SC-500 practice questions

Question 1

Litware's help desk lead will issue Temporary Access Passes so that users can register passkeys, including users who already hold Microsoft Entra administrator roles. Following least privilege, which role should the help desk lead hold to create passes for both standard users and administrators?

Accepted Answer

Privileged Authentication Administrator The Temporary Access Pass article lists who can act on passes: Privileged Authentication Administrators can create, delete and view a pass for admins and members (except themselves), Authentication Administrators can do so for members only, and Authentication Policy Administrators enable the method and choose which users and groups can sign in with it. Only Privileged Authentication Administrator reaches users who hold administrator roles.

Question 2

At Litware, the security engineer opens the PIM role settings for the Exchange Administrator Microsoft Entra role, turns on Require approval to activate, and saves without selecting any approvers. Later, an eligible user submits an activation request. Who can approve it?

Accepted Answer

Any active Privileged Role Administrator or Global Administrator in the tenant The PIM article on Microsoft Entra role settings says approvers don't need any role, at least one approver should be selected (two are recommended), and if no specific approvers are selected, active Privileged Role Administrators and Global Administrators become the default approvers. It also warns that a tenant is locked out when approval is required, no approvers are configured, and every Privileged Role Administrator and Global Administrator holds only an eligible assignment.

Question 3

Litware assigned the built-in Add a tag to resources policy definition, which uses the modify effect, to a subscription in the Azure portal with a system-assigned managed identity. New resources now receive the tag, but 240 resources that existed before the assignment still show as non-compliant a week later. What should the security engineer do so that the existing resources get the tag?

Accepted Answer

Create a remediation task for the policy assignment. The modify effect changes a request only while a resource is being created or updated. The Azure Policy modify effect page says an evaluation cycle makes no changes to resources that already exist; it marks them non-compliant so that a remediation task can fix them. A remediation task for the assignment applies the modify operations to the existing resources as the assignment's managed identity, which the portal already granted the roles the definition lists.

Question 4

Adatum's Azure subscription has Defender CSPM enabled. The security team wants Microsoft Defender for Cloud to block the creation of storage accounts that fail one specific Microsoft cloud security benchmark recommendation, which supports both the Deny and Enforce actions, without anyone writing Azure Policy JSON. What should the engineer configure?

Accepted Answer

Set the recommendation's effect to Deny in the subscription's Security policies. The page on managing benchmark recommendations describes Deny as preventing deployment of resources that don't comply, so a storage account that fails the recommendation can't be created. It's set in Environment settings: select the subscription, open Security policies, choose the benchmark, then Manage recommendations and Manage effect and parameters, and select Deny. Enforce instead applies the DeployIfNotExists effect to remediate noncompliant resources upon creation.

Question 5

Tailspin Toys connected its Azure DevOps organization to Defender for Cloud with only foundational CSPM enabled. Pipelines run the Microsoft Security DevOps extension, branch policies already require build validation on main, and IaC misconfiguration recommendations for Bicep files appear in Defender for Cloud. Developers now want those findings shown on their pull requests. What should you do?

Accepted Answer

Enable the Defender CSPM plan, and then turn on pull request annotations for the repositories in DevOps security IaC misconfiguration recommendations are included with foundational CSPM, but Learn's DevOps security support matrix lists pull request annotations under Defender CSPM only. With the Microsoft Security DevOps extension running and build validation already on main, the remaining steps are to enable the paid Defender CSPM plan and switch pull request annotations on in Defender for Cloud, under DevOps security, then Manage resources.

Question 6

Tailspin Toys connected an AWS account to Microsoft Defender for Cloud and runs foundational CSPM only. The security team wants a custom recommendation that marks EC2 instances missing a CostCenter tag as unhealthy and wants it grouped into a custom standard. What should the team do?

Accepted Answer

Enable Defender CSPM, then create the custom recommendation with a KQL query in Security policies. The page on creating custom standards and recommendations says KQL-based custom recommendations cover Azure, AWS, and GCP and require the Defender CSPM plan, while custom recommendations built from Azure Policy are a legacy method for Azure subscriptions. An EC2 tag check therefore needs a KQL query, which means enabling Defender CSPM first. Creating the recommendation needs Security Admin, and creating the custom standard that holds it needs Owner on the subscription.

Question 7

At Adatum, an audit-effect policy assignment flags a legacy virtual machine that must keep a nonstandard configuration until it's decommissioned at the end of the quarter. Compliance wants the VM to stay visible in compliance results as a temporarily accepted deviation and to be evaluated normally again after the quarter without anyone having to undo the change. What should the engineer create?

Accepted Answer

A policy exemption for the VM in the Waiver category, with expiresOn set to the end of the quarter The Azure Policy exemption structure page defines Waiver as an exemption granted because the resource's non-compliance is temporarily accepted, while Mitigated means the policy intent is met another way. An exempt resource still counts toward compliance and shows as Exempt. When the expiresOn date passes, the exemption object is kept for record-keeping but is no longer honored, so the VM is evaluated normally again with no cleanup step.

Question 8

At Litware, engineers create virtual machines in the RG-Ops resource group and then wait days for a central administrator to grant them sign-in access. The team lead must be able to assign only the Virtual Machine Administrator Login and Virtual Machine User Login roles in RG-Ops, and must not be able to assign any other role. Which assignment should you give the team lead?

Accepted Answer

Role Based Access Control Administrator at the RG-Ops scope, with a condition allowing only the two login roles Role Based Access Control Administrator is the built-in role designed for delegating role assignment management, and a condition on the assignment constrains which roles the delegate can assign, so the lead can grant only the two login roles. Learn's delegation article warns that Owner and User Access Administrator let a delegate assign any role, including Owner, to any user at that scope, while Contributor's NotActions exclude Microsoft.Authorization write and delete actions, so it can't create role assignments.

Question 9

Defender for Cloud shows the recommendation 'A maximum of 3 owners should be designated for subscriptions' for a Woodgrove Bank subscription with seven Owner assignments. Four of those users deploy and manage resources across this subscription, never grant access to anyone, and must not gain access to any other subscription. Which change resolves the finding while letting the four users keep managing resources?

Accepted Answer

Replace the four users' Owner assignments with Contributor assignments at the subscription scope The recommendation limits subscription owners to three to reduce the damage a compromised owner account can do. Contributor grants full access to manage all resources, but its NotActions exclude role assignment, which fits users who build and run resources but never grant access. Moving the four users to Contributor at the same subscription scope drops the owner count to three without widening or narrowing where they can work.

Question 10

Defender for Cloud flags 'Service Principals should not be assigned with administrative roles at the subscription and resource group level' at Litware. The flagged service principal runs an unattended pipeline several times a day. It holds Contributor on the subscription but only deploys code and settings to existing web apps in the RG-Web resource group. What should you do?

Accepted Answer

Replace the Contributor assignment with a Website Contributor assignment at the RG-Web resource group scope The recommendation flags service principals that hold privileged administrator roles, such as Owner, Contributor, or User Access Administrator, at subscription or resource group level, so the fix is a narrower role at a narrower scope. Website Contributor manages websites but not web plans and can't assign roles, which covers deployments to existing web apps. Assigning it at RG-Web removes the subscription-wide reach and the administrative role together.

Question 11

Fabrikam applied a Read-only lock to storage account stfin01, the only storage account in resource group rg-fin, which has no lock. An analyst who holds Storage Account Contributor used to browse its blobs in the Azure portal with the account key but no longer can. The security team keeps the lock and asks the engineer to restore the analyst's read access to the blobs. Which action works?

Accepted Answer

Assign Storage Blob Data Reader scoped to rg-fin, then switch the portal to Microsoft Entra user account authentication. A Read-only lock blocks every POST request to Resource Manager, including List Keys, so the portal can't use the account key and users must authorize with Microsoft Entra credentials. The lock resources page adds that a Read-only lock on a storage account also prevents role assignments scoped to the account or its containers. Storage Blob Data Reader assigned at rg-fin, which isn't locked, reaches stfin01 through inheritance, and the analyst's existing management role lets the portal open the account.

Question 12

Woodgrove Bank's audit logs show that a former contractor's service principal ran KeyBackup on the key in the vault kv-wg-cmk. That key protects several Azure SQL databases through transparent data encryption (TDE) and a storage account through customer-managed keys. The principal's backup and restore permissions are already revoked. What should you do next?

Accepted Answer

Create a new key in a separate, tightly restricted vault, move the services to it, then disable the old key A restored backup is a fully independent copy: disabling, deleting, or purging the original has no effect on it, and Key Vault has no way to revoke a backup blob. Disabling the key first would only take the SQL databases and storage account offline. The Key Vault backup article's response is to contain access, create a new key (not a new version) in a separate restricted vault, move dependent services to it, verify them, and only then disable the old key.

Question 13

Litware onboarded an existing Azure subscription that hosts virtual machines and storage accounts to Microsoft Defender for Cloud and turned on the Defender for Storage plan. Nobody has assigned any standards. When a compliance analyst opens the regulatory compliance dashboard, which standard shows assessment results without further configuration?

Accepted Answer

Microsoft cloud security benchmark When Defender for Cloud is enabled on an Azure subscription, the Microsoft cloud security benchmark is assigned and starts assessing resources automatically; the regulatory compliance standards page lists it as the default standard for Azure. Every other standard, such as ISO IEC 27001:2022 or PCI DSS v4.0.1, has to be added explicitly, and adding one requires a paid Defender plan, which this subscription has through Defender for Storage.

Question 14

Contoso's internal audit team needs read-only access to every resource in all subscriptions under the Production management group, including subscriptions that the cloud team will add to that management group next quarter. The auditors must not see any subscription in the Development management group. What should you do?

Accepted Answer

Assign the Reader role to the auditors' group at the Production management group scope A role assigned at a management group is inherited by every subscription, resource group, and resource beneath it, and a subscription added to that management group later picks up the same inherited access. Learn's guide to assigning Azure roles uses this case: Reader at the management group scope lets the principal read everything in all subscriptions in that management group. One group assignment at Production covers the future subscriptions and keeps Development out.

Question 15

Contoso's operations team holds the Contributor role on subscription Sub-Ops, but its attempts to add or remove resource locks during maintenance windows fail. The security team requires that the operations team be able to manage locks while having no ability to grant access to anyone. Which role should the engineer assign to the team at Sub-Ops?

Accepted Answer

Locks Contributor Contributor can't manage locks because its NotActions exclude Microsoft.Authorization write and delete operations, and the lock resources page says creating or deleting locks needs Microsoft.Authorization/* or Microsoft.Authorization/locks/*. The built-in Locks Contributor role grants only lock read, write, and delete. Azure RBAC is additive, so adding it alongside Contributor restores lock management without granting any role assignment rights.

Question 16

Fabrikam's production subscription returns RoleAssignmentLimitExceeded when administrators add role assignments. An Azure Resource Graph query shows about 1,900 assignments that give the Reader role to individual users at the same handful of resource group scopes. Fabrikam licenses Microsoft Entra ID P1 only. What should you do to make room for new assignments?

Accepted Answer

Add the users to Microsoft Entra groups and give each group one assignment in place of the individual ones Azure supports 5,000 role assignments per subscription across subscription, resource group, and resource scopes, and Learn states that the limit is fixed. The first fix in Learn's RBAC limits troubleshooting article is to replace principal-based assignments with group-based ones: many users holding one role at one scope collapse into a single group assignment. Eligible assignments don't count toward the limit, but Learn ties that fix to Microsoft Entra ID P2.

Question 17

Fabrikam deploys a production resource group from a Bicep file through a pipeline that signs in as a service principal. Engineers hold Contributor on that resource group for troubleshooting. No one except the pipeline may modify or delete the resources the Bicep file declares, and the engineers must not be able to change that protection. What should you implement?

Accepted Answer

A deployment stack stored at the subscription scope that targets the resource group, using denyWriteAndDelete with the pipeline excluded Deployment stack deny settings put a deny assignment on the managed resources that applies to everyone except the excluded principals, and denyWriteAndDelete blocks both changes and deletion. The deny assignment exists where the stack exists, and Learn advises storing a stack at the parent scope: a subscription-scope stack that deploys to the resource group keeps engineers, whose access stops at the resource group, away from the stack and its deny settings.

Question 18

Contoso runs a web tier on a virtual machine scale set plus two Azure Functions apps, and all of them read the same key vault. The platform team wants one identity whose role assignment exists before any of the compute is deployed and survives when instances are rebuilt. Which identity should the team use?

Accepted Answer

A user-assigned managed identity assigned to all three resources The managed identities overview says a user-assigned identity is a standalone Azure resource with an independent lifecycle that can be associated with more than one resource, and lists workloads needing preauthorization during provisioning, and resources recycled while permissions stay consistent, among its use cases. The best practice article adds that user-assigned identities and their role assignments can be configured before the resources that need them exist.

Question 19

Contoso's Azure SQL Managed Instance has a server audit named CorpAudit that writes to blob storage through TO URL and captures logins and batches. Compliance now also needs a record of what Microsoft support engineers do when they access the instance during a support case, and CorpAudit must keep recording Contoso's own activity. What should the DBA do?

Accepted Answer

Create a second server audit with Microsoft support operations selected, leaving CorpAudit as is The SQL Managed Instance auditing articles say Microsoft support operations are audited by selecting Microsoft support operations when you create an audit, and that it must be a separate server audit: enabling the option on an existing audit overwrites that audit so it logs only support operations. In T-SQL, the separate audit carries OPERATOR_AUDIT = ON, so CorpAudit keeps recording Contoso's own activity unchanged.

Question 20

Litware deployed a security admin configuration from Azure Virtual Network Manager to the East US and West US regions. The target network group uses dynamic membership. A new virtual network in North Europe matches the policy condition and now shows as a group member, but none of the security admin rules apply to it. What should Litware do?

Accepted Answer

Deploy the security admin configuration to the North Europe region as well A configuration takes effect only in the regions chosen when its deployment is committed. A network group can hold virtual networks from any region, but each member receives only the configurations applied to the group and deployed to that member's own region. Deploying the security admin configuration to North Europe adds it to that region's goal state. In East US and West US, new members already receive the deployed configuration without a redeployment.

Question 21

After a network change, VMs in Fabrikam's application subnet can't reach an on-premises database at 192.168.10.20 over ExpressRoute. No NSG rules changed. The engineer suspects a user-defined route now sends that traffic to a retired network virtual appliance, and needs the next hop type, next hop IP address and route table ID for that destination. Which Network Watcher tool fits?

Accepted Answer

Next hop The next hop overview describes a tool that returns the next hop type, IP address and route table ID for a specific destination IP. When a user-defined route matches, it names the route table that holds the route; otherwise it reports System Route. A VirtualAppliance result pointing at the retired appliance's address would confirm the misroute, which none of the security rule tools can show.

Question 22

Tailspin Toys runs a TCP licensing service on virtual machines behind an internal Standard Load Balancer whose backend pool is configured by IP address. Customers in their own Microsoft Entra tenants must reach the service privately from their own virtual networks. Several customer address spaces overlap Tailspin's, and no other Tailspin subnet may become reachable. What should Tailspin do?

Accepted Answer

Switch to a NIC-based backend pool, create a Private Link service on the load balancer frontend, then share its alias. The Private Link service overview lists two load balancer limits: it works only with Standard Load Balancer, and only where the backend pool is configured by NIC, not by IP address. With a NIC-based pool in place, the service fronts the load balancer, customers in other Microsoft Entra tenants connect through private endpoints in their own virtual networks, and destination-side NAT from a provider subnet keeps overlapping address spaces from conflicting.

Question 23

Adatum piloted point-to-site VPN on a route-based gateway that uses the Basic SKU. For production, users must authenticate through the company's existing NPS server by using RADIUS so that on-premises MFA applies. The team accepts a new gateway public IP address if one is needed. What should the engineer do?

Accepted Answer

Delete the Basic gateway, create a VpnGw1AZ gateway with a Standard SKU public IP address, and configure RADIUS The Basic SKU doesn't support RADIUS authentication, so the gateway has to move to another SKU. The Upgrade a VPN Gateway SKU article lists Basic to any other SKU as delete and re-create only: remove the connections, delete the gateway, create the new one, update devices with the new public IP address, and download new client profiles. New VPN gateways must use a Standard SKU public IP address, and the RADIUS limit belongs to Basic, so a VpnGw1AZ gateway can use RADIUS.

Question 24

Contoso's security admin configuration in Azure Virtual Network Manager targets a network group that includes VNet-Data, which hosts an Azure SQL Managed Instance. None of the configuration's rules reach VNet-Data, while other members enforce both Allow and Deny rules. Contoso wants the Allow rules enforced on VNet-Data without filing an exception request. What should Contoso do?

Accepted Answer

Deploy a security admin configuration whose applyOnNetworkIntentPolicyBasedServices is AllowRulesOnly By default, security admin rules skip a virtual network that contains Azure SQL Managed Instance or Azure Databricks, because those services' network intent policies govern their traffic. The security admin rules page offers two ways around it: request an exception through Microsoft's form, or use a security configuration whose applyOnNetworkIntentPolicyBasedServices field is set to AllowRulesOnly, which applies only the Allow rules to such networks while Deny rules still skip them.

Question 25

Litware runs VM2 in Subnet-App. NSG-Subnet, associated with Subnet-App, has an inbound rule at priority 200 that allows TCP 443 from the Internet service tag. NSG-NIC2, associated with VM2's network interface, has only the default rules. Internet clients still can't open HTTPS sessions to VM2's public IP address. What should the engineer do?

Accepted Answer

Add an inbound rule to NSG-NIC2 that allows TCP 443 from the Internet service tag For inbound traffic, Azure processes the subnet NSG first and then the NIC NSG, and each must allow the flow. NSG-Subnet allows TCP 443, so the packet moves on to NSG-NIC2, where no custom rule allows it and the DenyAllInbound default rule at priority 65500 drops it. The How network security groups filter network traffic page says that to permit a port to a VM with NSGs at both levels, both NSGs need a rule that allows it, so the fix is an allow rule in NSG-NIC2.

Question 26

Contoso's central network team uses Azure Virtual Network Manager. Its monitoring system in 10.100.5.0/24 must always reach agents on TCP 443 in every virtual network of a network group, even if a workload team later adds an NSG rule that blocks that traffic. What should the central team deploy?

Accepted Answer

A security admin rule with the Always Allow action for TCP 443 from 10.100.5.0/24 Security admin rules are evaluated before NSG rules. An Always Allow rule ends evaluation and sends matching traffic straight to the resource, so no NSG rule a workload team adds can block it. The security admin rules page describes Always Allow as allowing traffic regardless of lower-priority rules or user-defined network security groups, while an Allow rule passes the traffic on to NSG evaluation, where a deny still wins.

Question 27

Fabrikam's Azure Virtual Network Manager instance is scoped to its root management group, which holds 400 subscriptions. Every virtual network tagged Environment=Prod, including networks created next year, must receive the production security admin configuration without anyone adding networks by hand. What should the network team configure?

Accepted Answer

A network group with dynamic membership from an Azure Policy that uses the addToNetworkGroup effect Dynamic membership lets Azure Policy evaluate a condition such as a tag and place matching virtual networks in the network group through the addToNetworkGroup effect, in a custom definition whose mode is Microsoft.Network.Data. Networks created later join when they match. The configuration deployments page adds that membership changes take effect without redeploying the configuration, and below 1,000 subscriptions conditional membership updates within a few minutes.

Question 28

Woodgrove Bank's security admin configuration, deployed to East US, has one rule collection that targets a network group of all virtual networks and holds a Deny rule for inbound TCP 3389 at priority 10. The jump-host team must now accept RDP into VNet-Jump from 10.50.0.0/24, and wants its own NSG to decide which hosts get it. What should the central network team do?

Accepted Answer

Add a rule collection for a VNet-Jump network group to the deployed configuration with an Allow rule for TCP 3389 from 10.50.0.0/24 at priority 5, and redeploy A network manager deploys only one security admin configuration to a region, so more rules go into new rule collections inside it. The high-risk ports guide builds this exception: a network group for the excepted networks, a rule collection with an allow rule numbered lower than the blocking rule (1 to 9 against a Deny at 10), then a redeployment, since changes to a deployed configuration apply only after it is deployed again. Allow, unlike Always Allow, passes matching traffic on to NSG evaluation.

Question 29

During a review, Contoso finds that a container in a production storage account has its anonymous access level set to Container. The security team wants one change that blocks anonymous reads of every container in the account and prevents anyone from enabling anonymous access on a container later. What should they configure?

Accepted Answer

Set Allow Blob anonymous access to Disabled on the storage account. Setting AllowBlobPublicAccess to false, shown in the portal as Allow Blob anonymous access set to Disabled, overrides every container's setting: Azure Storage rejects all anonymous read requests, containers already configured for anonymous access stop accepting them, and users cannot configure anonymous access on a container afterward. The Remediate anonymous read access article notes the change can take up to 30 seconds to propagate and does not affect the $web container.

Question 30

Adatum must let VMs in Subnet-Batch reach Azure Storage in the East US region over TCP 443 and block every other outbound connection to the internet, without maintaining lists of IP addresses. NSG-Batch, associated with Subnet-Batch, has only the default rules. Which outbound rules should the engineer add to NSG-Batch?

Accepted Answer

Allow TCP 443 to the Storage.EastUS service tag at priority 100, then deny all traffic to the Internet service tag at priority 110 The Storage tag supports regional scope, so Storage.EastUS covers only East US storage ranges and stays current as Microsoft changes them. Learn's service tags overview says the Internet tag includes Azure-owned public IP space, so the storage allow needs the lower priority number to be processed first. A custom deny for Internet is required because the AllowInternetOutBound default rule at 65001 is processed before DenyAllOutBound at 65500.

Question 31

Litware's Azure Firewall Standard uses a Firewall Policy with one rule collection group. An application rule collection at priority 100 denies *.contoso.com over HTTPS from the workload subnet. A network rule collection at priority 300 allows TCP 443 from the workload subnet to any destination. A workload VM opens www.contoso.com over HTTPS. What happens?

Accepted Answer

The connection is allowed, because network rules are processed before application rules whatever the collection priorities. The Azure Firewall rule processing article states that application rules are always processed after network rules, and network rules after DNAT rules, regardless of rule collection group priority, rule collection priority or policy inheritance. Rules are terminating, so once the network rule allowing TCP 443 matches, processing stops and the application rule that denies *.contoso.com is never evaluated.

Question 32

Adatum stores national ID numbers in a column of an Azure SQL Database table. Compliance requires that privileged users, including the server admin, the Microsoft Entra admin and members of db_owner, can never read the plaintext values, while the HR application must still read and write them. Which feature should the security engineer implement?

Accepted Answer

Always Encrypted on the column, with the column master key kept in Azure Key Vault The Azure SQL security overview describes Always Encrypted as protecting specific columns, such as national identification numbers, from database administrators and other privileged users who have no business need to see the data. Values are decrypted only by client applications that can reach the encryption key, which is never exposed to the database engine, so the HR application keeps working while administrators see only ciphertext.

Question 33

Contoso wants to retire its legacy VPN by publishing on-premises file shares and web apps to remote staff through Microsoft Entra Private Access. Every user already holds a Microsoft Entra ID P1 license and no other Entra product license. What licensing must be in place for these users before Private Access can go into production?

Accepted Answer

Microsoft Entra Private Access licenses, standalone or through Microsoft Entra Suite, assigned alongside the existing P1 licenses The licensing overview in What is Global Secure Access states that Microsoft Entra Private Access is included in the Microsoft Entra Suite license and is also sold standalone, and that users of Private Access also need Microsoft Entra ID P1 or P2. P1 or P2 by itself includes only Internet Access for Microsoft services. With P1 already assigned, Contoso adds Private Access standalone or Entra Suite for each user, since most Global Secure Access services are licensed per user.

Question 34

Fabrikam will give three partners read access to a blob container named catalogs by using shared access signatures. Security requires that any one partner's tokens can be revoked at any time without affecting the other partners and without regenerating the storage account keys. Which approach should the engineer use?

Accepted Answer

Create one stored access policy per partner on catalogs, and issue each partner a service SAS bound to its policy. A stored access policy lets you revoke a service SAS without regenerating the account keys: delete the policy, change its signed identifier, or set its expiry in the past, and every signature bound to it stops working. A container holds up to five stored access policies, so one policy per partner on catalogs isolates each partner. Only a service SAS can reference a stored access policy; user delegation and account SAS are always ad hoc.

Question 35

Fabrikam replaced its VPN with Quick Access in Microsoft Entra Private Access, which publishes 10.30.0.0/16 to all employees. A finance application at 10.30.8.15 on TCP 443 must now be reachable only by the Finance group and only from compliant devices, while every other internal app keeps its current access. What should the engineer configure?

Accepted Answer

A per-app enterprise application with a 10.30.8.15 TCP 443 segment, assigned only to Finance and targeted by a compliant device policy Per-app access creates an enterprise application whose segment covers only the finance destination, so user assignment and Conditional Access apply to that app alone. Learn's per-app segmentation tutorial states that when an enterprise application segment overlaps Quick Access, the enterprise application takes precedence for that resource, which enforces explicit assignment. Only assigned Finance users on compliant devices reach the app, and other apps keep their Quick Access path; the segmentation guidance also suggests removing the address from Quick Access.

Question 36

Fabrikam has three Azure Cosmos DB accounts in one subscription: one is Azure Cosmos DB for NoSQL, one Azure Cosmos DB for MongoDB and one Azure Cosmos DB for Apache Cassandra. The security engineer enables Defender for Azure Cosmos DB at the subscription level. Which accounts can generate Defender for Azure Cosmos DB alerts?

Accepted Answer

Only the NoSQL account, because the plan doesn't support the other two APIs The Defender for Azure Cosmos DB overview lists Azure Cosmos DB for NoSQL as the only supported API; Azure Cosmos DB for Apache Cassandra, MongoDB, Table and Apache Gremlin aren't supported. Enabling the plan at subscription level is a valid scope on its own, so the NoSQL account is protected with no resource-level step, while the MongoDB and Cassandra accounts produce no alerts.

Question 37

Woodgrove Bank created a private endpoint for the blob subresource of a storage account and linked the privatelink.blob.core.windows.net zone to its virtual networks. Internal apps now resolve the account to a private IP address. A penetration tester outside the company can still read blobs over the internet with a valid SAS token. What should the security engineer change?

Accepted Answer

Set the storage account's public network access to Disabled so that only traffic through private endpoints is accepted Learn's private endpoint overview states that private endpoints provide a privately accessible IP address for a service but don't necessarily restrict public network access to it. The account's public endpoint stays open until public network access is set to Disabled, after which traffic is allowed only through a private endpoint. DNS resolution and access control are independent: with public access disabled, the service rejects the tester's connection regardless of what the name resolves to.

Question 38

Contoso hosts 20 databases on one Azure SQL Database logical server, which already has server-level IP firewall rules for Contoso's administrators. A partner's analysts connect from the public range 203.0.113.16 to 203.0.113.31 and must reach only the PartnerSales database. The DBA who must grant this access holds CONTROL DATABASE on PartnerSales and no Azure role assignment. What should the DBA create?

Accepted Answer

A database-level IP firewall rule for the range, created in PartnerSales with sp_set_database_firewall_rule The Azure SQL Database IP firewall rules article says database-level rules admit clients to one database only, are stored in that database, and can be created only with Transact-SQL, through sp_set_database_firewall_rule, once a first server-level rule exists. Configuring them needs CONTROL DATABASE, which the DBA holds. Any server-level rule would open all 20 databases to the partner, and the portal routes need Azure role permissions the DBA doesn't have.

Question 39

Fabrikam has Defender for Azure SQL Databases enabled. Its security engineer holds the SQL Security Manager role on the Azure SQL Database servers but no role on any storage account, and policy forbids new storage accounts for security tooling. The engineer must turn on SQL vulnerability assessment and approve baselines that take effect without waiting for a rescan. Which configuration fits?

Accepted Answer

Express configuration, with scan results kept in Microsoft-managed storage in the server's region The SQL vulnerability assessment article says express configuration needs no customer-managed storage account, stores results in the same region as the logical server, and lets SQL Security Manager change its settings. Its comparison table adds that an express baseline takes effect without rescanning the database. Classic configuration needs a storage account, SQL Security Manager plus Storage Blob Data Reader and Owner on it, and applies baselines only after a rescan.

Question 40

Fabrikam connected 600 on-premises servers to Azure Arc last month with a script that authenticated as a service principal. All 600 servers show Connected. A security review finds that the service principal's client secret is still valid and stored in plain text on the file share that held the script. The servers must stay connected and managed through Azure Arc. What should the engineer do about the secret?

Accepted Answer

Delete the client secret, because connected servers no longer need the credential that onboarded them. The Azure Arc-enabled servers security guidance on onboarding credentials says the credential is needed only when azcmagent connect runs on a server. After a server connects it isn't needed, and if the credential expires or is deleted the server stays connected to Azure. Deleting the exposed secret removes the risk that someone uses it to onboard machines outside Fabrikam into the subscription, while each agent keeps rotating its own managed identity credential.

Question 41

Tailspin Toys uses Microsoft Purview Data Security Posture Management (DSPM). Auditing is on, Copilot licenses are assigned, and Copilot interactions already appear in its reports. The security team now needs to see sensitive data that employees paste into third-party generative AI sites from Windows devices in Microsoft Edge, and to warn or block those pastes with endpoint DLP. Which action is required?

Accepted Answer

Onboard the Windows devices to Microsoft Purview so endpoint signals and DLP actions apply The DSPM setup tasks state that devices must be onboarded to Microsoft Purview both to see sensitive information shared with third-party generative AI sites, such as card numbers pasted into ChatGPT, and to apply endpoint DLP policies that warn or block those shares. Auditing and Copilot licenses cover only the Copilot and agent signal Tailspin already sees. The Purview browser extension matters for Chrome DLP and Insider Risk Management site visits, which this scenario doesn't need.

Question 42

Fabrikam uses Microsoft Defender as the external threat detection provider (preview) for Copilot Studio agents in its Production environment. Last week it created a Sales environment whose generative agents call tools that update customer records. Security requires that tool invocations in both environments be evaluated and that no tool call runs when the provider fails to decide in time. What should a Power Platform administrator do?

Accepted Answer

Set up additional threat detection for the Sales environment, and set the error behavior to Block the query in both environments Copilot Studio's external threat detection is configured per environment in the Power Platform admin center, under Security, then Threat detection, then Additional threat detection, and no tenant-wide setting exists, so a new environment must be set up after it is created. If no allow or block decision arrives within one second, the default error behavior lets the tool run; choosing Block the query makes a timeout or error fail closed.

Question 43

Woodgrove Bank disabled public network access on its Microsoft Foundry resource and wants AI Gateway (preview). In the Foundry portal, under Manage, then AI Gateway, the engineer selects Add AI Gateway and Use existing, but the bank's API Management instance, a classic Premium tier injected into a virtual network in the same tenant and subscription, isn't listed, although the engineer is Owner on it. Which API Management instance should the bank use?

Accepted Answer

A Premium v2 instance injected into a virtual network, in the same tenant and subscription as Foundry Use existing lists only instances in a v2 tier, in the same Microsoft Entra tenant and subscription as the Foundry resource, where you hold API Management Service Contributor or Owner, so a classic Premium instance never appears. Because public network access is disabled on the Foundry resource, the instance must also be privately accessible: Learn names a Standard v2 or Premium v2 instance with a private endpoint, or a Premium v2 instance injected into a virtual network. Among the v2 tiers, only Premium v2 supports injection.

Question 44

Litware has threat protection for AI services enabled on the subscription that hosts its Microsoft Foundry deployments. The privacy officer rules that text from user prompts and model responses must no longer appear in security alerts, but the security operations center (SOC) must keep receiving alerts for jailbreak and data leakage attempts. What should the security engineer change?

Accepted Answer

In the AI services plan settings, turn off suspicious prompt evidence (user prompt evidence) The AI services plan lets you control its components separately. Suspicious prompt evidence adds redacted snippets of user prompts and model responses to alerts; with user prompt evidence turned off, Defender for Cloud keeps analyzing prompts and responses for threat detection, but the prompt content is masked in alerts. The toggle is under Environment settings, the subscription, then Settings for AI services, so the SOC keeps its alerts without the text.

Question 45

Contoso runs an HTTP-triggered function app on the Consumption plan. A new requirement says that clients in the company's Azure virtual network must reach the app only through a private IP address in that network, and that public network access to the app must be disabled. What should the security engineer do?

Accepted Answer

Redeploy the functions to a new app on the Flex Consumption plan, add a private endpoint, and disable public access The Azure Functions networking options article lists a private endpoint for the function app as supported on Flex Consumption, Elastic Premium, and Dedicated, and as not supported on the Consumption plan. A private endpoint gives the app a private IP address from the virtual network, after which public network access can be turned off. Because the Consumption plan can't host one, the functions have to move to a plan that can, and Flex Consumption keeps the pay-for-what-you-use serverless billing model.

Question 46

Fabrikam runs a LangGraph agent on Amazon Web Services and registers it in the Foundry Control Plane with the A2A protocol, so clients now reach it through the URL that its Foundry resource's AI gateway (preview) provides. The security team wants every prompt sent to this agent screened for jailbreak attempts and blocked before it reaches the agent. What should the security engineer configure?

Accepted Answer

An llm-content-safety policy with shield-prompt set to true on the agent's API in the gateway's API Management instance Foundry guardrails currently apply only to agents developed in the Foundry Agent Service, not to other agents registered in the Foundry Control Plane. A registered custom agent is proxied through the AI gateway's API Management instance, where policies such as content safety apply. The llm-content-safety policy sends content to Azure AI Content Safety, can check A2A agent APIs managed in API Management, and blocks a detection with a 403; its shield-prompt attribute, false by default, turns on the user prompt attack check.

Question 47

Woodgrove Bank (Microsoft 365 E7) runs autonomous agents that call Microsoft Graph on a schedule with their own agent identities and no signed-in user. The CISO wants a Conditional Access policy that cuts these agents off when ID Protection flags them as compromised. Which policy configuration can the engineer build for this access pattern?

Accepted Answer

Target All agent identities, add the agent risk (preview) condition at High, and select Block access In application-only access the agent identity is the token subject, so the policy targets agent identities. Learn's guidance on targeting agent identities in Conditional Access says the only condition available for them is Agent risk (preview), with high, medium and low levels from ID Protection, and that Block access is the only control because no interactive remediation is possible. Device and network controls apply only to agents' user accounts.

Question 48

Woodgrove Bank hosts a customer-facing web app on an App Service Premium v3 plan, and customers must keep reaching it from the internet. Self-hosted pipeline agents in an Azure virtual network must reach the advanced tools (scm) site at a private IP address in that network to deploy, and the scm site must refuse all internet traffic. No access restriction rules exist, and the app access setting has never been set. What should you configure?

Accepted Answer

Add a private endpoint, set app access to Enabled, and set the advanced tools site's unmatched rule action to Deny The App Service access restrictions article describes this case: add a private endpoint to keep deployment traffic private, make sure public app access is enabled, and set the advanced tools site's unmatched rule to deny, which blocks public traffic to that site. Traffic through a private endpoint bypasses access restrictions, so the agents still reach scm. App access must be set explicitly because, when it isn't set, the default changes to disabled once a private endpoint exists.

Question 49

Tailspin Toys turned on Defender for Storage and threat protection for AI services for its subscription, and foundational CSPM is its only posture coverage. In the Data and AI security dashboard, Top issues lists high-severity alerts and recommendations but never any attack paths, and the security engineer also needs an AI bill of materials for the company's Foundry workloads. What should the engineer enable?

Accepted Answer

The Defender CSPM plan for the subscription, in Defender plans under Environment settings Attack path analysis and AI security posture management, including discovery of the generative AI bill of materials, are Defender CSPM capabilities that foundational CSPM doesn't include. The Data and AI security dashboard is enabled per subscription and reflects the plans enabled there; for full access Learn lists Defender CSPM with its sensitive data discovery extension, Defender for Storage, Defender for Databases, and threat protection for AI workloads, and Top issues then shows critical and high attack paths.

Question 50

Fabrikam exposes an HTTP-triggered function on the Elastic Premium plan, and three partner applications call it with one shared function key. The security team now requires that every caller present a Microsoft Entra ID access token, that requests without a valid token be rejected before any function code runs, and that the function code stay unchanged. What should you do?

Accepted Answer

Enable App Service built-in authentication with Microsoft Entra ID as the provider and require authentication The Securing Azure Functions article says access keys only make endpoints harder to reach and that the way to truly secure them is positive authentication of clients, so authorization can rest on identity. Built-in authentication is platform middleware that every request passes through before the app handles it, and the Require authentication setting rejects unauthenticated traffic, with HTTP 401 recommended for APIs. It needs no SDK and no change to function code.

Question 51

In a Consumption logic app workflow, an HTTP action calls an identity endpoint that returns an access token, and a later HTTP action sends that token in its Authorization header by referencing the first action's output. Support engineers must keep viewing run history from the corporate network, but they must not see the token in the first action's outputs or in the later action's inputs. What should you do?

Accepted Answer

Turn on Secure Outputs in the HTTP action that returns the access token The Logic Apps article on securing access and data says that when Secure Outputs is turned on in a trigger or action, its outputs are hidden in run history, and a downstream action that explicitly uses those secured outputs as inputs has its inputs hidden too, without its own Secure Inputs setting being turned on. One setting on the first HTTP action therefore hides the token in both places, while the engineers keep their run history access.

Question 52

A Contoso file server in a branch office was offline for four months while the site moved to a new building. The server is Azure Arc-enabled and protected by Defender for Servers. Network access is restored, but the Azure portal shows its Arc status as Expired, and its extensions can't be managed from Azure. What should the engineer do to bring the server back under Azure Arc management?

Accepted Answer

Disconnect the Connected Machine agent on the server, then connect it again by using an onboarding credential. The Arc identity and authorization article explains that the certificate behind each server's managed identity is valid for 90 days and that the agent renews it automatically only while it stays connected. A server offline long enough for that credential to expire becomes Expired, and automatic reconnection isn't possible: you disconnect the agent and reconnect it to Azure with an onboarding credential. Four months offline is past the 90-day lifetime, so no restart or wait brings it back.

Question 53

Contoso deploys a web app from a Bicep file. Because app settings must resolve Key Vault references while the app is created, the app gets only a user-assigned managed identity, which already holds Key Vault Secrets User on a vault that uses the Azure RBAC permission model and accepts traffic from all networks. After deployment, every Key Vault reference in the app settings shows an error. What should you do?

Accepted Answer

Set the app's keyVaultReferenceIdentity property to the resource ID of the user-assigned identity The Key Vault references article says references use the app's system-assigned identity by default. For apps that need secrets at creation time, before a system-assigned identity exists, it says to grant a user-assigned identity access in advance, assign it to the app, and set keyVaultReferenceIdentity to that identity's resource ID; the setting applies to every Key Vault reference in the app. Until it's set, the references don't use the identity that holds the role.

Question 54

Contoso is setting an encryption standard for new Linux VMs built from the company's own custom image. The standard must use customer-managed keys for the OS and data disks, encrypt the disk caches and the data that flows between the compute host and storage, put no encryption load on the VM's CPU, and stay supported after Azure Disk Encryption retires. Which approach should the security engineer choose?

Accepted Answer

Encryption at host, with the OS and data disks using a disk encryption set that holds the customer-managed key The comparison table in the overview of managed disk encryption options shows that encryption at host encrypts disk caches and the data flows between compute and storage, doesn't use the VM's CPU, works for custom images, and gives customer control of keys when configured with a disk encryption set; the server-side encryption article adds that each disk's cache uses that disk's key type. The overview says to use encryption at host for new VMs, because Azure Disk Encryption retires on September 15, 2028.

Question 55

Adatum enabled Defender for Servers Plan 2, and agentless results appear for most VMs. None ever appear for 12 VMs whose managed disks are encrypted with customer-managed keys through a disk encryption set, and the disks must stay on customer-managed keys. The keys sit in a key vault that uses the Azure RBAC permission model. The VMs run during every scan and meet the disk type, size and count limits. What should the engineer do?

Accepted Answer

Assign the Key Vault Crypto Service Encryption User role on the vault to the Microsoft Defender for Cloud Servers Scanner Resource Provider. The Enable agentless machine scanning article says Azure VMs whose disks use customer-managed keys need extra Key Vault permissions for Microsoft Defender for Cloud Servers Scanner Resource Provider, so that the scanner can create and check a secure copy of each encrypted disk. A vault on access policies needs Get, Wrap Key and Unwrap Key; a vault on Azure RBAC needs the Key Vault Crypto Service Encryption User role. This vault uses RBAC, so the role assignment is the fix.

Question 56

Litware protects a web app with Application Gateway WAF_v2, using a WAF policy in Prevention mode with the OWASP CRS 3.2 managed rule set. WAF logs trace blocked sign-in requests to one SQL injection rule that matches the value of a request header named X-Session-Context, which carries a signed token. That value must stay inspected by every other rule, and the rest of each request must stay fully inspected. What should you configure?

Accepted Answer

A per-rule exclusion for RequestHeaderValues equal to X-Session-Context, scoped to the matching rule The Application Gateway WAF exclusion lists article says an exclusion omits only the named request attribute from evaluation and the rest of the request is evaluated as normal, and that exclusions can apply to specific rules or globally. Per-rule exclusions, available with CRS 3.2 or later, are the narrow choice the article recommends: the one rule skips that header value, while every other rule still inspects it and the rest of the request.

Question 57

Fabrikam runs 120 Azure VMs. On each, a billing service requests Microsoft Entra tokens from the Azure Instance Metadata Service without naming an identity, because the VM's only managed identity is a user-assigned identity that holds the service's role assignments. The security team will assign the Deploy prerequisites to enable Guest Configuration policies on virtual machines initiative. What should be done before its remediation runs?

Accepted Answer

Change the billing service's token requests to name the user-assigned identity by its client ID The machine configuration prerequisites article says the initiative's identity definitions create a system-assigned managed identity in addition to any user-assigned identities, and that existing applications that don't specify the user-assigned identity then default to the system-assigned one. The managed identities FAQ confirms that IMDS defaults to the system-assigned identity when a request names none, so naming the client ID keeps the billing service on its own role assignments.

Question 58

Woodgrove Bank is setting up the Phishing Triage Agent in Microsoft Defender. An engineer proposes connecting an existing user account whose Defender permissions come from a Privileged Identity Management (PIM) eligible assignment. The SOC manager wants the agent to run continuously in the background with only the permissions it needs. Which identity choice should be made in the setup wizard?

Accepted Answer

Create a new agent identity with a role holding the required permissions The Phishing Triage Agent article recommends creating a new agent identity, a Microsoft Entra Agent ID, and the wizard then lets you select or create a role with only the permissions the agent needs. It also states that a user identity for the agent isn't compatible with PIM or a Temporary Access Pass, because neither supports long-term background operations, so the PIM-based account can't meet the continuous-run requirement.

Question 59

Woodgrove Bank has two Microsoft Sentinel workspaces connected to the Defender portal with Microsoft Defender XDR: WS-HQ is primary and WS-Ops is secondary. The SOC makes WS-Ops the primary. Scheduled analytics rules in WS-HQ query DeviceProcessEvents data that the Defender XDR connector streamed there, and they must keep working. WS-HQ doesn't need Defender XDR incidents. What should the engineer do?

Accepted Answer

Configure DeviceProcessEvents table ingestion into WS-HQ from the Microsoft Sentinel Tables page When the primary changes, the Defender XDR connector connects to the new primary and disconnects from the former one. The Multiple Microsoft Sentinel workspaces in the Defender portal article says rules and automation built on Defender XDR data stop until table ingestion is configured, and that secondary workspaces can still ingest Defender tables under Microsoft Sentinel, then Configuration, then Tables. That restores DeviceProcessEvents in WS-HQ without XDR incidents.

Question 60

A Contoso engineer holds Microsoft Sentinel Contributor on the workspace and Logic App Contributor on the rg-soar resource group. While creating an automation rule with the incident-created trigger, the engineer finds an incident-trigger playbook from rg-soar grayed out in the Run playbook action. What should be done so the rule can run the playbook?

Accepted Answer

Grant Microsoft Sentinel permissions on rg-soar with Manage playbook permissions An automation rule runs playbooks through a Microsoft Sentinel service account, which needs the Microsoft Sentinel Automation Contributor role on the resource group where the playbook lives. Playbooks Sentinel can't run show as grayed out, and the Manage playbook permissions link grants that access on the spot. Granting it takes a role such as Owner on rg-soar, which the engineer doesn't hold, so an Owner of the resource group completes the step.

Question 61

Adatum's security engineer is a Security Administrator in Microsoft Entra ID and holds Owner on the subscription that contains the Microsoft Sentinel workspace. That Owner assignment carries a condition limiting which roles the engineer can assign. In the Defender portal, under System, then Settings, then Microsoft Sentinel, the workspace isn't offered for connection. What should change?

Accepted Answer

Re-create the engineer's Owner assignment at the subscription scope without a condition Connecting a workspace to the Defender portal takes at least Security Administrator in Microsoft Entra ID plus Owner, or User Access Administrator with Microsoft Sentinel Contributor. The Connect Microsoft Sentinel to the Microsoft Defender portal article adds that the Owner assignment must be unconditional at the subscription scope, and workspaces the user lacks permissions for aren't offered. The Entra side is already met, so the conditional Owner assignment is what to fix.

Question 62

Contoso's Linux log forwarder runs Azure Monitor Agent 1.41 or later with two DCRs: Syslog via AMA collecting local4 for Linux servers, and CEF via AMA collecting local4 for a firewall that can send only on local4 and whose syslog headers don't follow RFC 3164 or RFC 5424. Firewall events land in both CommonSecurityLog and Syslog. Linux local4 messages must stay in Syslog. What should the engineer do?

Accepted Answer

Add a Syslog DCR transformation dropping rows where ProcessName has CEF or SyslogMessage has CEF:0 The Syslog and CEF via AMA connectors overview says using one facility for both Syslog and CEF duplicates data across CommonSecurityLog and Syslog. When the source can't change facilities, add an ingestion-time transformation to the Syslog DCR that filters CEF messages out. From AMA 1.41, ProcessName might not contain CEF for vendors whose headers break RFC 3164 or RFC 5424, so the filter must check both ProcessName and SyslogMessage.

Question 63

Fabrikam's auditors require a full user audit trail from the company's Windows servers, including sign-out events (event ID 4634). The SOC wants the lowest ingestion volume that still meets the requirement and won't maintain hand-written XPath queries. Which event set should the security engineer select in the Windows Security Events via AMA connector?

Accepted Answer

Common The Windows security event sets reference describes Common as a standard auditing set that keeps a full user audit trail, with both sign-in and sign-out events (4624 and 4634), security group changes, and key domain controller Kerberos operations, while cutting volume to a more manageable level. That makes it the smallest prebuilt set that satisfies an audit trail requirement, and it needs no XPath maintenance.

Question 64

Woodgrove Bank runs Defender CSPM on its Azure subscriptions. The CISO wants each high-severity Microsoft cloud security benchmark recommendation assigned to the person named in the resource's Owner tag, with 30 days to fix it and weekly email reminders, and the secure score must not drop for these findings until a due date passes. What should the security engineer configure?

Accepted Answer

A governance rule by severity that sets the owner by resource tag, a 30-day time frame, and Apply grace period selected Governance rules assign an owner, read from a resource tag if you choose, and a due date 7, 14, 30 or 90 days after the rule triggers, and owners get weekly emails by default. The rule setup says that when recommendations come from the Microsoft cloud security benchmark and you don't want the resources to affect Secure Score until they're overdue, you select Apply grace period. Governance rules require Defender CSPM, which Woodgrove runs.

SC-500 practice questions, with full explanations

The SC-500 bookshelf

Work the 75 questions, one topic at a time

Manage identity, access, and governance (18 questions)

Litware's help desk lead will issue Temporary Access Passes so that users can register passkeys, including users who already hold Microsoft Entra administrator roles. Following least privilege, which role should the help desk lead hold to create passes for both standard users and administrators?

At Litware, the security engineer opens the PIM role settings for the Exchange Administrator Microsoft Entra role, turns on Require approval to activate, and saves without selecting any approvers. Later, an eligible user submits an activation request. Who can approve it?

Tailspin Toys connected an AWS account to Microsoft Defender for Cloud and runs foundational CSPM only. The security team wants a custom recommendation that marks EC2 instances missing a CostCenter tag as unhealthy and wants it grouped into a custom standard. What should the team do?

Secure storage, databases, and networking (21 questions)

Contoso's central network team uses Azure Virtual Network Manager. Its monitoring system in 10.100.5.0/24 must always reach agents on TCP 443 in every virtual network of a network group, even if a workload team later adds an NSG rule that blocks that traffic. What should the central team deploy?

Secure compute (18 questions)

Manage and monitor security posture (18 questions)

Other certification question sets