Pass Your Microsoft SC-500 Exam Easy!

Inspecting NAT addresses helps establish which public source a legitimate client uses. It does not remove a known obsolete range that continues admitting unwanted requests.

Disabling all public network access can block the obsolete range, but it would also disconnect the expressly required public vendors. The change needs to retain legitimate approved IPs rather than replace the business network model.

Creating narrow rules for a vendor is necessary if approved entries are missing, but appending more allow rules without deleting the stale range leaves the original unauthorized reachability intact.

Routing a threat alert to a monitored responder is useful but insufficient for the specific immediate investigation. Without examining the requests and the container or account anonymous-read permissions, analysts cannot tell whether the observed enumeration represented failed probes or actual public disclosure.

On-upload malware scanning detects supported malicious file content. It does not establish whether an anonymous caller enumerated stored blobs or whether public read permission remains enabled. Enabling a different Defender capability leaves the access exposure undiagnosed.

Storage service-side encryption protects stored bytes but does not decide whether anonymous clients can retrieve them through the Blob endpoint. A container can be encrypted at rest yet publicly readable; the team must inspect exposure and requests, not just encryption.

Quarantining a flagged object is a response after a malware verdict exists; it does not enable on-upload scanning for unscanned blobs merely because CSPM is active.

Encryption at rest protects stored bits but does not evaluate uploaded blob contents for malware. The missing capability is an active Defender for Storage malware-scanning configuration.

Investigating suspicious access alerts may address active misuse, but it cannot prove newly uploaded content is scanned by the separate on-upload malware feature.

Forwarding alerts without monitoring while still processing the malicious blob fails the explicit containment requirement.

Plan verification is useful when alerts are absent, but the object already has a malware verdict; that is not the immediate containment action.

Global SAS revocation without scoped incident evidence risks an unrelated outage and does not provide first containment of the flagged attachment.

Confirming that encryption at rest and logging are configured helps establish security posture, but neither invalidates the reported token. The actor may continue using it until its expiry or until the signing policy or key is effectively revoked.

Quarantining a newly uploaded malware sample is appropriate for a malicious-file alert, not for a suspicious SAS used to read existing blobs. The affected authentication capability is the primary containment target in this case.

Making a container private can stop anonymous reads, but this incident involves a signed SAS, which is an authorization bearer token. Changing anonymous container access alone does not invalidate a compromised SAS with explicit read permission.

Investigating the newest storage threat alert is reactive and cannot by itself establish whether all intended storage accounts are onboarded. A subscription-wide assurance request requires checking the actual protection state of every in-scope account and its exceptions.

A single successfully protected account is not evidence of consistent subscription coverage. Per-account configuration or overrides can differ, and features or caps can be disabled independently; the investigation must inspect each intended storage account.

Checking encryption or public access settings is important baseline hardening but says nothing definitive about Defender for Storage malware scanning, sensitive-data threat detection, or the effective account-level plan and exceptions.

Quarantining one confirmed malicious attachment is valid incident containment but cannot establish whether other blobs were skipped because of a configured exclusion, exhausted volume cap, or failed scan. Coverage requires assessing the results of each object.

Distinguishing malware alerts from encryption-at-rest evidence is useful, but it does not address the false conclusion that every individual blob was scanned. The actual uncertainty is scan coverage, exclusions, throughput and account-specific monthly volume limits.

Checking that the protection plan is enabled is necessary, but plan enablement does not mean all content has a clean scan verdict. A monthly cap or exclusion may leave newly uploaded objects unscanned even while the broader account plan remains active.

Blindly quarantining all customer documents can disrupt legitimate processing, and the alerts may concern anomalous authentication or data access rather than malicious file content. Responders should triage the specific detection and then apply appropriate containment.

Investigating a specific anonymous-access alert may be a later response step. The scenario describes an operational routing failure across alerts; first ensure the SOC actually receives and owns them before deciding case-specific technical remediation.

Encryption-at-rest compliance cannot replace a functioning incident-delivery path. Even encrypted documents may be accessed through a compromised SAS or identity, and the threat-detection evidence still needs a responsible human or automation consumer.

Token revocation is a containment action for exposed SAS or key-signed access. No compromised token is identified in this question, and revoking a token would not establish that the stored blobs meet their at-rest encryption and key-management requirements.

Checking Defender plan enablement tells auditors whether a workload threat-detection feature is in scope. It does not prove encryption key ownership, encryption settings, key lifecycle, or whether stored data is appropriately protected by other baseline controls.

Suspicious public-blob access is an important threat to investigate, but reviewing an alert does not demonstrate approved key ownership or encryption configuration for the entire storage account. The required fix is a distinct control assurance test.

An account SAS may authorize broad resources and operations beyond a single blob. A 30-day token with service listing exceeds both the intended read-only operation and the 15-minute expiry, increasing the effect of accidental disclosure.

Disallowing Shared Key authorization is a storage hardening measure and can force Entra-backed alternatives, but it does not itself provide a temporary authorization token. The customer still needs an appropriately scoped credential for that specific blob.

An indefinite account-wide role assignment is significantly broader and longer lived than the single-blob, 15-minute requirement, and an external customer may not have an established Entra principal. A resource-scoped short-lived delegation is more appropriate.

Revocation and SAS expiry response are useful after a token has been issued, but do not choose a delegation mechanism that avoids storage account keys.

A time-limited SAS is not necessarily keyless; a service or account SAS can still be signed using the storage account key.

Disabling Shared Key can improve account security, but the question seeks a way for the service to issue delegated blob access without possession of the account key.