Pass Your Microsoft SC-500 Exam Easy!

Attempting to turn on vTPM before meeting Gen2/security-type prerequisites will not remedy image incompatibility.

Attestation incident triage is not the reason the feature cannot be configured on this machine.

Merely adding a securityType field cannot make an incompatible Gen1 image or unsupported size accept Secure Boot and vTPM.

Generation/image compatibility matters when planning secure boot, but it is not proof that storage encryption verifies boot-loader integrity.

Enabling vTPM contributes to boot measurement/secret protection, but does not replace mandatory storage confidentiality checks.

A boot attestation alert may identify a failed measurement, but it does not make disk encryption and platform boot validation equivalent.

Arc coverage checks apply to the hybrid subset, not the requested baseline assignment for the entire supported fleet.

Eligibility verification alone cannot assess each required guest OS setting without an actual machine configuration assignment.

Investigating an outdated evaluation is a later step if a deployed assignment already reports stale compliance.

Assessment refresh is not useful until the machine is eligible for this specific policy definition.

Changing a NotApplicable result to Compliant without assessment would fabricate policy evidence.

Reassigning the same policy cannot make an unsupported guest OS capable of the missing rule evaluation.

Arc extension checks are only relevant if this is an Arc-connected host with missing prerequisites; an old assessment timestamp must first be established.

Checking OS support is appropriate for NotApplicable results, not automatically for an earlier valid evaluation that has simply not refreshed.

Manually flipping dashboard status without a new guest assessment destroys evidence integrity.

Waiting for refresh is reasonable only after establishing the Arc targets actually received an applicable assignment and can evaluate it.

Reassigning a generic machine configuration policy without checking the Arc scope/agent may leave the original gap intact.

Assigning only Azure-native VM resource types excludes Arc machines; they do not inherit VM policy scope simply by being visible in Azure.

Hardening pod securityContext limits future privileges but is not evidence of what triggered the current observed process execution.

Rebuilding an old vulnerable image could be necessary later but does not establish what process actually ran during this live runtime alert.

The existence of a runtime alert indicates at least some sensor coverage; checking general plan state cannot replace investigating the specific event.

Runtime alert investigation responds to observed attacks, but does not replace vulnerable package versions in the registry image.

Pod security context can reduce runtime privileges but does not remove vulnerable dependencies embedded in the image.

Defender enrollment verifies visibility, not that the affected packages were patched in the running container.

Changing pod runtime user privileges does not register the migrated cluster for Defender discovery and telemetry.

Alert triage investigates events already captured; this cluster is absent from monitoring and may not be onboarded after migration.

An old cluster entry does not prove newly created node pools or cluster IDs are protected; coverage must be verified against current resources.

Investigating detections is useful for suspicious executions but does not change the explicitly unsafe securityContext permissions.

Image vulnerability scanning does not constrain what Linux capabilities the running pod is granted by its deployment manifest.

Rebuilding the base image for vulnerable packages does not by itself correct a manifest that still requests privileged root execution.

Network policy controls pod traffic; it does not prevent an overprivileged human from modifying cluster resources through the API.

A private AKS API server limits network reach but does not remove cluster-admin from an already authenticated developer.

Workload identity replaces pod static credentials, which does not restrict this developer’s Kubernetes API RBAC for viewing logs.