Microsoft SC-500 - Microsoft Certified: Cloud and AI Security Engineer Associate

Create a Conditional Access policy that targets the agent identities and evaluates agent risk. Microsoft Entra Conditional Access now supports agent identities as a dedicated policy target and can use risk signals from Microsoft Entra ID Protection to automatically block high-risk agents from accessing organizational resources. Microsoft explicitly documents a policy pattern for blocking high-risk agent identities by selecting Agents under the identity scope, targeting all relevant resources, and configuring the Agent risk condition to High. Microsoft Learn

For agent identities, the available enforcement action is effectively Block access, because autonomous agents cannot satisfy interactive remediation controls such as MFA. Microsoft also recommends dedicated agent-specific Conditional Access policies rather than relying on policies designed for human users. Microsoft Learn

A Microsoft Entra role assignment policy controls role governance rather than runtime resource access based on risk. A PIM activation policy governs privileged-role activation and is not designed to react automatically to agent sign-in risk. An Access Review periodically evaluates whether identities should retain access, but it does not provide immediate risk-based enforcement.

Therefore, the correct automated control is:

Correct answer: A. a Conditional Access policy for the identities

To customize the baseline: Use Azure Machine Configuration; Set enforcement mode to: Apply and Autocorrect

Azure Machine Configuration is the correct mechanism for applying and customizing guest configuration baselines across Azure VMs and Azure Arc-enabled servers. It integrates with Azure Policy and can enforce configuration through assignment modes such as Apply and Autocorrect. This provides centralized compliance and automatic correction without building a separate configuration-management pipeline for Windows and Linux servers. The compute domain tests whether protection is applied before deployment, during runtime, or through posture assessment. The selected answer matches the phase described in the requirement. Detection-only tools are not acceptable when the requirement says prevent, and local installation methods are inferior when Defender for Cloud, Azure Policy, or Azure Machine Configuration can enforce the control centrally. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > Azure Machine Configuration; Microsoft Learn > assignment modes and remediation.

Approval before elevation is implemented by requiring approval to activate the PIM role. Automatic removal after a fixed active period is controlled by the activation maximum duration. Expiring active or eligible assignments governs the assignment lifecycle, not the duration of each activation session. Requiring justification can improve audit quality, but it does not ensure that another administrator evaluates the request or that access ends after the configured active window. This domain is tested through precise scope control: tenant, subscription, resource, application, and data-plane authorization are not interchangeable. The correct choice applies the smallest identity or governance control that enforces the stated requirement. Options that only add users, create registrations, or provide broad administrator access fail because they do not directly enforce the requested access behavior. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > Privileged Identity Management; Microsoft Learn > configure role activation settings.

==============================================================

Defender CSPM must be enabled because Microsoft Defender for Cloud ' s risk prioritization capability is part of the paid Defender CSPM plan and isn ' t included with Foundational CSPM. Foundational CSPM provides baseline posture-management functions and security recommendations, but recommendations can remain Not evaluated for risk when the resources aren ' t protected by Defender CSPM. Microsoft explicitly identifies Defender CSPM as the prerequisite for recommendation risk prioritization.

Defender CSPM enriches recommendations with contextual risk factors such as Internet exposure, resource sensitivity, exploitability, lateral-movement potential, and business impact. Those factors are used to classify recommendations into risk levels such as Critical, High, Medium, and Low.

Enabling Defender for Servers Plan 2 supplies workload protection capabilities for servers but doesn ' t enable CSPM risk prioritization across Azure and AWS recommendations. Azure Arc onboarding isn ' t required merely to obtain risk levels for an already connected AWS environment. Similarly, assigning the CIS AWS Foundations standard changes which compliance assessments are evaluated; it doesn ' t activate Defender for Cloud ' s recommendation risk-ranking engine.

Therefore, the required change is to upgrade from Foundational CSPM to Defender CSPM.

===============

Set Allow storage account key access to Disabled. This setting controls the storage account ' s allowSharedKeyAccess property. When it is disabled, Azure Storage rejects requests authenticated by using the account access keys through Shared Key authorization, forcing supported data access to use Microsoft Entra-based authorization instead. Microsoft specifically recommends disabling Shared Key when organizations require Microsoft Entra ID authentication. Microsoft Learn

Option A does not meet the requirement. Setting the portal ' s default authorization method to Microsoft Entra changes the preferred portal experience, but it does not prevent clients from continuing to authenticate with an account key. The requirement says requests must be accepted only when authorized through Microsoft Entra ID, so Shared Key must actually be disabled.

A stored access policy controls permissions and validity for service SAS tokens and does not enforce Microsoft Entra authentication. Similarly, Secure transfer required enforces HTTPS/TLS transport but has no effect on whether authentication uses Microsoft Entra ID or Shared Key.

Microsoft documents the exact portal procedure under the storage account ' s Configuration page: set Allow storage account key access = Disabled. When this is done, Shared Key-authenticated requests are rejected.

Statement

Answer

When using SAS1, User1 can write to container2 on December 5, 2025.

Yes

When using SAS1, User2 can write to container1 on December 20, 2025.

Yes

When using SAS1, User1 can read from container2 on January 10, 2025.

No

The first statement is Yes. SAS1 is an account SAS for the Blob service, includes the Container resource type, includes Write/Create permissions, and is valid on December 5, 2025. A client using SAS1 is authorized according to the permissions and validity window embedded in the SAS rather than User1’s Azure RBAC role. Microsoft documents that an account SAS delegates access according to its selected services, resource types, permissions, and start/expiry times.

The second statement is also Yes. December 20 is within the SAS1 validity window. Although container1 has Policy1, stored access policies apply to service SAS, not to an account SAS. Microsoft explicitly states that stored access policies are not supported for account SAS tokens. Therefore, Policy1 ' s Read-only restriction does not constrain SAS1.

The third statement is No because January 10, 2025 occurs before SAS1 starts on December 1, 2025. A SAS request outside its validity interval is rejected regardless of the user ' s Azure RBAC assignment.

Microsoft Defender for Cloud provides native multicloud connectors for Amazon Web Services (AWS) and Google Cloud Platform (GCP). Therefore, both the AWS account and GCP environment can be connected to Defender for Cloud for cloud security posture management and supported workload-protection functionality. Microsoft ' s current multicloud support matrix explicitly covers Azure, AWS, and GCP and lists Defender CSPM, Defender for Servers, Defender for Containers, and several other capabilities across AWS and GCP. Microsoft Learn

For GCP, Defender for Cloud provides a dedicated onboarding workflow under Environment settings > Add environment > Google Cloud Platform, allowing projects or organizations to be connected and assessed. AWS has an equivalent native cloud connector mechanism. Microsoft Learn

Alibaba Cloud is not one of the native cloud environments that can be added through Defender for Cloud ' s multicloud connector model. Microsoft ' s documented supported multicloud environments are AWS and GCP in addition to Azure. Individual servers hosted elsewhere could potentially be onboarded through other mechanisms such as Azure Arc where supported, but that is different from connecting an Alibaba Cloud account as a cloud environment.

Therefore, the supported cloud accounts in the question are:

AWS and GCP only.

===============