Pass Your Microsoft SC-500 Exam Easy!

Posture-oriented discovery identifies potentially sensitive data; it does not replace the Defender for Storage antivirus scanning feature triggered on new uploads.

On-upload scanning evaluates blob content for malware but cannot by itself provide sensitive-data-aware suspicious-access signals. Both protections are required in this case.

Storage activity monitoring detects suspicious access, but antivirus scanning of blob uploads is a separately configurable feature. Filters, unsupported objects and monthly scan caps can leave uploads unscanned.

Defender for Databases addresses SQL or other supported database services, not AKS node/pod runtime behavior.

Agentless package vulnerability scanning does not provide the live workload runtime alert stream required here.

Defender for Storage scans/access monitors Blob and other supported storage assets, not suspicious Kubernetes process execution.

Checking feature licensing alone cannot repair a resource that is outside the intended plan scope after migration.

Server sensor health matters when the affected workload is a server; the first cross-workload difference is the destination subscription’s onboarding/plan scope.

Inventory cost optimization is not evidence that a migrated resource remains protected after a subscription-scope plan change.

Checking only plan entitlements does not show whether that workload type exists in this environment or needs the plan.

Enabling a database plan is unnecessary in a subscription that has no relevant database resources.

Subscription-move re-onboarding is irrelevant where the issue is broad unnecessary plan selection rather than missing alerts.

Subscription migration settings do not ensure an active analyst receives and investigates this incident.

Reviewing server plan enablement cannot fix a notification destination when a detection was already generated.

Enabling a different Defender workload plan cannot guarantee the existing threat alert reaches an accountable responder.

A clean vulnerability scan does not rule out credential abuse or malicious process/network activity detected at runtime.

Storage on-upload malware scanning operates on stored objects, not runtime lateral movement on the compromised VM.

Defender for Databases threat protection does not automatically isolate an alerting virtual machine.

Defender for Storage applies to storage accounts and does not license VM agentless vulnerability assessment.

Migrated-subscription troubleshooting helps if previously covered workloads moved, not when the plan itself lacks the requested feature.

Enabling database threat protection is a different workload plan and cannot provide snapshot-based VM vulnerability results.

Checking feature-plan enablement is needed after connecting but cannot create the missing cloud account connector.

Resource identity reconciliation is for duplicates after account moves, not initial AWS account integration.

Token rotation addresses an already exposed credential; the requirement is to create an authorized new AWS connector.

A whole report’s incomplete assessment must be disclosed, but this incident asks which concrete GCP project is excluded by connector scope.

Rotating an uncompromised credential is unrelated until an actual connector credential issue has been established.

Broadening to every partner tenant would exceed authorized cloud-account visibility and could cause permission/privacy problems.

Onboarding is already completed; recreating the connector does not automatically enable every plan or supported detection capability.

Scope exclusions protect partner accounts but do not prove each paid workload plan is active for authorized AWS resources.

Credential revocation is necessary for leaked integration secrets, not because a healthy connector discovers inventory.

Credential rotation helps security after compromise but not an inventory join error caused by connector overlap.

Restricting visibility to authorized accounts does not itself merge representations of a single EC2 resource across moved connectors.

Creating a new AWS connector can increase duplicate views if old account links and resource IDs are not reconciled.