Microsoft SC-500 Practice Test Questions Answers

Multi-user authorization (MUA) is the Azure Backup control designed to require a second, independently controlled authorization before critical Recovery Services vault operations can proceed. MUA uses an Azure Resource Guard as an additional authorization boundary. Microsoft explicitly supports placing the Resource Guard in a different Microsoft Entra tenant from the Recovery Services vault, which provides the highest degree of administrative isolation.

In this design, RSVault1 remains in contoso.com, while the security team can own the Resource Guard in security.contoso.com. When a vault administrator attempts a protected operation, such as modifying protection or changing a backup policy in a way that reduces retention or increases RPO, the user must obtain the required Resource Guard permission. An approver in the security tenant can control that access, including through PIM and the Backup MUA Operator role.

Immutability primarily prevents backup data from being altered or deleted and does not provide cross-tenant approval. PIM on the Backup Operator role alone does not create the Resource Guard authorization boundary. A private endpoint addresses network access only.

The SC-500 study guide explicitly includes configuring security controls for backup protection by using Azure Backup security features.

===============

Authentication method: The Microsoft identity provider; Access control method: Enterprise app assignment required

Built-in authentication for App Service should use the Microsoft identity provider for Microsoft Entra sign-in. To restrict access to selected users and groups, require enterprise app assignment on the corresponding enterprise application. IP restrictions only filter network source and cannot identify assigned corporate users. Local authentication and broad admin consent do not implement assigned-user enforcement for the backend API. This domain is tested through precise scope control: tenant, subscription, resource, application, and data-plane authorization are not interchangeable. The correct choice applies the smallest identity or governance control that enforces the stated requirement. Options that only add users, create registrations, or provide broad administrator access fail because they do not directly enforce the requested access behavior. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > App Service authentication; Microsoft Learn > App Service built-in authentication and enterprise app assignment.

==============================================================

Statement

Answer

You can establish a Remote Desktop connection from VM1 to VM3 for a maximum of three hours.

No

You can establish a Remote Desktop connection from VM2 to VM1 after requesting access.

No

You can establish a Remote Desktop connection from VM3 to VM1 without requesting access.

No

JIT access on VM1 controls inbound traffic to VM1, not outbound traffic originating from VM1. Therefore, the three-hour RDP rule on VM1 does not limit a connection from VM1 to VM3. Microsoft states that JIT protects selected VM ports by blocking inbound traffic until access is requested and approved.

The second statement is No because VM2 ' s source address is in 172.16.0.0/24, but VM1 ' s JIT configuration for RDP port 3389 permits requests only from 10.10.0.0/24 and 192.168.10.0/24. JIT requests must use source addresses allowed by the configured JIT policy.

The third statement is also No. VM3 is in 192.168.10.0/24, which is an allowed source range for port 3389, but that does not mean permanent access is open. Microsoft documents that when JIT is enabled, users must still request access; Defender for Cloud then temporarily opens the selected port for the approved source IP and duration.

Requirement

Conditional Access setting

Only allow access to App1 from Windows devices

Conditions

Only allow devices that are marked as compliant to access App1

Grant

For the operating-system requirement, configure Conditions. Microsoft Entra Conditional Access includes a Device platforms condition that allows a policy to target specific operating systems, including Windows. To restrict the policy to Windows devices, configure Conditions → Device platforms, enable platform targeting, and select Windows as the applicable platform. Microsoft documents device platform as one of the primary Conditional Access signals that administrators can use to scope policy enforcement. Microsoft Learn

For the compliance requirement, configure the Grant access control and select Require device to be marked as compliant. Microsoft Entra receives device compliance information from Microsoft Intune and evaluates that state during authentication. If the device isn ' t compliant, Conditional Access denies access when this grant requirement applies. Microsoft explicitly identifies Require device to be marked as compliant as a Conditional Access Grant control. Microsoft Learn

Target resources would be used separately to select App1 as the application protected by the policy. Users or agents determines which identities are subject to the policy, while Session manages post-authentication session behavior. Neither implements the two requirements shown in the answer area.