Pass Using SC-500 Exam Dumps

Exposed ports on the public IP address of CG1: 443 only; Network endpoint for App1: localhost:5000

In an Azure Container Instances group with a public IP address, only the ports exposed on the container group public endpoint are reachable externally. The public exposed port should therefore be limited to 443. Containers inside the same container group can communicate with one another over localhost, so App1 can continue to reach container2 at localhost:5000 without exposing port 5000 publicly. For this domain, least privilege means granting only the required data operation or allowing only the required network flow. The correct response avoids shared keys, broad peering, general contributor roles, or log-only controls when the scenario demands prevention, routing, event triggering, or account-specific configuration. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > Azure Container Instances security; Microsoft Learn > container group exposed ports and localhost communication.

==============================================================

Use Azure Logic Apps to automate remediation actions when Defender for Storage detects malicious content. Microsoft documents an event-driven remediation pattern in which Defender for Storage malware scanning sends scan results through Azure Event Grid, and an Azure Logic App or Azure Function performs an automated response such as quarantining, deleting, moving, or otherwise handling a malicious blob. This enables near-real-time remediation rather than simply recording or reporting the detection.

A Log Analytics workspace is useful for retaining malware scan results for audit, compliance, and investigation, but it does not itself execute remediation actions. An alert rule can generate notifications based on detected conditions, but it is not the primary workflow engine for taking corrective action against infected blobs. Azure Policy can enforce Defender for Storage configuration at scale, such as ensuring malware scanning is enabled across storage accounts, but it does not perform per-detection malware remediation.

Therefore, the solution should include Azure Logic Apps, typically triggered through Event Grid, to implement the required automated response.

This aligns with the SC-500 objective Implement Defender for Storage threat protection configurations under Secure storage, databases, and networking.

Assign Logic App Contributor to User1 at the RG1 scope. Microsoft Sentinel playbooks are implemented as Azure Logic Apps, and Microsoft documents that the Logic App Contributor role is the role that permits a user to create, edit, and manage logic apps/playbooks. Because App1 already exists in RG1 and User1 needs to add or manage it as a Sentinel playbook, this is the least-privileged role among the available choices. Microsoft Learn

The scope should be RG1, not the entire subscription. Granting the role at Sub1 would provide unnecessary permissions over logic apps in other resource groups and would violate least privilege.

Logic App Operator is insufficient because it allows a user to read, enable, disable, and run certain logic-app operations, but it does not permit editing or managing the workflow as required for playbook configuration. Microsoft Learn

Microsoft Sentinel Contributor provides permissions to manage Sentinel resources and can attach playbooks to analytics or automation rules, but it does not provide the underlying permissions required to edit/manage the Logic App resource itself. Microsoft explicitly lists Logic App Contributor for creating or editing playbooks

Comprehensive and Detailed 150 to 250 words of Explanation From [Cloud and AI Security Engineer/Course Guide/topics]:

Create an Azure role assignment for the AKS service principal at the Azure Container Registry scope. The automatically generated AKS service principal already provides the Microsoft Entra identity used by the cluster. What it still requires is authorization to perform the necessary operations against the target registry.

Microsoft documents that when an existing service principal needs access to an Azure Container Registry, you grant that access by creating an Azure RBAC role assignment for the service principal. For a registry using the traditional RBAC Registry Permissions model, AKS image-pull access is normally provided by assigning the AcrPull role at the registry scope. Microsoft Learn

Current Azure Container Registry configurations can also use the newer RBAC + ABAC repository-permissions model. In that model, the corresponding least-privilege pull role is Container Registry Repository Reader, rather than AcrPull. The principle remains the same: the AKS identity must receive an appropriate role assignment on the registry. Microsoft Learn

A Microsoft Entra user or group is unnecessary because the cluster already has a service principal. A Key Vault secret is also unnecessary for Azure RBAC authorization.

Correct answer: C. a role assignment