Microsoft SC-500 Practice Test 50

Question 490

A Security Copilot output cites a Defender alert that the requesting analyst CANNOT open in the source portal. What must investigators verify about effective identity and plugin authorization BEFORE trusting the citation?

Assign a supported Copilot platform role separately from Entra/Defender rights.
Enforce on-behalf-of effective source authorization and investigate plugin identity context.
Revoke Copilot platform permissions and validate source access removal.
Check the underlying Defender data permission, not only Copilot platform access.

Explanation

Correct Answer

Inspect the plugin’s on-behalf-of or configured service identity, source-side effective RBAC, returned record provenance and any cache; prevent cross-principal data exposure and validate the actual source item.

Incorrect Answers

Granting broader Copilot platform administration would not establish whether the underlying alert citation respected the user’s Defender authorization.

Removing all Copilot membership might prevent future prompts but does not explain a possibly overprivileged plugin retrieval path.

Checking the analyst’s Defender Reader role is necessary, yet alone cannot establish whether the plugin executed as that analyst or under a separate overprivileged connection.

Question 491

An incident summary lacks endpoint telemetry because the approved Microsoft Defender plugin is currently DISABLED in Security Copilot, although the user’s source-data role is verified. What specific change restores the endpoint source?

Enable and validate the appropriate supported Defender plugin and data rights.
Assess trust, data-sharing, permissions and approved catalog entry before enabling it.
Deny the broad grant and authorize only justified connector permissions.
Refresh credentials for an unrelated Copilot connector while leaving the Microsoft Defender endpoint-data plugin disabled.

Explanation

Correct Answer

Enable the approved Defender-related Security Copilot plugin and confirm it can read endpoint events under the current caller’s supported source roles.

Incorrect Answers

Catalog approval checks precede plugin enablement, but alone do not restore endpoint telemetry in the current summary.

Reducing broad grants is useful for risk control but does not make a currently disabled endpoint-data plugin available.

Refreshing an unrelated connector credential cannot supply missing endpoint data while the relevant Defender plugin remains disabled.

Question 492

Before enabling a Security Copilot external plugin, its authorization request asks for tenant-wide mailbox write permission although the SOC only needs to read one approved alert source. How should this SPECIFIC scope request be handled?

Keep retrieved tool content untrusted and enforce action authorization separately.
Assess trust, data-sharing, permissions and approved catalog entry before enabling it.
Restore approved connector authentication and verify on-behalf-of identity access.
Deny the broad grant and authorize only justified connector permissions.

Explanation

Correct Answer

Deny the tenant-wide permission request and authorize only the technically necessary, approved least-privileged source/operation scopes; test the plugin after the narrow grant.

Incorrect Answers

Treating returned text as untrusted prevents instruction injection but does not fix excessive API privileges at the authorization layer.

Publisher/catalog review is a separate trust gate; even a trusted plugin must not be granted unrelated mailbox-wide permissions.

Rotating connector credentials restores authentication but does not reduce the new plugin’s excessive Microsoft Graph mail-writing scope.

Question 493

A contributor proposes installing a new community Security Copilot plugin from an UNVERIFIED publisher into a workspace with sensitive incident data. What evaluation should precede activation?

Enable and validate the appropriate supported Defender plugin and data rights.
Keep retrieved tool content untrusted and enforce action authorization separately.
Deny the broad grant and authorize only justified connector permissions.
Assess trust, data-sharing, permissions and approved catalog entry before enabling it.

Explanation

Correct Answer

Validate publisher provenance, approved catalog/organizational policy, plugin package behavior, data transfers and permissions, then approve or reject installation using accountable change control.

Incorrect Answers

Enabling a built-in Defender plugin does not authorize an unrelated unknown publisher’s community extension.

Prompt-injection protections reduce malicious-instruction risks but do not vet the publisher’s trustworthiness or data-sharing terms.

Denying a particular broad API permission matters when the requested scopes are known; here the publisher, data processing and plugin behavior have not yet been established.

Question 494

An approved Security Copilot plugin remains enabled but its separate upstream service identity was rotated and all connector requests now return Unauthorized. What must be restored?

Deny the broad grant and authorize only justified connector permissions.
Reenable the Security Copilot plugin toggle but leave its rotated connector credentials expired and unrepaired.
Restore approved connector authentication and verify on-behalf-of identity access.
Enable and validate the appropriate supported Defender plugin and data rights.

Explanation

Correct Answer

Reconfigure the approved connector authentication (or supported on-behalf-of identity path), ensure only necessary source grants and test authenticated retrieval without retaining the old secret.

Incorrect Answers

Restricting excessive permissions is worthwhile but cannot by itself restore a previously approved missing connector credential.

Toggling the plugin back on does not update its rotated or expired upstream credential/token or reauthorize the source.

Enabling another Defender plugin cannot repair the broken authentication of this existing external connector.

Question 495

A third-party Microsoft Security Copilot plugin is approved only for threat-intelligence ENRICHMENT. Its retrieved response contains text telling the SOC agent to isolate devices and reset accounts, even though the authorized workflow has no remediation request. Which SECURITY COPILOT PLUGIN/WORKFLOW control should the owner enforce before permitting any such action?

Renew the third-party plugin credential and treat all returned commands as approved remediation because the connector can authenticate.
Reduce unrelated mail-read consent for the plugin but let its returned text invoke a device-isolation tool whenever it contains an imperative.
Enable a second Microsoft Defender data plugin so the untrusted partner response automatically acquires trusted instruction priority.
Keep the third-party plugin result as untrusted evidence, restrict usable plugins and write-capable operations to the approved workflow, and separately verify the effective principal and target-service permission before any remediation.

Explanation

Correct Answer

Security Copilot owners govern plugin availability; source access depends on actual connector and downstream Entra/RBAC permissions. Treat third-party enrichment as lower-trust evidence and require a separately authorized live-response workflow. A plugin result is not approval to change endpoint or account state.

Incorrect Answers

Successful plugin authentication proves a connector identity, not the trustworthiness of its returned text or permission to execute every instruction it contains.

Limiting an unrelated OAuth scope does not stop prompt-injected text from reaching a separately available action tool. The action boundary must be enforced where the live remediation is authorized.

Another enabled data connector might add investigation context, but cannot grant instruction authority to a compromised or untrusted plugin response.

Question 496

A SOC plans to deploy a Microsoft-published Security Store triage agent for routine incident enrichment, and no agent has been deployed yet. What is the supported rollout approach?

Enable a supported approved agent and test access scope and output accuracy against real cases.
Regression-test the updated agent and its source connectors before broad rollout.
Disable the agent and revoke orphaned permissions and tokens.
Reject overbroad grants and evaluate least-privileged approved use.

Explanation

Correct Answer

Choose an approved supported Security Store agent, verify deployment prerequisites/licensing, minimal source permissions, run the onboarding workflow and validate output on representative permitted cases.

Incorrect Answers

Regression-testing an UPDATED existing agent is a later lifecycle task; this agent has not yet been onboarded or permissioned.

Disabling orphaned agents is a retirement operation, not the initial authorized triage deployment.

A least-privilege grant review is necessary but alone does not select, deploy or validate a new triage agent.

Question 497

A newly selected Security Store investigation agent demands READ access to every mailbox in the tenant despite a narrow incident-response use case. How should its consent be handled?

Enforce an authorized action boundary and verify the actual tool result.
Reject overbroad grants and evaluate least-privileged approved use.
Regression-test the updated agent and its source connectors before broad rollout.
Disable the agent and revoke orphaned permissions and tokens.

Explanation

Correct Answer

Reject the unjustified tenant-wide grant, scope the agent to the minimum necessary approved data and identities, and verify whether the vendor supports those restrictions before enabling.

Incorrect Answers

Approval gates for live containment actions do not make overly broad mailbox read privileges appropriate.

Testing outputs after an upgrade does not justify over-scoped mail access that should be denied before deployment.

Deleting an already-retired agent is unrelated to evaluating excessive permissions on a newly proposed integration.

Question 498

A Security Copilot agent, intended only to SUMMARIZE incidents, automatically sends a Defender endpoint-isolation request after reading an alert. Which control is required before trusting any claimed isolation?

Regression-test the updated agent and its source connectors before broad rollout.
Enforce an authorized action boundary and verify the actual tool result.
Disable the agent and revoke orphaned permissions and tokens.
Enable a supported approved agent and test access scope and output accuracy against real cases.

Explanation

Correct Answer

Enforce explicit allowlisted actions, approved human/automated authorization, least-privileged connector roles and authoritative Defender device-status verification; a summary is not permission to isolate.

Incorrect Answers

General regression tests are useful but do not create a per-action authorization and evidence-of-execution requirement.

Retiring the entire agent might be a containment response, but the central design problem is that a summarization task crossed an unauthorized device-action boundary.

Enabling another agent supplies no authorization for a high-impact endpoint response.

Question 499

After a Security Store agent version update, its incident summaries cite different security records, but the team has not checked plugin or data-source behavior. What is necessary BEFORE wide rollout?

Disable the agent and revoke orphaned permissions and tokens.
Regression-test the updated agent and its source connectors before broad rollout.
Enforce an authorized action boundary and verify the actual tool result.
Approve the modified security agent for production solely because its display name and model version match the prior release.

Explanation

Correct Answer

Run version-specific regression tests on known incidents, citations, source connector auth, scopes and tool actions; investigate any changed evidence or omission before promotion.

Incorrect Answers

Agent offboarding is appropriate for retirement, not the normal first response to a potentially correct but unverified version upgrade.

Enforcing action approval protects live changes but does not prove that updated investigation summaries cite correct supporting evidence.

A matching display name/model version is not proof that plugin source mappings or citation accuracy were preserved.

Question 500

A retired Security Store agent still has functioning connector permissions. Select TWO retirement actions that remove both agent execution and its remaining connector access.

Enable a supported approved agent and test access scope and output accuracy against real cases.
Disable the retired Security Store agent through supported lifecycle controls.
Regression-test the updated agent and its source connectors before broad rollout.
Revoke connector permissions/tokens associated with the retired agent and verify no residual access.
Reject overbroad grants and evaluate least-privileged approved use.

Explanation

Correct Answer

Disable the deprecated agent using supported lifecycle/administrative controls so it cannot continue execution.

Revoke the retired agent’s connector tokens, source roles and permissions, verifying the connector no longer accepts its credentials.

Incorrect Answers

Enabling a new approved agent is a separate change and does not revoke the retired agent’s runtime or connector privileges.

Regression-testing a replacement improves deployment safety, but is not evidence that the retired agent has been deactivated and disconnected.

General least-privilege review is useful but does not deactivate the existing retired agent or revoke its currently valid connectors.

Implementing End-to-End Security Controls for Cloud and AI Workloads (SC-500) Practice Tests

Microsoft SC-500 Practice Test 48 - 10 Questions (Last Reviewed 27-Sep-2026)
Microsoft SC-500 Practice Test 49 - 10 Questions (Last Reviewed 26-Sep-2026)
Microsoft SC-500 Practice Test 50 - 10 Questions (Last Reviewed 25-Sep-2026)

Pass Your Microsoft SC-500 Exam Easy!

Question 490

Explanation

Correct Answer

Incorrect Answers

Question 491

Explanation

Correct Answer

Incorrect Answers

Question 492

Explanation

Correct Answer

Incorrect Answers

Question 493

Explanation

Correct Answer

Incorrect Answers

Question 494

Explanation

Correct Answer

Incorrect Answers

Question 495

Explanation

Correct Answer

Incorrect Answers

Question 496

Explanation

Correct Answer

Incorrect Answers

Question 497

Explanation

Correct Answer

Incorrect Answers

Question 498

Explanation

Correct Answer

Incorrect Answers

Question 499

Explanation

Correct Answer

Incorrect Answers

Question 500

Explanation

Correct Answer

Incorrect Answers

Implementing End-to-End Security Controls for Cloud and AI Workloads (SC-500) Practice Tests