SC-500 validates end-to-end security controls for cloud and AI workloads. This set covers Manage and monitor security posture, which accounts for 20–25% of the official skills outline. The domain tests risk assessment, compliance, event collection, and automated response. These SC-500 security posture questions focus on Defender for Cloud and Microsoft Sentinel configuration decisions.
This is the fourth set in our Cloud and AI Security Engineer Associate SC-500 series (Questions 31-40). It follows SC-500 Questions 21-30 on compute and AI security. Every question is an original practice scenario mapped to the official exam objectives, not a copy of a real exam item.
Distinguish collecting evidence from enforcing a control, and installing a template from activating a detection. For automated playbooks, check the service’s permissions separately from the engineer’s permissions.
Question 31: Prioritize Connected Risks
A company has enabled Defender CSPM and its required VM scanning capability. The team needs automatically identified sequences that connect an internet-exposed vulnerable resource, usable identity permissions, and a sensitive database. It wants to prioritize exploitable routes to critical assets rather than inspect isolated findings or build its own graph query. Which capability should it use?
A) The asset inventory list to review individual resource records.
B) The regulatory compliance dashboard to review framework controls.
C) Attack path analysis to review connected exploitable risk sequences.
D) Cloud security explorer to author custom graph-based risk queries.
👁 Reveal Answer
Correct Answer: C
Explanation: C uses the cloud security graph to identify exploitable entry points and subsequent steps toward critical assets. It combines context such as internet exposure, permissions, vulnerabilities, and lateral movement to prioritize connected risks. A inventories resources but is not the requested path-analysis experience. B organizes assessments against compliance controls rather than attacker routes. D supports proactive graph exploration, but requires the custom query work the scenario explicitly excludes.
Reference: Security explorer and attack paths in Microsoft Defender for Cloud
Question 32: Document a Process Control
A compliance standard is already enabled in Defender for Cloud. One control includes a manual assessment of the company’s security review process. The company has completed that process and has supporting documents. An authorized compliance engineer must record this evidence for the relevant subscriptions without using a resource scan as proof that the process occurred. What should the engineer do?
A) Attest the manual assessment and attach the supporting evidence.
B) Wait for an automated resource assessment to verify the process.
C) Download an Azure audit report instead of submitting company evidence.
D) Apply automated remediation to the control’s resource recommendations.
👁 Reveal Answer
Correct Answer: A
Explanation: A uses the manual attestation and evidence workflow. The engineer selects the assessment and relevant subscriptions, records the attestation, attaches evidence, and saves it. B cannot substitute automated resource configuration checks for customer input required by a manual assessment. C provides Microsoft’s service audit material, not proof of the company’s review process. D may improve technical resource findings but does not document this organizational control’s completion.
Reference: Improve regulatory compliance in Microsoft Defender for Cloud
Question 33: Interpret a Disabled Plan
An administrator turns one paid Defender for Cloud workload protection plan off in an Azure subscription and saves the change. An inspection still shows extensions that the plan deployed. No other enabled plan uses these extensions. The team must interpret the plan change without assuming that installed components prove protection remains enabled. Which behavior is documented for extensions used by the disabled plan?
A) They are uninstalled immediately, and all historical findings are deleted.
B) They stay installed, and the disabled plan continues collecting indefinitely.
C) They are uninstalled immediately, but the disabled plan keeps collecting.
D) They stay installed, but stop collecting data after a short time.
👁 Reveal Answer
Correct Answer: D
Explanation: D matches the documented plan-disablement behavior: turning the individual plan off does not uninstall its extensions, but they stop collecting data after a short time. Installed extensions alone therefore do not establish that the plan remains enabled. A incorrectly promises immediate removal and deletion of historical findings. B incorrectly treats installation as indefinite collection under the disabled plan. C incorrectly combines immediate removal with continued collection by that disabled plan.
Reference: Connect your Azure subscriptions to Microsoft Defender for Cloud
Question 34: Include Future Cloud Accounts
A company wants Defender for Cloud coverage across an AWS organization, including member accounts created later. The authorized onboarding team has access to the AWS management account and can deploy the required dependencies. It wants native connector provisioning with the least repeated onboarding work. Which approach should it choose?
A) Onboard the management account using the Single account option.
B) Onboard the management account using the Management account option.
C) Onboard a delegated administrator using the Management account option.
D) Onboard each existing member using the Single account option.
👁 Reveal Answer
Correct Answer: B
Explanation: B creates the management-account connector and uses automatic provisioning to create connectors for discovered member accounts and newly created accounts under that management account. A selects single-account coverage instead of organization onboarding. C is unsupported because management-account onboarding requires the actual AWS management account, not a delegated administrator. D can connect today’s members individually but requires repeated work for new accounts, violating the scenario’s administrative-effort constraint.
Reference: Connect your AWS account to Microsoft Defender for Cloud
Question 35: Confirm a Newly Discovered Host
Defender EASM discovers an internet-facing host and labels it Candidate. An investigation confirms that the company owns the host and is directly responsible for it. The team wants it included in the default owned-asset dashboard charts and regularly scanned, rather than left in discovery-only candidate handling. Which asset state should the analyst assign?
A) Dependency, because the host is part of the attack surface.
B) Approved Inventory, because ownership and responsibility are confirmed.
C) Monitor Only, because the host is relevant but not controlled.
D) Candidate, because the original discovery classification must remain.
👁 Reveal Answer
Correct Answer: B
Explanation: B represents owned attack-surface assets for which the organization is directly responsible. Approved Inventory assets appear in default dashboard charts and are scanned daily. A describes third-party infrastructure that supports owned assets, not this company-owned host. C fits relevant assets outside direct control or technical dependency, contrary to the confirmed responsibility. D leaves the host in a state scanned only during discovery; candidate classification should be updated after ownership review.
Reference: Understand inventory assets in Defender EASM
Question 36: Grant Incident Handling Access
A Microsoft Sentinel SIEM deployment uses built-in Azure RBAC roles. An analyst who is a tenant member must view workspace data and manage incident status and assignment, but must not create or edit analytics rules or install solutions. No other role grants broader access, and running playbooks is not required. Which built-in role provides least privilege at the Sentinel resource group?
A) Microsoft Sentinel Reader.
B) Microsoft Sentinel Contributor.
C) Microsoft Sentinel Responder.
D) Microsoft Sentinel Playbook Operator.
👁 Reveal Answer
Correct Answer: C
Explanation: C includes Reader permissions and adds incident management, matching the analyst’s duties without analytics-rule or solution-management access. A allows viewing incidents and data but not managing incidents. B adds creation and editing of Sentinel resources and content hub management, exceeding the requirement. D allows listing, viewing, and manually running playbooks, but does not supply incident management or workspace data access. Role assignments are cumulative, so the absence of broader grants matters.
Reference: Roles and permissions in the Microsoft Sentinel platform
Question 37: Activate an Installed Detection
An engineer installs a Sentinel Content hub solution. Its data connector is configured, and the required records are arriving. A scheduled analytics template is present, but no active rule has been created from it. The team needs ongoing detections with the least custom development. What should the engineer do next?
A) Create and enable an analytics rule from the installed template.
B) Reinstall the solution to refresh the installed content definitions.
C) Save a workbook from the solution to visualize the ingested records.
D) Run a hunting query from the solution to inspect the current records.
👁 Reveal Answer
Correct Answer: A
Explanation: A completes the template-to-active-rule step. Installing solution content supplies the analytics template, but the engineer must create and enable a rule to use it for ongoing detection. B repeats installation without creating the missing active rule. C creates a visualization rather than activating the scheduled detection. D can produce useful investigation results at that moment, but a one-time hunting query does not establish the ongoing analytics rule requested by the team.
Reference: Discover and deploy Microsoft Sentinel content from Content hub
Question 38: Set the Collection Threshold
A security appliance already sends valid CEF messages to a Linux forwarder using the daemon facility. AMA and the CEF connector are configured correctly. The team wants Warning, Error, Critical, Alert, and Emergency messages, but not Notice, Informational, or Debug messages. Which minimum log level should it select for daemon in the DCR’s Collect tab?
A) Informational.
B) Notice.
C) Error.
D) Warning.
👁 Reveal Answer
Correct Answer: D
Explanation: D selects Warning as the minimum severity. The connector collects that level and all higher-severity levels, producing the requested Warning-through-Emergency set. A also includes Informational and Notice, increasing ingestion beyond the requirement. B also includes Notice, which the team excludes. C starts at Error and therefore misses Warning events that the team needs. The minimum-level setting is an inclusive severity threshold, not a request for only one severity.
Reference: Ingest syslog and CEF messages to Microsoft Sentinel with AMA
Question 39: Collect Only the Required Event
A dedicated Windows Security Events via AMA DCR is associated with supported servers. Their audit policies already generate failed-logon event 4625. For this collection path, the team requires only that event ID and must avoid ingesting other Security or AppLocker events. No other DCR collects these logs. Which collection setting most directly meets the requirement?
A) Choose All events and filter the results only when querying.
B) Choose Common and filter the results only when querying.
C) Choose Custom and restrict the DCR with an XPath event filter.
D) Choose Minimal and retain its complete predefined event set.
👁 Reveal Answer
Correct Answer: C
Explanation: C defines the collected event set through XPath queries in the data collection rule, allowing collection to be restricted to the required event. A and B ingest larger event sets; filtering later in a query does not prevent that ingestion. D is smaller than Common, but still includes several events besides 4625, such as successful logons and process creation. Existing audit generation and DCR association are already satisfied, so collection filtering is the missing configuration.
Reference: Windows security event sets that can be sent to Microsoft Sentinel
Question 40: Authorize Automatic Response
A Sentinel automation rule must run an existing incident-triggered Logic App that uses the Microsoft Sentinel connector. The rule’s trigger, conditions, and playbook action are correct, and the engineer has the required editing permissions. The playbook is in a separate resource group where the Microsoft Sentinel service account has no execution permissions. What should an authorized administrator grant to fix this specific gap?
A) Grant Sentinel Reader to the service account on the playbook group.
B) Grant Sentinel Automation Contributor to the service account on the playbook group.
C) Grant Sentinel Playbook Operator to the engineer on the playbook group.
D) Grant Sentinel Contributor to the engineer on the workspace group.
👁 Reveal Answer
Correct Answer: B
Explanation: B grants the Microsoft Sentinel service account the Microsoft Sentinel Automation Contributor role on the resource group containing the playbook. That service permission is separate from the engineer’s ability to configure an automation rule. A provides read access, not the required automation execution permission. C concerns a user’s manual playbook operations and does not authorize the service account. D adds user editing permissions at the workspace group while leaving the separate playbook group’s service-permission gap unresolved.
Study Tips for Security Posture and Monitoring
- Connect the risks. Attack path analysis prioritizes exploitable routes, while cloud security explorer supports custom graph queries.
- Supply the right evidence. Manual compliance assessments need customer attestation, not just another resource scan.
- Filter before ingestion. CEF thresholds and Windows DCR event filters determine which records the collection path admits.
- Separate user and service permissions. Authoring an automation rule does not automatically authorize Sentinel to execute its playbook.
Keep Practicing for Cloud and AI Security Engineer
Use these SC-500 security posture questions to review the difference between content installation, data collection, and active response. Revisit SC-500 Questions 21-30 for compute and AI security. The next set will be a mixed review across all four security domains.