Pass Your Microsoft SC-500 Exam Easy!

Runtime threat telemetry is a different detection signal; a healthy EDR sensor does not prove that vulnerability packages were recently reassessed.

Exposure-aware prioritization and compensating controls are remediation planning, not evidence that the latest vulnerability scan is current.

Updating an image template without deploying to this running VM or fixing scanning coverage leaves the current assessment stale.

Patching only the current VM leaves the unchanged base image vulnerable so the next redeployment reintroduces the flaw.

Compensating controls are temporary when a patch is delayed; the scenario says a source image still repeatedly reintroduces the defect.

EDR telemetry is useful for detecting attacks but does not stop the deployment pipeline from recreating a known vulnerable package.

An enabled Plan 2 subscription does not waive required key permissions for scanning customer-managed encrypted disks.

Waiting for normal scan discovery will not solve the specifically missing Key Vault authorization on the disk encryption key.

EDR sensor instrumentation is separate from snapshot-based agentless vulnerability assessment and cannot authorize encrypted disk snapshots.

Agentless scan eligibility establishes periodic posture coverage, not the runtime process and network events EDR relies on.

Increasing agentless scan cadence does not install or replace continuous EDR instrumentation and cannot provide per-process behavior events.

Checking snapshot scan-plan state cannot activate continuous endpoint monitoring in the guest.

EDR setup is orthogonal to agentless disk-snapshot vulnerability assessment and does not explain its missing output.

Assuming enrollment from the subscription without inspecting VM disk size, supported state, key permissions or scanning exclusions can hide an actual gap.

Waiting for the next scan is reasonable after verifying eligibility and the 24-hour scan cycle; it cannot resolve an unsupported machine or disabled plan.

Running more snapshots does not provide in-guest process interception or real-time threat protection.

Validating supported scan coverage ensures useful inventory but does not turn vulnerability findings into blocking actions.

Checking report freshness cannot prove an endpoint will block malicious execution as it occurs.

The distinction between vulnerability posture and continuous EDR is unrelated to the delay of this VM’s first agentless assessment.

Plan and disk eligibility were confirmed; the next diagnostic is whether the scanner has had time to include the newly created machine.

Eligibility and plan prerequisites are already established by the scenario; rechecking them alone does not explain first-scan scheduling.

Image, generation and size compatibility checks are prerequisites, not the boot-chain enforcement mechanism itself.

vTPM measures and protects boot keys/integrity evidence, but without Secure Boot it does not itself enforce signature validation of boot binaries.

Boot measurement review can detect integrity issues, but does not configure Secure Boot to reject unsigned boot components.

Secure Boot validates signed boot components; it does not by itself provide a TPM-backed store for application keys.

Generation/image prerequisite checks are useful, but they do not activate the required vTPM component.

A boot attestation alert investigation is a separate response to altered measurements, not initial provision of a TPM-backed key store.

Changing Secure Boot settings without understanding the attestation result risks masking tampering or causing incompatibility.

Enabling vTPM is a configuration requirement, not a substitute for investigating why the latest measurements changed.

Disk encryption and boot integrity are separate protection domains; knowing data is encrypted does not explain a suspicious boot measurement.

Attempting to turn on vTPM before meeting Gen2/security-type prerequisites will not remedy image incompatibility.

Attestation incident triage is not the reason the feature cannot be configured on this machine.

Merely adding a securityType field cannot make an incompatible Gen1 image or unsupported size accept Secure Boot and vTPM.