesting Windows Security Event logs via the AMA connector into the table the scenario requires.

Source: Windows Security Events via AMA connector for Microsoft Sentinel

Correct answer: A and B
Automation rules provide simple, code-free incident-management actions (tagging, assigning, suppressing/closing) and can also control and sequence which playbooks run for a given incident or alert, centralizing automation logic without requiring a Logic App for basic triage actions.

Why other options are incorrect
C. Calling external REST APIs or performing custom remediation logic requires a playbook (an Azure Logic App), not the automation rule itself.
D. Automation rules don’t replace Logic Apps/playbooks — they complement them by deciding when and in what order playbooks run; actual remediation workflows still live in playbooks.

Source: Automate threat response with playbooks in Microsoft Sentinel

Correct answer: B
Security Copilot enforces a minimum of two Copilot Owners at all times as a safeguard against accidentally locking the workspace out of administrative control; an attempt to reduce below two owners is blocked.

Why other options are incorrect
A. There is a minimum owner requirement, specifically two, so this claim is false.
C. Holding Global Administrator isn’t a workaround for the two-owner minimum; the constraint applies to Copilot Owner role assignment itself.
D. Role assignment for Security Copilot roles (Owner/Contributor) is done within Security Copilot’s own role assignment settings, not the Entra admin center, and doing so there wouldn’t bypass the minimum-owner rule anyway.

Source: Understand authentication in Microsoft Security Copilot

Correct answer: B
Security Copilot plugins authenticate on behalf of the signed-in user, meaning the user must also hold the relevant permissions in the underlying product (for example, Microsoft Sentinel Reader in Azure RBAC) to retrieve that product’s data — being a Copilot Contributor alone doesn’t grant access to plugin data sources.

Why other options are incorrect
A. Plugins explicitly respect the underlying product’s own permission model rather than bypassing it — that’s the on-behalf-of design.
C. Both Owners and Contributors can use plugins; access to a specific plugin’s data still depends on the user’s permissions in that product, not the Copilot role alone.
D. Microsoft 365 E5 licensing relates to Security Copilot inclusion/entitlement, not to whether a specific plugin’s underlying data permissions (Azure RBAC roles) are satisfied.

Source: Understand authentication in Microsoft Security Copilot

Correct answer: B
The Security Store is Security Copilot’s catalog of prebuilt Microsoft and partner agents (such as phishing or alert triage agents) that admins can browse and deploy directly into their workspace, without building custom automation from scratch.

Why other options are incorrect
A. Writing a custom plugin manifest is how you build your own plugin integration; it isn’t how you obtain a prebuilt, ready-made agent.
C. Duplicating a promptbook only reuses existing prompt sequences the tenant already has; it isn’t a source of new prebuilt agents from Microsoft or partners.
D. Logic Apps custom connectors are used to build playbooks/automation for products like Sentinel, not to deploy Security Copilot agents.

Source: Application card for Microsoft Security Copilot agents