Use Azure Logic Apps to automate remediation actions when Defender for Storage detects malicious content. Microsoft documents an event-driven remediation pattern in which Defender for Storage malware scanning sends scan results through Azure Event Grid , and an Azure Logic App or Azure Function performs an automated response such as quarantining, deleting, moving, or otherwise handling a malicious blob . This enables near-real-time remediation rather than simply recording or reporting the detection.

A Log Analytics workspace is useful for retaining malware scan results for audit, compliance, and investigation, but it does not itself execute remediation actions. An alert rule can generate notifications based on detected conditions, but it is not the primary workflow engine for taking corrective action against infected blobs. Azure Policy can enforce Defender for Storage configuration at scale, such as ensuring malware scanning is enabled across storage accounts, but it does not perform per-detection malware remediation.

Therefore, the solution should include Azure Logic Apps , typically triggered through Event Grid, to implement the required automated response.

This aligns with the SC-500 objective Implement Defender for Storage threat protection configurations under Secure storage, databases, and networking.

Assign Virtual Machine User Login to User1. Microsoft Entra authentication for supported Azure Arc-enabled Windows servers uses Azure RBAC to authorize RDP sign-in. Microsoft specifies two relevant roles: Virtual Machine Administrator Login , which provides administrator privileges, and Virtual Machine User Login , which provides standard user privileges. Because the requirement is only for User1 to sign in and explicitly requires least privilege , Virtual Machine User Login is the correct role.

Assigning Virtual Machine Administrator Login would also permit access, but it unnecessarily grants local administrative privileges and therefore violates least privilege. Adding User1 manually to the local Remote Desktop Users group is not the correct authorization model for Microsoft Entra-based Arc sign-in. Microsoft specifically requires the appropriate Azure login role and documents that manual local-group elevation is not the supported mechanism for authorizing Microsoft Entra sign-in.

A Conditional Access policy requiring MFA can impose an additional authentication condition, but it does not provide the underlying authorization required to log on to SRV1.

The SC-500 study guide places extending security controls to hybrid servers by using Azure Arc within the Secure compute domain.

===============

The security team wants a serverless workflow to run when scan results are produced. Defender for Storage malware scanning emits events that can be subscribed to through Azure Event Grid, and Event Grid can trigger Azure Functions, Logic Apps, or other serverless handlers. Diagnostic settings and Log Analytics are useful for investigation but are not the lowest-effort event trigger for each malicious upload. Lifecycle policies are storage-management controls, not security remediation workflows. Microsoft platform security questions usually hinge on where enforcement occurs: at the resource, server, subnet, firewall policy, private endpoint, or subscription level. The selected answer uses the control plane that owns that enforcement point. Other options are rejected when they only log activity, broaden network access, or protect a different service category. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > Defender for Storage; Microsoft Learn > Event Grid events for malware scanning results.

==============================================================

Filtering must happen before data is written to the Log Analytics workspace. With Azure Monitor Agent, Syslog collection is governed by data collection rules, and DCR transformations or filtering can reduce ingestion before records reach the workspace. An ASIM parser normalizes queried data after ingestion, an analytics rule detects conditions after data exists, and a table-level transformation is not the primary collection control for Linux Syslog from AMA in this scenario. The posture and monitoring objective focuses on turning security data into usable operational outcomes. The correct answer either collects the right signal, grants the right security-operations role, or automates incident handling at the correct layer. Distractors often provide dashboards, queries, or broad permissions, but those do not create the requested workflow or least-privilege security capability. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > Syslog event collection; Microsoft Learn > data collection rules for Azure Monitor Agent.

==============================================================

Privileged pods must be rejected before they are admitted to the AKS cluster. Azure Policy for AKS integrates with admission control to enforce policies such as denying privileged containers. Runtime alerts can detect privileged activity after deployment, but the requirement is prevention. Agentless Kubernetes discovery and image vulnerability assessment provide visibility; they do not block a privileged pod specification during admission. For SC-500, compute controls are evaluated by workload type: VM, Arc server, AKS, container registry, container group, Functions, Logic Apps, App Service, and AI agent runtime. The right answer uses the Microsoft control that is native to that workload. Broad Azure roles or unrelated monitoring services would either overgrant access or fail to enforce the required security state. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > AKS security controls; Microsoft Learn > Azure Policy for AKS admission control.

==============================================================

The requirement is centralized enforcement for all databases on the logical server. Microsoft Entra-only authentication disables SQL authentication at the server level, so SQL logins cannot be used against any database hosted there. Configuring an Entra administrator is typically a prerequisite or supporting step, but by itself it does not disable SQL authentication. A managed identity for the server and deleting logins from one database do not meet the central enforcement requirement. For SC-500, the decisive distinction is whether the control authenticates an identity, grants authorization, or merely changes configuration visibility. The incorrect choices generally either grant excessive privilege, change the application model, or operate at the wrong scope. Microsoft expects the least-privilege identity path that satisfies the scenario without introducing shared secrets or unnecessary tenant-wide rights. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > Azure SQL authentication; Microsoft Learn > Microsoft Entra-only authentication for Azure SQL.

==============================================================