Complete SC-500 Microsoft Materials

To ensure that a user named user2-28681041 can manage the properties of the virtual machines in the RG1lod28681041 resource group using the principle of least privilege, you can follow these steps:

In the Azure portal, search for and select the resource group named RG1lod28681041.

In the left pane, select Access control (IAM).

Select Add.

In the Add role assignment pane, enter the following information:

Role: Select the appropriate role for your scenario. For example, Virtual Machine Contributor.

Assign access to: Select User, group, or service principal.

Select: Enter the name of the user you want to assign the role to. For example, user2-28681041.

Select Save.

An app consent policy allows the tenant to define which delegated permissions are considered low risk and may be consented to by users. Higher-privilege permissions can remain subject to admin consent. Tenant-wide admin consent would approve App1 broadly rather than creating an ongoing policy boundary. Application assignments and PIM role assignments control user access or privileged roles, not delegated permission consent behavior. This domain is tested through precise scope control: tenant, subscription, resource, application, and data-plane authorization are not interchangeable. The correct choice applies the smallest identity or governance control that enforces the stated requirement. Options that only add users, create registrations, or provide broad administrator access fail because they do not directly enforce the requested access behavior. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > app consent settings; Microsoft Learn > app consent policies.

==============================================================

The automatically applied security policy is the Microsoft cloud security benchmark (MCSB). MCSB is Microsoft ' s default security standard for Defender for Cloud and provides the baseline security controls and recommendations used to assess Azure resources. Microsoft explicitly identifies the MCSB initiative as the Defender for Cloud default policy initiative. Microsoft Learn

Microsoft also documents that when Defender for Cloud is enabled for an Azure subscription, Foundational CSPM includes regulatory compliance with the Microsoft cloud security benchmark, along with recommendations, secure score, inventory, and other foundational posture-management capabilities. Microsoft Learn

The MCSB standard is designed as a cloud-focused security framework that maps Microsoft security controls to widely recognized frameworks and best practices. It serves as the default foundation for Defender for Cloud recommendations and can apply across Azure and supported multicloud environments. Microsoft has historically documented MCSB as being automatically assigned when environments are onboarded to Defender for Cloud. Microsoft Learn

Standards such as PCI DSS, ISO/IEC 27001, and the CIS Microsoft Azure Foundations Benchmark are additional regulatory or compliance standards that administrators can assign according to organizational requirements. They are not the default Defender for Cloud policy automatically applied simply because Defender CSPM is enabled.

Therefore:

Correct answer: C. Microsoft cloud security benchmark (MCSB)

===============