Microsoft SC-500 Online Access

A Sentinel playbook is an Azure Logic Apps workflow used to automate response actions. For an unsupported external ITSM system, a playbook can call the system API and create a ticket when a new incident is generated. Workbooks visualize data, watchlists enrich detections, and analytics rules generate alerts or incidents. None of those directly integrate with a custom ITSM endpoint in the same way a playbook does. In Microsoft Sentinel and Defender scenarios, collection, detection, investigation, and automation are separate functions. The selected answer maps to the function requested by the question rather than a neighboring capability. This is why analytics, hunting, workbooks, connectors, automation rules, and playbooks must not be treated as interchangeable. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > Sentinel automation rules and playbooks; Microsoft Learn > playbooks for incident response.

==============================================================

First, create a private endpoint for KV1. A private endpoint creates a network interface with a private IP address inside the selected virtual network. With the appropriate Azure Private DNS configuration, the normal Key Vault hostname resolves to that private IP from VNet1, allowing App1 to communicate with KV1 through Azure Private Link instead of the public network path.

Second, disable public access on KV1. Microsoft states that when Key Vault public network access is disabled, public data-plane connections are rejected and the vault is accessible through private endpoints instead. This directly fulfills the requirement that requests from outside the private network path be denied. Microsoft Learn

An access policy controls authorization to Key Vault data, such as whether an identity can retrieve secrets or perform key operations. It does not provide the required network isolation. In this scenario, App1 already accesses the secrets, so the missing controls are specifically network controls.

Adding App1 ' s public IP addresses would also retain public network connectivity, which conflicts with the requirement to use a private address and block outside requests.

Statement

Answer

User2 can connect to

No

User3 can connect to

Yes

User1 can connect to

No

Microsoft Entra Private Access applies access at the application-segment level, and an application segment is defined by attributes including the destination FQDN or IP address and the destination port. Users must be assigned to the corresponding enterprise application to access its defined segments. Microsoft specifically documents that Private Access supports precise per-app segmentation using FQDNs, IP addresses, ports, and user/group assignments.

User2 = No. User2 is assigned only to App2, which permits 10.20.30.40 on port 8443. without an explicit port uses HTTPS default TCP 443, so it does not match App2 ' s segment.

User3 = Yes. User3 is assigned to App1, whose wildcard FQDN *.corp.contoso.com on port 443 matches intranet.corp.contoso.com. Microsoft supports wildcard FQDN segments such as *.contoso.com with explicitly configured ports.

User1 = No. Although intranet.corp.contoso.com matches App1 ' s wildcard FQDN, User1 is authorized only for port 443. Specifying :8443 causes the connection to fall outside App1 ' s configured segment.