Pass Your Microsoft SC-500 Exam Easy!

Disk Encryption Set rotation affects at-rest cryptography, not who can export or share the specific snapshot resource.

Proving the original VM disk is encrypted says nothing about the distribution, export tokens or accessible copies of its snapshot.

Restoring a disk encryption key after outage does not revoke access granted to a shared snapshot.

Hub/spoke deployment checks can optimize Bastion placement but are not themselves an alternative secure access service or public ingress closure.

Session audit logging improves accountability but does not stop internet-origin RDP attempts against the exposed VM.

Checking Bastion subnet reachability is troubleshooting after deployment, not the core replacement for existing public management exposure.

Enabling additional activity logs can support diagnosis but cannot itself make the blocked management-port path reachable.

Peering topology checks are unnecessary to explain this same-VNet connection when the existing Bastion has no cross-VNet hop.

Least-privilege permissions govern who can start a session; they cannot resolve a demonstrated TCP network timeout between Bastion and VM.

Session/audit logging is important after deployment but does not answer whether a hub Bastion can reach peered spokes.

Deploying Bastion and removing public RDP/SSH exposure is a good security configuration, but it is not a prerequisite evaluation of gateway placement.

Duplicating Bastion per spoke without evaluating peering is an unsupported topology assumption that may produce needless gateways and costs.

Installing Bastion rather than direct public RDP changes exposure but does not by itself prove who used which session.

Least-privilege RBAC reduces who may log in but is not a historic record of the operator’s actual sessions.

Validating network reachability establishes sessions can connect, not authoritative operator attribution after the fact.

Audit records help review access after use, but do not narrow the partner’s existing broad owner role.

Bastion can reduce public management exposure, but its deployment alone does not revoke subscription-wide Azure Owner rights.

Permanent Owner is disproportionate to console access and permits modifying unrelated subscription resources.

Requesting a JIT window is possible only once appropriate JIT protection is already configured for the VM.

Effective-NSG analysis diagnoses exposure but does not establish a request-based time-limited access workflow.

Audit history shows JIT requests after the control is deployed, but does not remove the current always-open SSH rule.

Enabling a JIT policy is setup work already completed for this VM; the current task is a single timed request.

A permanent inbound RDP rule recreates the unnecessary exposure that JIT is intended to limit.

Inspecting NSG precedence can help if the approved connection fails but does not create the temporary access authorization.

Reviewing JIT approvals cannot override an independently permissive NSG rule admitting traffic outside approved windows.

An individual access request does not close the broad allow that exists before and after the request.

Keeping Allow Any open means connections can bypass the intended time/source restrictions regardless of JIT approvals.

A current effective NSG view indicates present packet filtering, not which identity initiated last week’s short-lived authorization.

An NSG snapshot lacks the request/approval principal and may not include expired ephemeral rule history.

JIT enablement defines future protection, but is not sufficient historical evidence of an individual maintenance request.

Policy-scope prerequisite inspection matters after registration, but cannot make a completely unmanaged on-premises server visible to Azure Policy.

Defender workload extensions can be enabled later; they do not replace the Arc resource onboarding step needed for policy targeting.

Arc connectivity troubleshooting applies once the Connected Machine agent is installed; this server has not yet been onboarded.