You have an Azure subscription that contains a blob container named cont1. Con1 ' has the access policies shown in the following exhibit.

Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.
NOTE: Each correct selection is worth one point.

Explanation:

You have a Microsoft Entra tenant that contains the users shown in the following table.

You use Microsoft Security Copilot.
From Microsoft Security Store, User1 attempts to deploy a partner built agent named Agent1 and reports that the Get agent option is unavailable.
You need to identify whether Agent1 can run in Security Copilot successfully. The solution must follow the principle of least privilege.
How should you complete the deployment? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Explanation:

To complete approval for Agent1: Instruct User4 to approve Agent1; To complete the agent setup:
Create an app registration for Agent1
Security Store partner-built agents require organization-level approval before contributors can acquire and use them. User4 is the Security Copilot Owner, so User4 is the least-privilege approver among the listed accounts.
The agent also needs an app registration so the agent identity and permissions can be represented through Microsoft Entra. Global Administrator could approve many things, but using the Security Copilot Owner avoids unnecessary tenant-wide privilege for this operational approval. This answer also follows operational scalability. Microsoft security architecture favors policy-driven deployment, agentless assessment, managed identities, and Defender workload plans where possible. Those mechanisms reduce manual configuration while keeping enforcement tied to the resource type, which is why the selected choice is stronger than manual or after-the-fact alternatives. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > Microsoft Security Copilot agents; Microsoft Learn > Security Store agent approval and app registration.

You have an Azure Storage account that contains a blob container named container 1 and a client application named App1. You need to enable App1 access to container1 by using Microsoft Entra authentication. What should you do ' To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Explanation:

You have an Azure virtual network named VNet1 that contains an Azure Bastion Subnet. VNet1 contains a subnet named Subnet1 Subnet1 contains multiple virtual machines.
You plan to deploy Azure Bastion to provide secure RDP access to the virtual machines on Subnet1. You associate a network security group (NSG) named NSG1 to Azure Bastion Subnet.
You need to configure rules for NSG1. The solution must meet the following requirements:
*Allow required inbound access to Azure Bastion from the internet.
*Allow user access to the virtual machines by using Azure Bastion.
Which TCP ports should you allow for the NSG1 rules? To answer, drag the appropriate ports to the correct rules. Each port may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.

Explanation:
Inbound from the internet: 443; Outbound to Subnet1: 3389

Azure Bastion requires inbound HTTPS access on TCP 443 from the internet to the AzureBastionSubnet so users can reach the Bastion service. For RDP to Windows virtual machines, Bastion then needs outbound access to the target subnet on TCP 3389. Port 22 would be required for SSH, but the scenario is specifically secure RDP. Other listed ports do not satisfy Bastion RDP access requirements. For this domain, least privilege means granting only the required data operation or allowing only the required network flow. The correct response avoids shared keys, broad peering, general contributor roles, or log-only controls when the scenario demands prevention, routing, event triggering, or account-specific configuration. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > Azure Bastion; Microsoft Learn > Azure Bastion NSG access and port requirements.

You plan to deploy Microsoft 365 Copilot.
You discover that Copilot can access sensitive information in your Microsoft SharePoint Online libraries.
You need to automatically identify which SharePoint Online content has been shared between all internal users.
What should you create?

• A. a Microsoft Purview Data Security Posture Management (DSPM) remediation action
• B. a Microsoft Purview data loss prevention (DLP) policy in audit mode for SharePoint Online
• C. a SharePoint Advanced Management (SAM) Data access governance report
• D. a Conditional Access policy that requires multifactor authentication (MFA) for SharePoint Online

Explanation: Only visible for PDFVCE members. You can sign-up / login (it's free).