Microsoft Implementing End-to-End Security Controls for Cloud and AI Workloads (SC-500) Exam Questions

Microsoft Implementing End-to-End Security Controls for Cloud and AI Workloads Exam Objectives

1. 1

   1.0 Manage identity, access, and governance (20-25%)

   • 1.1Secure access to resources by using Microsoft Entra ID
   • 1.2Implement and configure Privileged Identity Management (PIM)
   • 1.3Implement conditional access policies
   • 1.4Implement and configure authentication methods, including multifactor authentication (MFA) and passwordless
   • 1.5Implement and configure identity for applications, including enterprise applications and app registrations
   • 1.6Manage OAuth permission grants and consent settings
   • 1.7Implement and configure managed identities for Azure resources
   • 1.8Secure secrets and keys by using Azure Key Vault
   • 1.9Deploy Key Vault
   • 1.10Configure Key Vault settings
   • 1.11Configure access to Key Vault
   • 1.12Configure firewall settings on Key Vault
   • 1.13Manage keys, secrets, and certificates
   • 1.14Scan for secrets by using Defender Cloud Security Posture Management (Defender CSPM)
   • 1.15Implement Defender for Key Vault
   • 1.16Implement governance to enforce security and regulatory compliance
   • 1.17Implement and configure security controls by using Azure Policy, including built-in and custom policy definitions
   • 1.18Evaluate regulatory compliance by using Microsoft Defender for Cloud
   • 1.19Implement and configure security controls in Defender for Cloud, including security standards and recommendations
   • 1.20Implement resource locks
   • 1.21Manage Azure built-in role assignments
   • 1.22Manage custom roles, including Azure roles and Microsoft Entra roles
   • 1.23Evaluate and remediate overprivileged access assignments by using Azure role-based access control (RBAC)
   • 1.24Configure security controls for backup protection by using Azure Backup security features
   • 1.25Implement and configure security controls by using infrastructure as code
2. 2

   2.0 Secure storage, databases, and networking (25-30%)

   • 2.1Implement security for storage accounts
   • 2.2Implement and configure security for storage accounts
   • 2.3Configure Azure Storage firewall rules
   • 2.4Implement Defender for Storage threat protection configurations
   • 2.5Manage access to storage, including access policies
   • 2.6Implement security for databases
   • 2.7Implement platform-level security configurations in Azure SQL
   • 2.8Configure database auditing for Azure SQL Database and Azure SQL Managed Instance
   • 2.9Configure Defender for Databases protection across Azure database services
   • 2.10Implement security for Azure network services
   • 2.11Implement and manage network security groups (NSGs) and application security groups (ASGs)
   • 2.12Implement and configure network access policies by using Azure Virtual Network Manager
   • 2.13Configure security for an Azure Virtual WAN
   • 2.14Implement and configure security for virtual private network (VPN) connections
   • 2.15Implement and configure Microsoft Entra Private Access
   • 2.16Configure Azure private endpoints to secure access to Azure platform as a service (PaaS) resources
   • 2.17Configure Azure Private Link services to secure access to network resources
   • 2.18Implement and configure Azure Firewall
   • 2.19Evaluate effective security rules by using Azure Network Watcher diagnostics
3. 3

   3.0 Secure compute (20-25%)

   • 3.1Implement security for AI
   • 3.2Identify overexposure of data in SharePoint
   • 3.3Identify risks related to Microsoft Copilot and AI apps by using Microsoft Purview Data Security Posture Management (DSPM)
   • 3.4Enable and configure real-time protection for Microsoft Copilot Studio agents
   • 3.5Implement conditional access for Microsoft Entra Agent ID
   • 3.6Analyze blast radius for security risks related to Entra Agent ID by using Defender XDR
   • 3.7Manage Entra Agent ID access
   • 3.8Configure and deploy AI Gateway in Azure API Management for Microsoft Foundry
   • 3.9Enable Defender for AI Service in Cloud Workload Protection in Defender for Cloud
   • 3.10Configure guardrails for agent security in Foundry
   • 3.11Monitor AI security by using the Data and AI security dashboard in Defender for Cloud
   • 3.12Manage agents in Microsoft 365 admin center
   • 3.13Implement security for servers and virtual machines (VMs)
   • 3.14Implement and configure disk encryption
   • 3.15Plan and implement Azure Bastion
   • 3.16Enable and enforce use of just-in-time (JIT) VM access
   • 3.17Extend security controls to hybrid and multicloud servers by using Azure Arc
   • 3.18Onboard servers to Defender for Servers in Defender for Cloud, including hybrid and multicloud scenarios
   • 3.19Configure Defender for Servers settings, including vulnerability scanning, and endpoint detection and response (EDR)
   • 3.20Implement and manage agentless scanning for VMs in Defender for Servers
   • 3.21Configure security features on a VM, including secure boot, virtual Trusted Platform Module (vTPM), integrity monitoring, and security type
   • 3.22Enforce security configuration of Azure-managed servers by using Azure Machine Configuration
   • 3.23Implement security for application platform services
   • 3.24Detect misconfigurations and runtime risks in container workloads by using Defender for Containers
   • 3.25Implement and configure security controls for Azure Kubernetes Service (AKS)
   • 3.26Implement and configure security controls for Azure Container Registry
   • 3.27Implement and configure security controls for Azure Container Instances and Azure Container Apps
   • 3.28Implement and configure security controls for Azure Functions, including authentication and network access
   • 3.29Implement and configure security controls for Azure Logic Apps
   • 3.30Implement and configure security controls for Azure App Service
   • 3.31Implement and configure Azure Web Application Firewall
   • 3.32Implement security policies for back-end API protection by using API Management
4. 4

   4.0 Manage and monitor security posture (20-25%)

   • 4.1Manage security posture by using Defender for Cloud
   • 4.2Identify security risks by using Defender CSPM
   • 4.3Evaluate compliance against security frameworks by using Defender for Cloud
   • 4.4Enable and configure Defender for Cloud workload protection plans
   • 4.5Connect hybrid cloud and multicloud environments to Defender for Cloud, including Amazon Web Services (AWS) and Google Cloud Platform (GCP)
   • 4.6Configure Microsoft Defender Vulnerability Management settings for Azure VMs
   • 4.7Discover unprotected assets and vulnerabilities by using Microsoft Defender External Attack Surface Management (EASM)
   • 4.8Implement activity and event collection in Microsoft Sentinel
   • 4.9Create and connect workspaces in Microsoft Sentinel
   • 4.10Assign roles in Microsoft Sentinel
   • 4.11Implement and use content hub solutions
   • 4.12Configure and use Microsoft data connectors for Azure resources
   • 4.13Implement and configure syslog and Common Event Format (CEF) event collections
   • 4.14Implement and configure collection of Windows Security events by using data collection rules, including Windows Event Forwarding (WEF)
   • 4.15Create custom log tables in the workspace to store ingested data
   • 4.16Implement automation rules and playbooks in Microsoft Sentinel
   • 4.17Implement data retention in Microsoft Sentinel data stores
   • 4.18Query Microsoft Purview Audit in Defender XDR
   • 4.19Implement Microsoft Security Copilot
   • 4.20Configure workspaces for Security Copilot
   • 4.21Manage permissions and roles in Security Copilot
   • 4.22Enable and configure plugins
   • 4.23Enable and configure Microsoft agents and Security Store agents