Authentic Microsoft Certification Exam SC-500 Questions Answers

Passwordless sign-in: Microsoft Authenticator; First-time sign-in for new users: Temporary Access Pass

Microsoft Authenticator supports passwordless phone sign-in, allowing users to authenticate from a mobile device without typing a password. Temporary Access Pass is a time-limited, helpdesk-issued credential designed for onboarding or recovery, so it fits first-time sign-in for new users. SMS and voice call are authentication methods but are not passwordless sign-in methods in the same strong sense, and hardware OATH tokens are not the requested mobile-device experience. For SC-500, the decisive distinction is whether the control authenticates an identity, grants authorization, or merely changes configuration visibility. The incorrect choices generally either grant excessive privilege, change the application model, or operate at the wrong scope. Microsoft expects the least-privilege identity path that satisfies the scenario without introducing shared secrets or unnecessary tenant-wide rights. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > passwordless authentication methods; Microsoft Learn > Microsoft Authenticator and Temporary Access Pass.

==============================================================

The Windows Security Events via AMA connector uses Azure Monitor Agent and data collection rules for direct collection from Windows machines. It is the supported path for new deployments and avoids the legacy Log Analytics agent. Windows Forwarded Events is for a Windows Event Collector model, not direct agent collection. Syslog via AMA is for Linux Syslog, and Azure Resource Graph is not an event-collection connector. In Microsoft Sentinel and Defender scenarios, collection, detection, investigation, and automation are separate functions. The selected answer maps to the function requested by the question rather than a neighboring capability. This is why analytics, hunting, workbooks, connectors, automation rules, and playbooks must not be treated as interchangeable. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > Windows Security events using DCRs; Microsoft Learn > Windows Security Events via AMA connector.

==============================================================

Configure just-in-time (JIT) VM access in Microsoft Defender for Cloud . JIT is specifically designed to keep management ports such as TCP 3389 for RDP closed and open them temporarily only after an authorized user requests access. Microsoft states that administrators can configure each protected port with its protocol, permitted source addresses, and a maximum request time . A 60-minute RDP access window therefore maps directly to the JIT mechanism. Microsoft Learn

Defender for Cloud manages the underlying network controls so that management access is restricted when it is not needed. When an authorized request is approved, Defender temporarily modifies the effective access rules for the requested source and duration. After the approved interval expires, access is closed again. This minimizes the VM ' s exposure to RDP scanning and brute-force attempts. Microsoft Learn

Microsoft Entra PIM controls privileged role activation, but it does not dynamically modify NSG rules for RDP. Azure Policy evaluates and enforces resource configuration but is not intended to grant temporary user-requested port access. Azure Bastion avoids exposing RDP directly but does not implement the stated 60-minute request-based NSG workflow.

SC-500 specifically requires candidates to enable and enforce just-in-time VM access .