nerdexam
Microsoft

AZ-500 · Question #507

Drag and Drop Question You have an Azure subscription named Sub1 that contains the storage accounts shown in the following table. The storage3 storage account is encrypted by using customer-managed…

The correct answer is Enable the Defender for Storage plan for Sub1.; For storage3, assign the AzDefenderPlanAutoEnable tag and set the value to off.; Disable Defender for Storage for storage3. The correct sequence is: (1) Enable Defender for Storage at the subscription level (Sub1) to automatically protect all storage accounts including storage1 and storage2. (2) Tag storage3 with 'AzDefenderPlanAutoEnable = off' to signal exclusion intent before disabling, which is…

Submitted by zhang_li· Mar 6, 2026Manage security posture by configuring Microsoft Defender for Cloud plans and protecting Azure Storage resources, including subscription-level enablement and resource-level exclusions using tags and per-resource settings.

Question

Drag and Drop Question You have an Azure subscription named Sub1 that contains the storage accounts shown in the following table. The storage3 storage account is encrypted by using customer-managed keys. You need to enable Microsoft Defender for Storage to meet the following requirements: - The storage1 and storage2 accounts must be included in the Defender for Storage protections. - The storage3 account must be excluded from the Defender for Storage protections. Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area. Answer:

Exhibit

AZ-500 question #507 exhibit

Answer Area

Drag items

For storage3, disable the customer-managed keys.Disable Defender for Storage for storage3.Enable the Defender for Storage plan for Sub1.For storage3, assign the AzDefenderPlanAutoEnable tag and set the value to off.Enable the Defender for Storage plan for RG1.

Correct arrangement

  • Enable the Defender for Storage plan for Sub1.
  • For storage3, assign the AzDefenderPlanAutoEnable tag and set the value to off.
  • Disable Defender for Storage for storage3.

Explanation

The correct sequence is: (1) Enable Defender for Storage at the subscription level (Sub1) to automatically protect all storage accounts including storage1 and storage2. (2) Tag storage3 with 'AzDefenderPlanAutoEnable = off' to signal exclusion intent before disabling, which is the proper method to prevent auto-enablement on that specific resource. (3) Explicitly disable Defender for Storage on storage3 to ensure it is excluded from protection, since subscription-level enablement would otherwise include it by default. This three-step approach leverages subscription-wide coverage while using resource-level overrides to exclude storage3.

Topics

#Microsoft Defender for Storage#Azure Security Center#Storage Account Security#Resource Tagging

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full AZ-500 Practice