Microsoft SC-500 Practice Test 44

Question 430

An EASM dashboard lists three domain aliases for the SAME underlying external host and IP. The team plans three independent incidents. Which evidence-led inventory action avoids double-counting without discarding exposure?

Validate ownership and assess the external service using EASM discovery.
Preserve discovered exposure evidence and triage ownership properly.
Confirm ownership before scheduling remediation or assigning liability.
Deduplicate identities using authoritative ownership and endpoint evidence rather than treating every alias as independent risk.

Explanation

Correct Answer

Correlate host/IP/certificate/DNS and inventory relationships to consolidate confirmed aliases as one underlying asset while retaining the URLs and any distinct reachable services.

Incorrect Answers

Beginning an ownership review for one unfamiliar candidate does not correct a proven three-alias inventory duplication.

Preserving unresolved discovery evidence does not itself reconcile multiple confirmed names belonging to the same host.

Corporate ownership confirmation is helpful when a domain is disputed, but the issue here is duplicate identities for one confirmed host.

Question 431

A regional security operations team is deploying Microsoft Sentinel for the first time with a contractual restriction on log-data residence and retention. What foundational resource decision comes BEFORE onboarding the service?

Confirm Sentinel onboarding/solution enablement rather than recreating the workspace.
Select/enable an appropriately governed Log Analytics workspace and verify geographic retention requirements.
Identify the correct connected workspace and source ingestion coverage.
Check ownership, roles and supported location/configuration before changing region broadly.

Explanation

Correct Answer

Choose or create the appropriate Log Analytics workspace in the approved region and define retention/permissions, then enable Sentinel on that workspace.

Incorrect Answers

Enabling Sentinel on an existing workspace assumes a suitable workspace has already been chosen and verified for the data-residency requirement.

Finding ingestion for a second workspace is troubleshooting after deployment, not selection of the first approved regional workspace.

Changing resource ownership/roles helps when a deployment fails; the required initial decision is to select an approved ingestion and residency location.

Question 432

A Log Analytics workspace works for Azure Monitor, but no Microsoft Sentinel experience appears. Select TWO onboarding checks that activate Sentinel for the intended existing workspace instead of creating an unnecessary replacement.

Create a second Log Analytics workspace for Sentinel and treat the presence of a new workspace as proof that Sentinel is enabled on the existing one.
Confirm Microsoft Sentinel onboarding has been enabled for the existing Log Analytics workspace.
Install an Azure Activity content-hub solution and configure its connector while assuming that these actions alone onboard Microsoft Sentinel to the existing Azure Monitor workspace.
Assume that Azure Monitor metric ingestion alone proves Microsoft Sentinel is enabled on the existing workspace, without checking Sentinel onboarding.
Verify the workspace is the intended one instead of creating a duplicate solely because features are absent.

Explanation

Correct Answer

Enable Microsoft Sentinel on the intended EXISTING Log Analytics workspace; Azure Monitor alone does not automatically activate the Sentinel solution.

Identify the existing intended workspace and verify that it, rather than an unnecessary new duplicate, is the workspace being onboarded.

Incorrect Answers

Creating an unrelated new Log Analytics workspace does not activate Sentinel on the original workspace the SOC needs to use.

A content hub solution and data connector may be useful after Sentinel is onboarded, but neither alone completes onboarding of the existing Azure Monitor workspace.

Checking only Azure Monitor metric ingestion would confuse a functioning log workspace with an enabled Sentinel service; verify actual Sentinel onboarding.

Question 433

A central SOC can see Sentinel incidents from Environment A but cannot find those arising in Environment B, whose data is held in a DIFFERENT Log Analytics workspace. Which diagnostic scope should it inspect?

Select/enable an appropriately governed Log Analytics workspace and verify geographic retention requirements.
Evaluate supported cross-workspace access and data-residency constraints before consolidation.
Confirm Sentinel onboarding/solution enablement rather than recreating the workspace.
Identify the correct connected workspace and source ingestion coverage.

Explanation

Correct Answer

Confirm the incidents’ actual Sentinel-enabled workspaces, cross-workspace access and the Environment B connector and data-flow scope; incidents are not automatically unified across every workspace.

Incorrect Answers

Creating yet another regional workspace does not expose Environment B incidents already stored elsewhere.

Cross-region workspace aggregation requires compliance planning, but a broad consolidation is not the first step before locating the source workspace and checking ingestion.

Sentinel is demonstrably enabled for Environment A; re-onboarding the first workspace does not explain missing Environment B incidents.

Question 434

A Log Analytics workspace deployment that formerly worked fails after its resource group is moved and access assignments are altered. What should be checked BEFORE an administrator proposes a broad regional migration?

Select/enable an appropriately governed Log Analytics workspace and verify geographic retention requirements.
Evaluate supported cross-workspace access and data-residency constraints before consolidation.
Check ownership, roles and supported location/configuration before changing region broadly.
Confirm Sentinel onboarding/solution enablement rather than recreating the workspace.

Explanation

Correct Answer

Inspect resource group/subscription scope, inherited Azure RBAC, deployment identity, supported workspace region and current configuration before changing residency unnecessarily.

Incorrect Answers

Selecting a fresh workspace may abandon existing data and does not diagnose why deployment rights or configurations changed.

Cross-workspace incident queries cannot fix an ARM deployment authorization failure following the move.

Sentinel onboarding changes SIEM feature availability, not the ARM permission/configuration failure introduced by a resource-group move.

Question 435

The SOC wants to search security events stored in several Sentinel workspaces across countries while regulations prohibit exporting some raw records. Which design review should precede physical workspace consolidation?

Evaluate supported cross-workspace access and data-residency constraints before consolidation.
Check ownership, roles and supported location/configuration before changing region broadly.
Identify the correct connected workspace and source ingestion coverage.
Confirm Sentinel onboarding/solution enablement rather than recreating the workspace.

Explanation

Correct Answer

Assess permitted cross-workspace queries, RBAC, data-processing jurisdictions and retention obligations; use authorized federation/access where possible instead of assuming records can be moved.

Incorrect Answers

An ARM deployment permission check applies to resource changes, not cross-border data residency for existing workspaces.

Locating source workspaces identifies data, but no cross-region residency/egress authorization follows from that inventory alone.

Re-enabling Sentinel service on the workspaces does not establish permission to relocate restricted datasets.

Question 436

An incident investigator must read incidents and the supporting logs without editing Sentinel analytic rules. Select THREE access-scope checks that grant only the necessary investigator and log permissions.

Grant an incident investigator a narrow supported Sentinel reader role.
Grant Log Analytics Reader at an entire subscription merely to see one incident, without verifying the incident workspace or Sentinel authorization.
Scope the assignment to the intended workspace without permitting analytics-rule modifications.
Verify underlying log query access separately before claiming investigation access is complete.
Assign Microsoft Sentinel Responder solely for read-only investigation even though that role can change incident status and ownership.
Grant Sentinel Contributor to every investigator because that role also lets them view incidents.

Explanation

Correct Answer

Assign the supported Microsoft Sentinel Reader role at the narrow intended scope for incident investigation without giving incident-edit or rule-authoring privileges.

Apply the authorization at the intended Sentinel workspace/resource scope, avoiding permissions on unrelated workspaces or rules.

Verify that the analyst can query the necessary underlying logs in this workspace; a view of incident metadata is not sufficient if evidence tables are inaccessible.

Incorrect Answers

Subscription-wide Log Analytics Reader is wider than necessary to investigate a particular Sentinel workspace and may still not capture Sentinel incident permissions.

Sentinel Responder can modify incidents, which exceeds a read-only investigator’s need; it must not be assumed to be the least-privileged role for this task.

Sentinel Contributor permits content and analytics modifications, overprivileging an investigator who only reads incidents and supporting logs.

Question 437

An analyst with Microsoft Sentinel Reader can view incidents but the Update status/Assign incident action is unavailable. Which Azure role and workspace scope should be checked?

Inspect Sentinel responder role assignment and scope.
Assign a narrow Sentinel reader/incident access role as appropriate.
Limit contributor privileges and apply separation of duties.
Check related Log Analytics workspace query permissions separately.

Explanation

Correct Answer

Validate a Microsoft Sentinel Responder or otherwise supported incident-management role at the incident’s actual workspace scope; apply least privilege rather than contributor rights.

Incorrect Answers

Sentinel Reader is intentionally read-only and does not grant incident status or ownership updates.

Limiting contributor privileges is good governance but does not grant a read-only investigator incident-response capability.

Log Analytics query rights allow log inspection and do not alone grant Sentinel incident lifecycle modification.

Question 438

A developer who only maintains one approved detection is assigned Microsoft Sentinel Contributor across every workspace and can modify organization-wide analytics. How should these effective privileges be reduced?

Assign a narrow Sentinel reader/incident access role as appropriate.
Give the developer the broadest Sentinel Contributor permissions across workspaces to prevent accidental organization-wide edits.
Limit contributor privileges and apply separation of duties.
Check related Log Analytics workspace query permissions separately.

Explanation

Correct Answer

Restrict content-edit roles to justified workspace scope, separate author/deployer/reviewer duties and remove unnecessary global Contributor assignments.

Incorrect Answers

Sentinel Reader removes editing, but simply assigning it without removing inherited Contributor permissions leaves the dangerous grant intact.

Subscription-wide Sentinel Contributor expands the same unwanted content modification authority to more workspaces.

Log Analytics Reader is a data-query control; it does not correct overbroad Sentinel content-writing roles already held by the developer.

Question 439

A user can open a Sentinel incident panel but an associated KQL query against the underlying Log Analytics workspace returns an authorization error. Which distinct permission layer is missing?

Check related Log Analytics workspace query permissions separately.
Use time-bound least-privilege assignments and verify expiration.
Inspect Sentinel responder role assignment and scope.
Assign a narrow Sentinel reader/incident access role as appropriate.

Explanation

Correct Answer

Inspect effective Log Analytics workspace/table query permissions, resource context and applicable Azure RBAC separately from Sentinel incident permissions.

Incorrect Answers

Time-bounding an assignment limits access duration, not a missing permission to execute the source KQL query.

Responder grants incident workflow actions, not guaranteed query rights for the underlying log table or workspace.

Sentinel incident view access is already established; another Sentinel Reader assignment cannot prove KQL authorization.

Question 440

A contractor must inspect SOC incidents for exactly one month and no longer, with access limited to one Sentinel workspace. Which authorization lifecycle is appropriate?

Check related Log Analytics workspace query permissions separately.
Use time-bound least-privilege assignments and verify expiration.
Assign a narrow Sentinel reader/incident access role as appropriate.
Limit contributor privileges and apply separation of duties.

Explanation

Correct Answer

Grant a supported least-privilege workspace-scoped assignment with an explicit end date or PIM eligibility, then verify expiry/revocation after the month.

Incorrect Answers

Correcting log query permissions is relevant only if a specific query fails; it does not enforce expiry of the requested SOC role.

A perpetual Reader assignment restricts actions but violates the stated one-month authorization window.

Separating contributor duties does not establish the specified time-bounded entitlement for the contractor.

Implementing End-to-End Security Controls for Cloud and AI Workloads (SC-500) Practice Tests

Microsoft SC-500 Practice Test 42 - 10 Questions (Last Reviewed 03-Oct-2026)
Microsoft SC-500 Practice Test 43 - 10 Questions (Last Reviewed 02-Oct-2026)
Microsoft SC-500 Practice Test 44 - 10 Questions (Last Reviewed 01-Oct-2026)
Microsoft SC-500 Practice Test 45 - 10 Questions (Last Reviewed 30-Sep-2026)
Microsoft SC-500 Practice Test 46 - 10 Questions (Last Reviewed 29-Sep-2026)

Pass Your Microsoft SC-500 Exam Easy!

Question 430

Explanation

Correct Answer

Incorrect Answers

Question 431

Explanation

Correct Answer

Incorrect Answers

Question 432

Explanation

Correct Answer

Incorrect Answers

Question 433

Explanation

Correct Answer

Incorrect Answers

Question 434

Explanation

Correct Answer

Incorrect Answers

Question 435

Explanation

Correct Answer

Incorrect Answers

Question 436

Explanation

Correct Answer

Incorrect Answers

Question 437

Explanation

Correct Answer

Incorrect Answers

Question 438

Explanation

Correct Answer

Incorrect Answers

Question 439

Explanation

Correct Answer

Incorrect Answers

Question 440

Explanation

Correct Answer

Incorrect Answers

Implementing End-to-End Security Controls for Cloud and AI Workloads (SC-500) Practice Tests