Manage and monitor security posture
Domain 4 of SC-500 accounts for 20-25% of the exam. EarnYourCert has 98 original questions for this domain, all with explanations: 61 multiple choice, 17 yes/no and 20 completion or ordering items, like the real exam.
Domain 4 sample questions
8 questions from our 98-question bank for this domain. Try to answer before revealing the solution.
1. Which Defender CSPM capability helps prioritize risks by showing how an attacker could move from an internet-exposed VM to sensitive data?
- Secure score recommendations without attack paths
- Attack path analysis and the cloud security explorer
- The regulatory compliance dashboard for ISO standards
- Just-in-time access requests for management ports
Show answer
Correct answer: B. Attack paths prioritize exploitable risk chains.
2. How can you assess AWS and GCP resources in Defender for Cloud?
- Only Azure resources can be assessed
- Connect the cloud accounts with multicloud connectors
- Migrate the AWS and GCP resources to Azure first
- Upload resource inventories as CSV files manually
Show answer
Correct answer: B. Connectors enable CSPM and workload protection across clouds.
3. Which Defender for Cloud feature lets you apply the same security standard to many subscriptions and track compliance across them?
- A subscription-level secure score only
- Azure Policy exemptions
- Security standards assigned at management group level
- Resource group tags
Show answer
Correct answer: C. Standards can be assigned at scale.
4. Which connector brings Azure subscription control plane events into Sentinel?
- Windows Security Events
- CEF via AMA
- TAXII
- Azure Activity
Show answer
Correct answer: D. Azure Activity logs capture management operations.
5. Which Sentinel capability triggers a Logic Apps workflow to isolate a device when a high-severity incident is created?
- An automation rule that runs a playbook
- A watchlist
- A workbook
- An analytics rule alert grouping setting
Show answer
Correct answer: A. Playbooks run response actions.
6. Incidents from an analytics rule must show the affected account and host as entities for investigation. What should you configure in the rule?
- Entity mapping
- A higher query frequency and a longer lookback period
- Alert grouping only
- Data retention
Show answer
Correct answer: A. Entity mapping turns query columns into entities used by investigation graphs and UEBA.
7. What do plugins in Security Copilot provide?
- Data and actions from Microsoft and third-party security tools
- Dedicated hardware for running the language models locally on-premises
- A DNS service that resolves product endpoints
- A separate tenant for each connected product and its administrators
Show answer
Correct answer: A. Plugins extend the sources Copilot can use.
8. What should administrators review periodically for Security Copilot plugins and agents?
- Which plugins and agents are enabled, their permissions and usage
- Only whether product names and descriptions are spelled correctly in the list
- Only the color theme of the portal
- The DNS zone of the organization and the certificates used by each plugin
Show answer
Correct answer: A. Governance of extensions reduces risk.