Microsoft SC-500 - Microsoft Certified: Cloud and AI Security Engineer Associate

Filtering must happen before data is written to the Log Analytics workspace. With Azure Monitor Agent, Syslog collection is governed by data collection rules, and DCR transformations or filtering can reduce ingestion before records reach the workspace. An ASIM parser normalizes queried data after ingestion, an analytics rule detects conditions after data exists, and a table-level transformation is not the primary collection control for Linux Syslog from AMA in this scenario. The posture and monitoring objective focuses on turning security data into usable operational outcomes. The correct answer either collects the right signal, grants the right security-operations role, or automates incident handling at the correct layer. Distractors often provide dashboards, queries, or broad permissions, but those do not create the requested workflow or least-privilege security capability. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > Syslog event collection; Microsoft Learn > data collection rules for Azure Monitor Agent.

==============================================================

Defender for Storage can be configured at the subscription level and overridden at the individual storage account level. Because the subscription cap is 10,000 GB but storage1 needs its own 2,000 GB monthly cap, the correct action is to enable the storage-account override and configure the account-specific malware scanning limit. Sentinel ingestion caps and DCR filtering affect logs, not the malware scanning volume cap. For this domain, least privilege means granting only the required data operation or allowing only the required network flow. The correct response avoids shared keys, broad peering, general contributor roles, or log-only controls when the scenario demands prevention, routing, event triggering, or account-specific configuration. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > Defender for Storage configurations; Microsoft Learn > override subscription-level Defender for Storage settings.

==============================================================

Statement

Answer

User2 can connect to https://10.20.30.40.

No

User3 can connect to https://intranet.corp.contoso.com.

Yes

User1 can connect to https://intranet.corp.contoso.com:8443.

No

Microsoft Entra Private Access applies access at the application-segment level, and an application segment is defined by attributes including the destination FQDN or IP address and the destination port. Users must be assigned to the corresponding enterprise application to access its defined segments. Microsoft specifically documents that Private Access supports precise per-app segmentation using FQDNs, IP addresses, ports, and user/group assignments.

User2 = No. User2 is assigned only to App2, which permits 10.20.30.40 on port 8443. https://10.20.30.40 without an explicit port uses HTTPS default TCP 443, so it does not match App2 ' s segment.

User3 = Yes. User3 is assigned to App1, whose wildcard FQDN *.corp.contoso.com on port 443 matches intranet.corp.contoso.com. Microsoft supports wildcard FQDN segments such as *.contoso.com with explicitly configured ports.

User1 = No. Although intranet.corp.contoso.com matches App1 ' s wildcard FQDN, User1 is authorized only for port 443. Specifying :8443 causes the connection to fall outside App1 ' s configured segment.