Microsoft Updated SC-500 Exam Questions and Answers by alma

A private endpoint is the appropriate mechanism because it exposes the Azure Storage service through a private IP address associated with Subnet1 . Private endpoints support Azure virtual network network policies, including network security groups (NSGs) . When private-endpoint network policies are enabled for the subnet, NSG rules can be applied to traffic destined for the private endpoint, allowing network access to be controlled through the NSG associated with Subnet1.

This differs materially from a service endpoint . Service endpoints continue to access Azure Storage through its public service endpoint and require service-side virtual network ACL/firewall configuration to restrict which subnets may access the storage account. Microsoft explicitly states that enabling a service endpoint alone is insufficient: the Azure service must also be configured with appropriate virtual-network access controls. Therefore, access would not be governed only by the NSG.

An Azure Private Link service is used to privately publish a customer-owned service, typically behind a load balancer; it is not required to consume Azure Storage privately. A UDR controls routing and does not establish private access to Storage.

For a complete private-access design, the storage account ' s public endpoint should also be restricted or disabled. Microsoft recommends private endpoints when private network access to Azure Storage is required.

Eligible approvers: Admin1 and Admin3 only; Maximum active duration of the role: 1 day

The answer area indicates that Admin1 and Admin3 are the eligible approvers and that the active AI Administrator role duration is one day. This is consistent with PIM role settings: approvers are explicitly configured for a role activation policy, and maximum active duration controls how long the activated role remains available. Other administrators who are not configured as approvers cannot approve the request merely because they hold unrelated roles. This domain is tested through precise scope control: tenant, subscription, resource, application, and data-plane authorization are not interchangeable. The correct choice applies the smallest identity or governance control that enforces the stated requirement. Options that only add users, create registrations, or provide broad administrator access fail because they do not directly enforce the requested access behavior. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > PIM activation approval and duration; Microsoft Learn > role settings in PIM.

==============================================================

The solution as worded adds virtual machine resources to a role. Azure Storage authorization through Azure RBAC is granted to security principals such as managed identities, users, groups, and service principals, not to VM compute objects as resource containers. Since each VM already has a system-assigned managed identity, the correct approach would be to assign the storage data role to those identities. As stated, this solution does not meet the goal. The exam objective emphasizes practical identity enforcement rather than cosmetic configuration. A valid answer must identify who authenticates, what permission is granted, where the scope is applied, and whether the method continues to work without passwords or secrets. That is why the selected answer is preferred over broader administrative roles or unrelated access settings. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > managed identities and storage access; Microsoft Learn > RBAC role assignments are made to identities.

==============================================================

The correct configuration is the Secrets Store CSI Driver. The planned change requires AKS1 to integrate with Vault1, which is an Azure Key Vault. Microsoft provides the Azure Key Vault Provider for Secrets Store CSI Driver specifically for this scenario. It enables an AKS cluster to consume Key Vault objects—such as secrets, keys, and certificates—by mounting them into Kubernetes pods through a CSI volume. Microsoft explicitly describes this driver as providing integration between Azure Key Vault and AKS.

A workload identity can be used as an authentication mechanism that allows Kubernetes workloads to authenticate to Azure resources, including Key Vault, but it is not by itself the feature that performs the Key Vault integration requested by the question. In fact, Workload ID is one of several supported identity methods that can be used with the Secrets Store CSI Driver.

Application scaling controls workload capacity and does not provide secret-store integration. Kubernetes RBAC controls authorization to Kubernetes resources but does not connect AKS to Azure Key Vault.

This maps directly to the SC-500 Secure compute domain, which includes implementing and configuring security controls for Azure Kubernetes Service (AKS).