Secure compute

Security Controls Across the AI Workload Stack

An AI application built on Microsoft Foundry is really several layers stacked together, and each layer needs its own security control. Treat it like any other workload: identity for the app, network isolation for the endpoint, and content-aware controls for what the model sees and returns.

Exam tip. If a scenario describes sensitive data leaking through a chatbot's answers rather than through a file share, the control being tested is Purview DSPM for AI, not a traditional DLP policy aimed at email or documents.

Defender for Cloud's Workload-Specific Plans

Microsoft Defender for Cloud's free tier only covers posture recommendations. Each paid Defender plan adds active threat detection for one specific resource type, so matching the right plan to the workload in a scenario is a recurring exam pattern.

Exam tip. A scenario naming a specific resource under attack, such as a Kubernetes cluster or a storage account, is pointing at the matching Defender plan. Do not answer with a generic 'enable Defender for Cloud' when the question is really asking which specific plan to turn on.

Defender for Servers: What Each Plan Actually Gives You

Plan selection questions are common and are decided by one capability the stem names. Plan 1 is Defender for Endpoint integration and nothing more. Everything else people associate with server protection, vulnerability assessment, file integrity monitoring, just-in-time access, agentless scanning, sits in Plan 2.

Exam tip. If the stem forbids installing anything in the guest, the answer is agentless scanning and therefore Plan 2.

Securing AI Workloads: Identity, Data, Runtime and Posture

The AI content is the newest part of SC-500 and it is organised the same way as the rest of the exam: an identity layer, a data layer, a runtime layer and a posture layer. Knowing which layer a control belongs to answers most questions, because the distractors are usually real controls from a different layer.

Exam tip. Prompt injection is an input problem with an authorisation fix. Any answer that only filters the prompt is a partial control.

1. Kestrel Fabrication Works has virtual machines that occasionally require RDP access for administrative tasks, but the security team wants to minimize the attack surface by keeping management ports closed by default and only opening them for a limited time window when an authorized request is approved. What should they enable?

• A. Azure Bastion with a public IP
• B. Just in time VM access through Microsoft Defender for Serverscorrect
• C. A Network Security Group rule allowing RDP from any source
• D. Microsoft Defender for Storage

Just in time VM access, part of Microsoft Defender for Servers, keeps management ports locked down by default and temporarily opens them only after an approved request for a limited time window, minimizing exposure. Azure Bastion provides browser based RDP and SSH without a public IP, but does not itself provide the time bound, request driven access model described. An NSG rule allowing RDP from any source increases exposure rather than reducing it. Defender for Storage protects storage resources, unrelated to VM management ports.

2. Marlstone Bank needs to run a single, untrusted multi-tenant workload with a strong isolation boundary per workload instance, without managing cluster nodes, and specifically wants hypervisor-level isolation for each container group rather than containers sharing a single kernel. Which service natively provides this?

• A. Azure Container Instances, where each container group runs in its own hypervisor-isolated boundarycorrect
• B. Azure Kubernetes Service with all workloads scheduled on a shared node pool
• C. Azure Functions on the Consumption plan
• D. Azure App Service on a shared multi-tenant plan

Azure Container Instances runs each container group in its own hypervisor-isolated boundary by default, giving stronger per-workload isolation than pods that share a kernel on common AKS nodes. AKS on a shared node pool, Functions on Consumption, and App Service on a shared plan all involve workloads sharing underlying compute in ways that provide weaker per-workload isolation than ACI's default model.

3. Thornmere Financial processes highly sensitive financial models and wants to protect data while it is being actively processed in memory, defending against a scenario where even a privileged administrator of the underlying host could not inspect the data. What should they deploy the workload on?

• A. A standard virtual machine with Azure Disk Encryption
• B. A virtual machine behind Azure Firewall with threat intelligence filtering
• C. A virtual machine with Just in time access enabled
• D. Azure confidential virtual machines using a hardware based trusted execution environmentcorrect

Azure confidential virtual machines use hardware based trusted execution environments to encrypt data in use in memory, isolating it so that even privileged host administrators or the hypervisor cannot access it, which matches the requirement. Disk encryption protects data at rest only, not data actively in memory. Azure Firewall protects network traffic, not in memory data. Just in time access reduces network exposure to management ports, it does not protect data in use.