SC-500 manage and monitor security posture
Manage and monitor security posture is worth 20–25% of SC-500. It covers knowing the state of your estate (Defender for Cloud), collecting what happens in it (Microsoft Sentinel), and the newest addition, Microsoft Security Copilot.
The distinction running through the whole domain: posture is about what could go wrong, monitoring is about what did.
Defender for Cloud
Six objectives:
- Defender CSPM for identifying risk across the estate
- Evaluating compliance against security frameworks
- Enabling and configuring workload protection plans
- Connecting AWS and GCP, plus hybrid environments
- Microsoft Defender Vulnerability Management settings for Azure VMs
- Defender EASM — discovering unprotected assets and vulnerabilities from the outside
CSPM versus workload protection is the pairing to know. CSPM is posture — misconfigurations, risk paths, recommendations, always looking at how things are set up. Workload protection plans are runtime threat detection for a resource type — Defender for Servers, for Storage, for Databases, for Containers, for AI Services.
EASM deserves its own note because it answers a different question from everything else: it looks at your organisation from the outside, discovering internet-facing assets nobody registered. Any scenario about shadow IT, forgotten subdomains or unknown exposed assets wants EASM.
Microsoft Sentinel
Ten objectives, mostly about getting data in and acting on it:
| Objective | Note |
|---|---|
| Create and connect workspaces | The foundation |
| Assign roles | Sentinel-specific RBAC |
| Content hub solutions | Packaged connectors, rules and workbooks |
| Microsoft data connectors | For Azure resources |
| Syslog and CEF | Linux and network appliances |
| Windows Security events via data collection rules, including WEF | Windows servers at scale |
| Custom log tables | For ingested data that fits no standard table |
| Automation rules and playbooks | Automated response |
| Data retention | How long data stays, and at what cost |
| Querying Purview Audit in Defender XDR | Microsoft 365 activity |
Match the source to the mechanism: Azure resources use data connectors; Linux hosts and appliances use syslog or CEF; Windows servers use data collection rules with Windows Event Forwarding where appropriate; anything non-standard goes to a custom log table.
Automation rules and playbooks are the response half — the answer whenever a scenario describes a repetitive manual reaction to a recurring alert.
Microsoft Security Copilot
Four objectives, and entirely new to this exam:
- Configure workspaces for Security Copilot
- Manage permissions and roles
- Enable and configure plugins
- Enable and configure Microsoft agents and Security Store agents
The framing to hold: Security Copilot is a security product you deploy and govern, not a feature that appears. It has workspaces, its own permission model, plugins that connect it to data sources, and agents. Questions here are about setting it up correctly and controlling who can use what, rather than about what it can generate.
Sample questions
Question 1. Security suspects the organisation has internet-facing assets nobody has registered — old subdomains and services from acquired companies. What should you use to find them?
- A. Defender CSPM recommendations
- B. A Defender for Servers workload protection plan
- C. Defender External Attack Surface Management (EASM)
- D. A Microsoft data connector in Sentinel
Show answer
Answer: C
Defender External Attack Surface Management discovers internet-facing assets from the outside, which is what finding unregistered or forgotten exposure requires. Defender CSPM assesses resources you already know about, a workload protection plan protects a resource type, and a Sentinel data connector ingests from a configured source.
Question 2. A firewall appliance must send its logs to Microsoft Sentinel. It supports industry-standard log forwarding but has no Azure integration. What should you implement?
- A. Syslog and CEF event collection
- B. A Microsoft data connector for Azure resources
- C. Data collection rules for Windows Security events
- D. Querying Purview Audit in Defender XDR
Show answer
Answer: A
Syslog and Common Event Format collection is the mechanism for appliances that forward standard logs without Azure-native integration. Microsoft data connectors target Azure resources, data collection rules for Windows Security events target Windows hosts, and Purview Audit covers Microsoft 365 activity.
Question 3. The same low-severity alert appears several times a day and the analyst response is always identical: enrich, tag, and close if a condition is met. What should you implement?
- A. Increase data retention on the workspace
- B. Create a custom log table for the alert
- C. Disable the analytics rule producing the alert
- D. An automation rule with a playbook to handle the response
Show answer
Answer: D
Automation rules and playbooks in Sentinel automate a repeatable response to recurring alerts, which is precisely the described pattern. Raising retention keeps data longer, a custom log table changes storage, and disabling the rule loses visibility rather than handling it.
What to practise
Connect one non-Azure source to Sentinel — a syslog sender is enough — and watch the data arrive in a table you chose. Then build one automation rule. On the Defender for Cloud side, open CSPM and a workload protection plan side by side so the posture-versus-runtime distinction becomes concrete rather than a definition you memorised.