Free SC-500 Exam Flashcards

An active assignment carries the role's privileges all the time. An eligible assignment carries identical privileges but only after the user activates the role, which removes standing privilege without removing the ability to work.

Multifactor authentication, a business justification, and approval from designated approvers. Activation lasts only up to a maximum duration the admin sets, so the user must reactivate later rather than keeping the role.

After first-factor authentication completes. That is why it is not a defense against denial-of-service floods. Conditional Access needs Microsoft Entra ID P1, and sign-in or user risk conditions need ID Protection at P2.

A system-assigned identity is tied to one resource and is deleted with it. A user-assigned identity is its own resource, can be attached to many resources, and survives them, so shared workloads keep one stable set of role assignments.

User consent settings limit which application permissions ordinary users may grant themselves. The admin consent workflow gives a blocked user a way to request approval, so risky delegated grants reach a reviewer instead of being silently allowed or silently refused.

7 to 90 days, defaulting to 90. It is set only at vault creation and can never be changed afterward, so decide before you deploy. Soft delete is on by default for new vaults and cannot be turned off once enabled.

It blocks purging a deleted vault or object until the full retention period elapses, so an attacker cannot permanently destroy keys early. It is optional, requires soft delete, and cannot be disabled once turned on.

Detects unusual or potentially harmful attempts to access a vault and alerts with the caller's object ID, user principal name, or IP address. After a confirmed alert, rotate or disable every secret, key, and certificate that was accessed.

disabled first, then append and modify, then deny, then audit, then manual, then auditIfNotExists, with denyAction last. Append and modify run early because they can change a request enough that a later deny no longer matches.

Because Azure Policy deploys the missing configuration on your behalf, so the assignment's identity must hold the roles that deployment requires. Resources that already exist stay non-compliant until you run a remediation task.

CanNotDelete permits reading and modifying but blocks deletion. ReadOnly also blocks modification, which can break operations that write behind the scenes, such as listing storage account keys. Locks are inherited by child scopes.

Owner, User Access Administrator, and Role Based Access Control Administrator. Contributor can create and manage every resource type but cannot create role assignments, which is how you delegate operational work without letting someone expand their own rights.

Only the user delegation variant is secured by Microsoft Entra credentials through a user delegation key, so no account key sits in your code. The other two rely on the storage account key, which is why Microsoft steers you away from them.

Associate it with a stored access policy on the container, then delete or change that policy. Only service SAS supports this, there is a limit of five policies per container, and an ad hoc SAS can only be killed by rotating the key.

It denies public access except from the IP ranges, virtual network subnets, and private endpoints you list. Add resource instance rules or the trusted Microsoft services exception so platform services such as backup do not break.

Scanning is billed per gigabyte and capped by default at 10,000 GB of uploaded blobs per month per storage account. Once the cap is hit, scanning stops for the month, so act on the 75 percent and cap-reached alerts.

Hash reputation only compares an uploaded blob's hash against known malware and is available in every plan. Malware scanning applies Microsoft Defender Antivirus to the full file content and is a paid feature of the current plan.

TDE encrypts the whole database at rest and is invisible to the application, so a database administrator can still read the data. Always Encrypted encrypts chosen columns in the client driver, so the engine and DBAs never see plaintext.

An Azure storage account, a Log Analytics workspace, or Event Hubs. A server-level policy applies to every database on that server, and a database-level policy adds to it rather than replacing it, so events can be written twice.

It disables SQL logins and passwords entirely, so every connection must present a Microsoft Entra identity. Shared database credentials disappear, and Conditional Access and MFA now apply to database access.

Custom rules use priorities 100 to 4096, lowest number evaluated first. Defaults sit at 65000 AllowVNetInBound, 65001 AllowAzureLoadBalancerInBound, and 65500 DenyAllInBound. You cannot delete defaults, only override them.

They let an NSG rule target a named group of network interfaces instead of IP prefixes. A new VM added to the group inherits the rules immediately, so you stop rewriting address lists every time the application scales.

Admin rules apply at the virtual network level and are evaluated first. Allow hands traffic on to NSG evaluation, but Always Allow and Deny end evaluation immediately, so an application team's NSG cannot undo a central Deny.

A private endpoint puts a private IP for the service inside your subnet and maps to one specific resource instance, so a leaked key cannot reach a different account. A service endpoint keeps the public endpoint and only identifies the source subnet.

TLS inspection, signature-based IDPS, URL filtering on the full path rather than just the FQDN, and web category matching on full URLs. IDPS ships over 67,000 signatures set to Disabled, Alert, or Alert and Deny.

Shows the aggregated inbound and outbound rules actually applied to a network interface, combining the NIC's NSG, the subnet's NSG, and Virtual Network Manager admin rules. It is how you find which rule is really blocking traffic.

A default assessment runs weekly over the top 100 SharePoint sites by usage to surface oversharing before Copilot amplifies it. Remediation options include restricting access by sensitivity label and SharePoint Restricted Content Discovery.

Raises runtime alerts on generative AI workloads for jailbreak, data leakage, data poisoning, and credential theft, using Azure AI Content Safety Prompt Shields plus Microsoft threat intelligence. It scans text tokens only, not image or audio.

User prompt attacks are jailbreak attempts typed by the person in the chat. Document attacks are instructions hidden inside grounding content such as files or email, so the attacker is a third party the user never sees.

Service principals assume stable, long-lived workloads. Agent identities are a distinct object type built for agents that are created and destroyed at scale, must be told apart from human and app identities in logs, and require an accountable sponsor. Conditional Access can then target the agent identity itself.

The llm-token-limit policy enforces a tokens-per-minute limit or a token quota against a counter key such as a subscription key or IP. One noisy application can no longer consume the whole model deployment's quota.

Encryption at host encrypts temp disks, caches, and the data flow to storage on the host itself and uses no VM CPU. Azure Disk Encryption runs in-guest BitLocker or dm-crypt and retires on 15 September 2028, so new VMs should use encryption at host.

Secure Boot refuses to boot unsigned boot loaders, kernels, and drivers. vTPM stores boot-chain measurements and enables remote attestation. Attestation fails whenever Secure Boot is off, and trusted launch requires a generation 2 VM.

Defender for Servers Plan 2 keeps deny-all inbound rules on the selected management ports in the NSG and Azure Firewall. An approved request opens them for the requester's IP for a set window, then the previous rules are restored.

It brokers RDP and SSH over TLS on port 443, so target VMs need no public IP, no agent, and no exposed 3389 or 22. Dedicated SKUs run in a subnet that must be named AzureBastionSubnet.

It registers machines running outside Azure as Azure Resource Manager resources, so Defender for Servers, Azure Policy, machine configuration, and the Azure Monitor Agent reach them exactly as they reach an Azure VM.

Covers the container lifecycle: vulnerability assessment of registry and running images, hardening recommendations for cluster configuration, agentless Kubernetes discovery, and runtime threat detection on nodes and workloads.

Detection only logs matches, which is how you tune out false positives on a new deployment. Prevention blocks with HTTP 403. Under Core Rule Set anomaly scoring the block threshold is 5, so one Critical match is enough on its own.

Recommendations from the Microsoft Cloud Security Benchmark, which foundational CSPM applies at no cost across Azure, AWS, and GCP. A higher score means lower identified risk, and recommendations are grouped into security controls.

Attack path analysis, the cloud security explorer, agentless VM vulnerability and secret scanning, AI security posture management, regulatory compliance assessments beyond the benchmark, governance rules, and risk prioritization.

Crawls your internet-facing footprint from the outside in to find unknown or unmanaged assets. It is included with the Defender CSPM plan and feeds internet-exposure data into attack path analysis and the cloud security explorer.

Connecting an AWS account or GCP project pulls its resources into the same asset inventory, recommendations, secure score, and workload protection plans, so all three clouds are assessed against one benchmark instead of three consoles.

Both can run sessions and promptbooks. Only an owner manages capacity settings, tenant-wide custom plugins, data sharing options, and the usage dashboard. Neither role by itself grants access to any underlying security data.

Reader views data, incidents, and workbooks. Responder adds managing incidents. Contributor adds creating and editing analytics rules and installing content hub solutions. Assign these at the resource group level.

Microsoft Sentinel Playbook Operator can list and manually run playbooks; Logic App Contributor is needed to create or edit them. Sentinel Contributor alone cannot run one, because playbooks are separate Logic Apps resources.

A packaged set of connectors, analytics rules, hunting queries, workbooks, playbooks, and parsers for one product, installed and updated as a single unit instead of importing each artifact separately.

The Windows Security Events via AMA connector writes to SecurityEvent, with a data collection rule choosing All events, Common, Minimal, or custom XPath filters. Windows Event Forwarding writes to WindowsEvent instead, so SecurityEvent rules will not match it.

Devices send to a Linux log forwarder VM running rsyslog or syslog-ng with the Azure Monitor Agent, listening on port 514. A data collection rule filters facilities and severities; syslog lands in Syslog and CEF in CommonSecurityLog.

An automation rule reacts to an incident or alert and can set severity, assign an owner, add tags, close it, or call a playbook. The playbook is the Logic App that performs the external action, such as isolating a device.

Analytics retention defaults to 30 days and extends to two years, with Microsoft Sentinel solution tables free to 90 days. Total retention in the data lake reaches 12 years, but lake data is not available to real-time analytics rules or hunting.