5 SC-500 Defender and Sentinel Questions Explained

Security posture and operations is 20-25% of the SC-500 exam. The questions are scenarios: a short story, four plausible answers, and one that fits best. Here are five from the course’s exam Q&A video, each with the reasoning and the Part to rewatch.

A four-step method for any scenario

1. The need: what must the engineer achieve?
2. The scope: one resource, a resource group, a subscription, or the whole tenant?
3. Prevent or detect? “Prevent” points to Policy, guardrails or a firewall; “detect” points to Defender plans or Sentinel.
4. Least privilege and least cost: of what remains, choose the smallest change that meets the need.

Question 1

You must see which internet-exposed VM could reach a storage account with sensitive data. What do you need?

Answer: Defender CSPM attack path analysis. Attack paths and the cloud security explorer come with Defender CSPM; foundational CSPM gives only recommendations and secure score. Rewatch: Part 9.

Question 2

Auditors require a report against ISO 27001 for your subscription. What do you do?

Answer: Add the ISO 27001 standard in Defender for Cloud security policies, then download the compliance report. The standard is assigned as an Azure Policy initiative, gets its own compliance tab, and the report downloads as PDF or CSV. Rewatch: Part 9.

Question 3

VMs must be scanned for vulnerabilities without installing anything and without network access. Which option?

Answer: Agentless scanning for machines in Defender for Servers or Defender CSPM. It reads disk snapshots, so it needs no agent and no network path. Rewatch: Part 9.

Question 4

Posture for an AWS account must appear in Defender for Cloud, without storing access keys. What do you do?

Answer: Add an AWS environment connector and run the generated CloudFormation template. The template creates an IAM role that Defender assumes through a federated identity, so no keys are stored. Rewatch: Part 9.

Question 5

A new Sentinel workspace must be used with Defender XDR incidents in one queue. What do you do?

Answer: Connect the workspace to the Defender portal as the primary workspace. Onboarding correlates Sentinel and XDR incidents; the Azure portal experience for Sentinel ends on 31 March 2027. Rewatch: Part 10.

Practise the rest

The full video walks through every question in this domain. For timed practice with a score per domain, take the SC-500 mock exam, and rewatch the Parts it points you to.