SC-500 Microsoft Certified: Cloud and AI Security Engineer Associate Free Practice Exam Questions (2026 Updated)

Encryption type

ExpressRoute circuits

Layer 2 encryption

ER3 and ER4 only

Layer 3 encryption

ER1, ER2, ER3, and ER4

For Layer 2 encryption, Azure ExpressRoute uses MACsec (Media Access Control Security). Microsoft states that MACsec is available for ExpressRoute Direct connections because customers have dedicated physical ports connecting their edge routers directly to Microsoft Enterprise Edge routers. Therefore, both ER3 (ExpressRoute Direct) and ER4 (ExpressRoute Metro Direct) can use MACsec. Provider-based ExpressRoute circuits such as ER1 and ER2 do not expose dedicated ExpressRoute Direct ports to the customer and therefore do not support this native Layer 2 MACsec capability. Microsoft Learn

For Layer 3 encryption, ExpressRoute can use IPsec over ExpressRoute private peering. Unlike MACsec, IPsec is an end-to-end network-layer encryption mechanism and is not dependent on ExpressRoute Direct physical ports. Microsoft states that IPsec over ExpressRoute works with any ExpressRoute circuit, allowing encrypted connectivity between the on-premises network and Azure over private peering.

Storage2 must be configured to use an account encryption key. The planned storage account must support Azure Table storage, while the technical requirement specifies that all storage data must be encrypted using Fabrikam-managed keys, meaning customer-managed keys (CMKs).

Azure Storage treats Table and Queue encryption differently from Blob Storage and Azure Files. Microsoft states that to encrypt Table Storage or Queue Storage with a customer-managed key, the storage account must be configured at creation time to use an encryption key scoped to the account rather than the default service-scoped key. After creation, this setting cannot be changed. Microsoft Learn

An encryption scope does not solve this requirement because encryption scopes apply to Blob Storage containers and individual blobs, not Azure Table data. Microsoft Learn

An Azure RBAC assignment may later be required so that the storage account ' s managed identity can access the customer-managed key in Key Vault, but it does not itself configure Table Storage to support account-level CMK encryption. Purge protection applies to Azure Key Vault rather than storage2.

Therefore, when storage2 is created, configure Table Storage to use the account encryption key.

===============

Choose Admin1 because the planned Defender for Cloud change is to enable the NIST SP 800-53 Rev. 5 regulatory compliance standard for Sub1. Defender for Cloud implements regulatory compliance standards through Azure Policy initiatives, and assigning a new standard requires permissions to create or manage policy assignments.

Microsoft states that assigning a regulatory compliance standard requires Owner or Policy Contributor permissions at the relevant scope. Microsoft Learn Admin1 has the Resource Policy Contributor Azure role on Sub1, which provides the policy-management permissions required to assign policy initiatives and therefore supports enabling the NIST standard without granting broader resource-management permissions.

Admin2 has User Access Administrator, which manages Azure RBAC assignments but does not provide the policy-management permissions required for this operation. Admin3 has Contributor, which can manage Azure resources but is restricted from performing certain Microsoft.Authorization operations, including policy assignment operations needed here. Admin4 is a Global Administrator in Microsoft Entra but has no Azure role assignment for Sub1; Microsoft Entra directory administration does not automatically provide subscription-level Defender for Cloud policy-management rights.

Because Admin1 already has the specific policy-management role required for the change, selecting Admin1 satisfies both the functional requirement and the principle of least privilege.

===============

For AKS1, assign the AcrPull role on Registry1. AcrPull provides the permissions required to download container images from an Azure Container Registry without granting permissions to push, modify, or delete images. Microsoft documents that when AKS is integrated with an Azure Container Registry, the appropriate pull-only role is assigned to the AKS identity used for image pulls. This satisfies the explicit requirement that AKS1 must only be able to pull images and follows least privilege. Microsoft Learn

For ID1, assign AcrPush. Microsoft defines AcrPush as the built-in Azure RBAC role for identities that require both push and pull permissions on a non-ABAC-enabled Azure Container Registry. It therefore allows ID1 to upload container images and retrieve existing images from Registry1 without granting broad resource-management capabilities such as Contributor or Owner. Microsoft Learn

Contributor and Owner would grant substantially more Azure management permissions than required. Reader does not provide container image pull/push data-plane permissions.

The first step is to enable a managed identity for APIM1. Azure API Management uses a system-assigned or user-assigned managed identity to authenticate to Azure Key Vault when a named value references a Key Vault secret. Microsoft documents that APIM must have a managed identity and that this identity must then be granted the required Key Vault secret permissions before APIM can retrieve the secret.

After the identity is enabled, you grant that identity appropriate Key Vault access—typically secret Get and, depending on the configuration, List permissions—and then configure the APIM named value to reference the Key Vault secret. Microsoft specifically supports named values whose type is Key vault, allowing APIM policies to consume secrets without storing their plaintext values directly in the API Management configuration.

Merely marking the current named value as a secret only masks and encrypts the value inside APIM; it does not satisfy the Defender recommendation that the value be stored in Azure Key Vault. Defender for APIs is unrelated to establishing the Key Vault integration, and APIM subscription keys serve a different purpose from backend credentials.

This aligns with SC-500 objectives covering managed identities, Azure Key Vault, and securing application-platform services such as Azure API Management.

Application

Users who can grant admin consent

App1

User1 only

App2

User1 only

The current Microsoft Entra documentation establishes that tenant-wide admin consent requires an appropriately privileged directory role. Application Administrator is one of the roles permitted to grant tenant-wide consent for requested permissions, except certain Microsoft Graph application permissions that require a more privileged role such as Privileged Role Administrator. User1 therefore has the relevant admin-consent authority. Microsoft Learn

Being an enterprise application owner does not by itself confer tenant-wide admin-consent authority. Ownership allows management of organization-specific properties of the owned enterprise application, including SSO, provisioning, user assignments, and ownership, but it doesn ' t elevate the owner into a tenant administrator capable of granting organization-wide API consent. Microsoft Learn

Consequently, User3 being the owner of App1 doesn ' t qualify User3 to grant tenant-wide admin consent, and User4 ' s ownership of App2 doesn ' t provide that permission either. Their Azure DevOps Administrator and Security Operator roles don ' t supply application-consent authority.

User2 ' s Application Developer role permits application-development activities but isn ' t an admin-consent role.

Definition effect: DeployIfNotExists; For remediation: a managed identity that has the Contributor role

DeployIfNotExists is the Azure Policy effect used when a noncompliant resource should trigger deployment of a related configuration, such as a VM extension. Remediation tasks require a managed identity that has the role permissions needed to deploy the extension. Audit or Deny would only report or block resources. The managed identity is essential because Azure Policy performs the deployment on behalf of the assignment. This answer also follows operational scalability. Microsoft security architecture favors policy-driven deployment, agentless assessment, managed identities, and Defender workload plans where possible. Those mechanisms reduce manual configuration while keeping enforcement tied to the resource type, which is why the selected choice is stronger than manual or after-the-fact alternatives. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > Azure Policy built-in and custom definitions; Microsoft Learn > deployIfNotExists and remediation.

==============================================================

Auditing scope: Enable on each server or instance; Auditing destination: A Log Analytics workspace

Server-level or instance-level auditing minimizes administration because new databases under the same logical server or managed instance inherit the auditing configuration. The destination must support KQL queries, which points to a Log Analytics workspace, not local database-level files or ad-hoc storage-only output. This design gives the security team a central query plane for audit events while avoiding repeated manual configuration each time another Azure SQL database is added. For this domain, least privilege means granting only the required data operation or allowing only the required network flow. The correct response avoids shared keys, broad peering, general contributor roles, or log-only controls when the scenario demands prevention, routing, event triggering, or account-specific configuration. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > Configure database auditing; Microsoft Learn > Azure SQL auditing destinations and Log Analytics.

==============================================================

Comprehensive and Detailed 150 to 250 words of Explanation From [Cloud and AI Security Engineer/Course Guide/topics]:

Create an Azure role assignment for the AKS service principal at the Azure Container Registry scope. The automatically generated AKS service principal already provides the Microsoft Entra identity used by the cluster. What it still requires is authorization to perform the necessary operations against the target registry.

Microsoft documents that when an existing service principal needs access to an Azure Container Registry, you grant that access by creating an Azure RBAC role assignment for the service principal. For a registry using the traditional RBAC Registry Permissions model, AKS image-pull access is normally provided by assigning the AcrPull role at the registry scope. Microsoft Learn

Current Azure Container Registry configurations can also use the newer RBAC + ABAC repository-permissions model. In that model, the corresponding least-privilege pull role is Container Registry Repository Reader, rather than AcrPull. The principle remains the same: the AKS identity must receive an appropriate role assignment on the registry. Microsoft Learn

A Microsoft Entra user or group is unnecessary because the cluster already has a service principal. A Key Vault secret is also unnecessary for Azure RBAC authorization.

Correct answer: C. a role assignment

To customize the baseline: Use Azure Machine Configuration; Set enforcement mode to: Apply and Autocorrect

Azure Machine Configuration is the correct mechanism for applying and customizing guest configuration baselines across Azure VMs and Azure Arc-enabled servers. It integrates with Azure Policy and can enforce configuration through assignment modes such as Apply and Autocorrect. This provides centralized compliance and automatic correction without building a separate configuration-management pipeline for Windows and Linux servers. The compute domain tests whether protection is applied before deployment, during runtime, or through posture assessment. The selected answer matches the phase described in the requirement. Detection-only tools are not acceptable when the requirement says prevent, and local installation methods are inferior when Defender for Cloud, Azure Policy, or Azure Machine Configuration can enforce the control centrally. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > Azure Machine Configuration; Microsoft Learn > assignment modes and remediation.

Passwordless sign-in: Microsoft Authenticator; First-time sign-in for new users: Temporary Access Pass

Microsoft Authenticator supports passwordless phone sign-in, allowing users to authenticate from a mobile device without typing a password. Temporary Access Pass is a time-limited, helpdesk-issued credential designed for onboarding or recovery, so it fits first-time sign-in for new users. SMS and voice call are authentication methods but are not passwordless sign-in methods in the same strong sense, and hardware OATH tokens are not the requested mobile-device experience. For SC-500, the decisive distinction is whether the control authenticates an identity, grants authorization, or merely changes configuration visibility. The incorrect choices generally either grant excessive privilege, change the application model, or operate at the wrong scope. Microsoft expects the least-privilege identity path that satisfies the scenario without introducing shared secrets or unnecessary tenant-wide rights. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > passwordless authentication methods; Microsoft Learn > Microsoft Authenticator and Temporary Access Pass.

==============================================================

Defender plan

Selection

Defender for Servers Plan 1

Sub1 and VM1 only

Defender for Key Vault

Sub1 and Vault1 only

For Defender for Servers Plan 1, Microsoft supports enablement at the Azure subscription level and at the individual server resource level. Microsoft’s current deployment-scope table explicitly states that Plan 1 can be enabled for an Azure subscription and for a specific resource, such as an Azure VM. It cannot be enabled directly on a management group, resource group, or Log Analytics workspace as a Plan 1 protection scope.

For Defender for Key Vault, the exam item targets the Defender plan at the subscription or individual vault scope. Defender for Key Vault is billed and represented using a per-vault protection model, and Microsoft’s Defender for Cloud policy set includes a dedicated configuration for the Key Vault plan. It is not enabled on a resource group, management group, or Log Analytics workspace.

One current-platform nuance: Microsoft announced in July 2026 that new onboarding through the legacy Defender for Key Vault plan-enablement path is deprecated/blocked, with migration to the newer fixed-pricing model. The exam answer for this item as written remains the scope combination above.

Final selections:

Defender for Servers Plan 1 → Sub1 and VM1 only

Defender for Key Vault → Sub1 and Vault1 only

Virtual machine type

Plan

Windows Server

Microsoft Defender for Servers

Linux

Microsoft Defender for Servers

Microsoft Defender for Servers is the correct plan for both the Windows Server and Linux virtual machines because the requirement is to provide malware protection at the virtual-machine operating-system level. Defender for Servers protects both Windows and Linux VMs and integrates with Microsoft Defender for Endpoint to provide endpoint protection, including antimalware capabilities. Microsoft states that Defender for Servers supports Windows and Linux virtual machines across Azure and other supported environments.

For Linux systems, Defender for Servers deploys the Defender for Endpoint component that includes antimalware functionality. For Windows Server, Defender Antivirus is integrated with Defender for Endpoint and provides malware protection. In addition, Defender for Servers Plan 2 supports agentless malware scanning, which scans VM disks for malicious files without installing an additional scanning agent.

The fact that the Linux machines host databases does not make Microsoft Defender for Databases the correct answer. Defender for Databases protects supported database workloads against database-specific threats; it does not replace VM-level malware protection.

The SC-500 study guide places onboarding and configuring VMs with Defender for Servers under the Secure compute objective.

Only image2 is trusted. Azure Container Registry ' s Docker Content Trust (DCT) implementation identifies trusted image tags by cryptographic signatures generated when a publisher pushes an image with client-side Docker Content Trust enabled.

Microsoft explains that enabling DCT at the registry level allows clients to push signed images, but enabling the registry feature does not retroactively sign existing images. Therefore, image1, which already existed before content trust was enabled, doesn ' t automatically become trusted. Microsoft Learn

Image2 is pushed after registry content trust is enabled and with client content trust enabled. Its Docker client therefore signs and publishes the corresponding trust metadata, making image2 the trusted image.

Image3 is pushed with client content trust disabled, so it remains unsigned even though the registry itself supports DCT. Microsoft explicitly notes that a DCT-enabled registry can still contain a mixture of signed and unsigned image tags.

There is also a current platform lifecycle point: Microsoft stopped allowing Docker Content Trust to be newly enabled on registries that hadn ' t previously enabled it beginning May 31, 2026, and DCT is scheduled for complete removal on March 31, 2028. The question nevertheless tests the documented DCT trust semantics.

Requirement

Conditional Access setting

Only allow access to App1 from Windows devices

Conditions

Only allow devices that are marked as compliant to access App1

Grant

For the operating-system requirement, configure Conditions. Microsoft Entra Conditional Access includes a Device platforms condition that allows a policy to target specific operating systems, including Windows. To restrict the policy to Windows devices, configure Conditions → Device platforms, enable platform targeting, and select Windows as the applicable platform. Microsoft documents device platform as one of the primary Conditional Access signals that administrators can use to scope policy enforcement. Microsoft Learn

For the compliance requirement, configure the Grant access control and select Require device to be marked as compliant. Microsoft Entra receives device compliance information from Microsoft Intune and evaluates that state during authentication. If the device isn ' t compliant, Conditional Access denies access when this grant requirement applies. Microsoft explicitly identifies Require device to be marked as compliant as a Conditional Access Grant control. Microsoft Learn

Target resources would be used separately to select App1 as the application protected by the policy. Users or agents determines which identities are subject to the policy, while Session manages post-authentication session behavior. Neither implements the two requirements shown in the answer area.

Statement

Answer

You can establish a Remote Desktop connection from VM1 to VM3 for a maximum of three hours.

No

You can establish a Remote Desktop connection from VM2 to VM1 after requesting access.

No

You can establish a Remote Desktop connection from VM3 to VM1 without requesting access.

No

JIT access on VM1 controls inbound traffic to VM1, not outbound traffic originating from VM1. Therefore, the three-hour RDP rule on VM1 does not limit a connection from VM1 to VM3. Microsoft states that JIT protects selected VM ports by blocking inbound traffic until access is requested and approved.

The second statement is No because VM2 ' s source address is in 172.16.0.0/24, but VM1 ' s JIT configuration for RDP port 3389 permits requests only from 10.10.0.0/24 and 192.168.10.0/24. JIT requests must use source addresses allowed by the configured JIT policy.

The third statement is also No. VM3 is in 192.168.10.0/24, which is an allowed source range for port 3389, but that does not mean permanent access is open. Microsoft documents that when JIT is enabled, users must still request access; Defender for Cloud then temporarily opens the selected port for the approved source IP and duration.