Pass the Microsoft Certified: Information Security Administrator Associate SC-500 Questions and answers with ExamsMirror

Statement

Selection

Traffic destined for an Azure Storage account is

able to connect to East US 2

FTP connections from 1.2.3.4 to 10.0.0.10/32 are

dropped

The first selection is able to connect to East US 2 because NSG rules are evaluated in ascending priority order—the lower numerical value has higher priority . The StorageEA2Allow outbound rule has priority 104 and permits traffic to the Storage.EastUS2 service tag on destination port 443 . The broader DenyStorageAccess rule has priority 105 and denies outbound traffic to the general Storage service tag. Because priority 104 is evaluated first, HTTPS storage traffic to East US 2 is allowed; storage traffic for other regions subsequently matches the priority-105 deny rule. Microsoft confirms that regional service tags such as Storage.EastUS2 restrict the tag to the service ' s IP ranges in that specific region. Microsoft Learn

The FTP connection is dropped . The Contoso_FTP inbound rule permits TCP port 21 from 1.2.3.4/32, but only when the destination is 10.0.0.5/32 . The question ' s destination is 10.0.0.10/32, so this custom allow rule does not match. The traffic ultimately reaches the NSG ' s default DenyAllInbound rule and is blocked. Microsoft documents that NSG processing stops on the first matching rule.

Statement

Answer

From VM1, you can access File1 by using a private IP address.

Yes

From VM2, you can access File1 by using a private IP address.

Yes

From VM2, you can access File2 by using a private IP address.

No

The private endpoint is configured for the blob sub-resource of contoso2024. Azure Storage private endpoints are created for individual storage services. Microsoft documents separate private endpoint targets for blob , file , queue , table , and other supported storage services. Therefore, PE1 provides private connectivity to Blob Storage, which contains File1, but it does not provide a private endpoint for the Azure Files service that contains File2. Microsoft Learn

VM1 → File1 = Yes. VM1 is in VNet1, and VNet1 is peered with VNet2. A private endpoint has an IP address in Subnet21, and private endpoint connectivity can be consumed from connected virtual networks, including peered VNets, provided DNS resolves the storage Blob endpoint to that private IP. Microsoft Learn

VM2 → File1 = Yes. VM2 resides directly in VNet2, where the blob private endpoint exists, so it can reach File1 through the endpoint ' s private IP.

VM2 → File2 = No. File2 resides in an Azure file share , which requires a separate private endpoint targeting the file sub-resource and normally uses the privatelink.file.core.windows.net private DNS zone. The existing blob private endpoint cannot provide private-IP connectivity to Azure Files.

The correct role is Security Reader . Microsoft Defender for Cloud uses Azure RBAC to control access to security information. The Security Reader role provides read-only access specifically to Defender for Cloud data, including security recommendations, security alerts, security policies, and security state , while preventing the user from modifying policies, dismissing alerts, or changing security configuration. Microsoft explicitly recommends assigning the least-permissive role required for the user ' s operational duties.

This scope is especially important for multicloud environments. When an AWS account is onboarded, Defender for Cloud represents that environment through an Azure security connector resource. Microsoft documents that permissions assigned at the resource group containing the AWS connector are inherited for multicloud recommendations and security alerts . Therefore, assigning Security Reader to Group1 at RG1 provides the analysts with the required visibility into the connected AWS environment.

Although Reader can also view recommendations and alerts, it grants broader read access to Azure resources within RG1 and is therefore less restrictive. Security Administrator permits security-policy changes and alert/recommendation management, while Owner provides extensive resource-management and access-control permissions.

Thus, Security Reader at RG1 satisfies the requirement with the least privilege.

To verify identity-based authentication over SMB , use File shares . Azure Files supports identity-based authentication for SMB by using an identity source such as on-premises AD DS, Microsoft Entra Domain Services, or Microsoft Entra Kerberos. Microsoft documents that the identity-based access configuration for Azure Files is managed from the storage account ' s File shares experience. From there, you can verify whether an identity source has been configured for SMB authentication. Microsoft Learn

To restrict access so that users can access the storage account only during 2025 , use Shared access signature . A SAS supports explicit start and expiry timestamps , allowing access to be valid only during a defined time window. For example, the SAS can be configured to begin on January 1, 2025 and expire at the end of December 31, 2025. Microsoft also recommends granting only the minimum required permissions and limiting the validity duration when creating SAS tokens. Microsoft Learn

Settings such as Access keys provide long-lived credentials and do not inherently enforce a calendar-based validity period. Networking controls where access originates but not a specific one-year authorization window.

Inbound from the internet: 443; Outbound to Subnet1: 3389

Azure Bastion requires inbound HTTPS access on TCP 443 from the internet to the AzureBastionSubnet so users can reach the Bastion service. For RDP to Windows virtual machines, Bastion then needs outbound access to the target subnet on TCP 3389. Port 22 would be required for SSH, but the scenario is specifically secure RDP. Other listed ports do not satisfy Bastion RDP access requirements. For this domain, least privilege means granting only the required data operation or allowing only the required network flow. The correct response avoids shared keys, broad peering, general contributor roles, or log-only controls when the scenario demands prevention, routing, event triggering, or account-specific configuration. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > Azure Bastion; Microsoft Learn > Azure Bastion NSG access and port requirements.

==============================================================

Assign Key Vault Crypto Service Encryption User . This built-in Azure RBAC role is specifically designed for workloads that need to read key metadata and perform key wrap and unwrap operations . Microsoft describes the role as allowing an identity to read metadata for Key Vault keys and perform cryptographic wrap/unwrap operations. This matches the existing KeyVault1 permissions—Get, List, Wrap, and Unwrap—without providing unnecessary key-management privileges. Microsoft Learn

Microsoft also provides an explicit mapping from legacy Key Vault access policies to Azure RBAC roles. The access-policy combination Get, List, Wrap Key, and Unwrap Key maps to Key Vault Crypto Service Encryption User . Microsoft Learn

Key Vault Reader provides metadata-reading permissions but cannot perform the required wrap and unwrap operations. Key Vault Crypto User grants a broader collection of cryptographic operations than required. Key Vault Crypto Officer is significantly overprivileged because it can perform key-management operations such as creating, importing, deleting, and updating keys.

Requirement

Component

To allow traffic between all the virtual networks in Production

A connectivity configuration

To block traffic between Development and Production

A security admin configuration

An Azure Virtual Network Manager connectivity configuration defines how virtual networks within network groups communicate. For the Production network group, a connectivity configuration can implement a mesh topology , which establishes connectivity among the virtual networks in that group without requiring administrators to create and maintain individual VNet peerings. Microsoft documents connectivity configurations as the mechanism for establishing managed connectivity patterns such as mesh and hub-and-spoke across virtual networks.

To prevent communication between the Development and Production environments, use a security admin configuration . Security admin configurations contain centrally managed security admin rule collections that can Allow, Always Allow, or Deny network traffic. These rules can be applied across targeted network groups and are specifically suitable for enforcing network segmentation. Microsoft identifies blocking traffic between virtual networks or subnets as a supported security-admin-rule scenario. A Deny security admin rule terminates traffic evaluation and prevents the traffic from reaching the destination, independently of ordinary NSG permissions.

A routing configuration controls routing behavior rather than organizational security segmentation. IPAM manages address-space planning and allocation, while a scope defines which resources Virtual Network Manager can manage; neither directly satisfies these two traffic-control requirements.