SC-500 Implementing End-to-End Security Controls for Cloud and AI Workloads

At the Azure SQL logical server level, SQL authentication must be disabled for every hosted database. Which configuration centrally enforces this?

• A. Configure a Microsoft Entra administrator
• B. Enable a managed identity
• C. Enable Microsoft Entra-only authentication
• D. Remove logins from one database

Tenant user consent is disabled. An app uses delegated Microsoft Graph permissions and must let signed-in users access Graph without consent prompts. What should an administrator do?

• A. Require user assignment in Enterprise Applications
• B. Replace delegated permissions with application permissions
• C. Rely on user consent at sign-in
• D. Grant admin consent to the delegated permissions

For an AI Administrator role, elevated access must be approved and removed automatically after a fixed activation period. Which two PIM settings meet these requirements?

• A. Expire active assignments after
• B. Require approval to activate
• C. Require justification on activation
• D. Expire eligible assignments after
• E. Set activation maximum duration

A Microsoft Entra Global Administrator must remove the only Owner assignment on a subscription beneath a management group. What should the administrator do first?

• A. Move the subscription to another management group
• B. Assign User Access Administrator at the subscription
• C. Request Security Administrator through PIM
• D. Enable Access management for Azure resources

A policy must require private endpoints for new Microsoft Foundry deployments under a management group, while leaving one resource group exempt. How should the policy be assigned?

• A. At the management group and exclude the exception resource group
• B. At the exception resource group
• C. At the management group and include only the exception group
• D. At one subscription without excluding the exception group