SC-500 Microsoft Certified: Cloud and AI Security Engineer Associate Free Practice Exam Questions (2026 Updated)

A user-assigned managed identity can be attached to multiple virtual machines and then granted an Azure Storage data role. The applications running on VM1 and VM2 can request tokens for that identity and access storage1 without account keys. Public network access is already enabled, so the missing control is authorization. Assigning the user-assigned managed identity to the correct storage role satisfies the access requirement. For SC-500, the decisive distinction is whether the control authenticates an identity, grants authorization, or merely changes configuration visibility. The incorrect choices generally either grant excessive privilege, change the application model, or operate at the wrong scope. Microsoft expects the least-privilege identity path that satisfies the scenario without introducing shared secrets or unnecessary tenant-wide rights. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > managed identities; Microsoft Learn > user-assigned managed identities and role assignment to storage.

==============================================================

Multi-user authorization (MUA) is the Azure Backup control designed to require a second, independently controlled authorization before critical Recovery Services vault operations can proceed. MUA uses an Azure Resource Guard as an additional authorization boundary. Microsoft explicitly supports placing the Resource Guard in a different Microsoft Entra tenant from the Recovery Services vault, which provides the highest degree of administrative isolation.

In this design, RSVault1 remains in contoso.com, while the security team can own the Resource Guard in security.contoso.com. When a vault administrator attempts a protected operation, such as modifying protection or changing a backup policy in a way that reduces retention or increases RPO , the user must obtain the required Resource Guard permission. An approver in the security tenant can control that access, including through PIM and the Backup MUA Operator role.

Immutability primarily prevents backup data from being altered or deleted and does not provide cross-tenant approval. PIM on the Backup Operator role alone does not create the Resource Guard authorization boundary. A private endpoint addresses network access only.

The SC-500 study guide explicitly includes configuring security controls for backup protection by using Azure Backup security features .

===============

Approval before elevation is implemented by requiring approval to activate the PIM role. Automatic removal after a fixed active period is controlled by the activation maximum duration. Expiring active or eligible assignments governs the assignment lifecycle, not the duration of each activation session. Requiring justification can improve audit quality, but it does not ensure that another administrator evaluates the request or that access ends after the configured active window. This domain is tested through precise scope control: tenant, subscription, resource, application, and data-plane authorization are not interchangeable. The correct choice applies the smallest identity or governance control that enforces the stated requirement. Options that only add users, create registrations, or provide broad administrator access fail because they do not directly enforce the requested access behavior. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > Privileged Identity Management; Microsoft Learn > configure role activation settings.

==============================================================

User Access Administrator is the least-privilege Azure built-in role for managing role assignments without full resource ownership. Assigning it at the MG1 scope covers both Sub1 and Sub2 because management group scope flows down to child subscriptions. Contributor cannot assign Azure roles. Owner would work but grants more than role-assignment authority, violating least privilege. Assigning separately at each subscription adds unnecessary administration. For SC-500, the decisive distinction is whether the control authenticates an identity, grants authorization, or merely changes configuration visibility. The incorrect choices generally either grant excessive privilege, change the application model, or operate at the wrong scope. Microsoft expects the least-privilege identity path that satisfies the scenario without introducing shared secrets or unnecessary tenant-wide rights. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > manage Azure built-in role assignments; Microsoft Learn > User Access Administrator role.

==============================================================

VNet1: An Azure Private Link service; VNet2: A private endpoint

Private Link service and private endpoint provide one-way, explicitly scoped private connectivity. VNet1 hosts the target VMs and should expose only the intended service through an Azure Private Link service. VNet2, where VM3 runs, consumes that service through a private endpoint. VNet peering or VPN would create broader network reachability between the networks and would not inherently deny VM3 access to other resources in Sub1. Microsoft platform security questions usually hinge on where enforcement occurs: at the resource, server, subnet, firewall policy, private endpoint, or subscription level. The selected answer uses the control plane that owns that enforcement point. Other options are rejected when they only log activity, broaden network access, or protect a different service category. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > Private Link services and private endpoints; Microsoft Learn > Azure Private Link architecture.

==============================================================

Requirement

Component

To allow traffic between all the virtual networks in Production

A connectivity configuration

To block traffic between Development and Production

A security admin configuration

An Azure Virtual Network Manager connectivity configuration defines how virtual networks within network groups communicate. For the Production network group, a connectivity configuration can implement a mesh topology , which establishes connectivity among the virtual networks in that group without requiring administrators to create and maintain individual VNet peerings. Microsoft documents connectivity configurations as the mechanism for establishing managed connectivity patterns such as mesh and hub-and-spoke across virtual networks.

To prevent communication between the Development and Production environments, use a security admin configuration . Security admin configurations contain centrally managed security admin rule collections that can Allow, Always Allow, or Deny network traffic. These rules can be applied across targeted network groups and are specifically suitable for enforcing network segmentation. Microsoft identifies blocking traffic between virtual networks or subnets as a supported security-admin-rule scenario. A Deny security admin rule terminates traffic evaluation and prevents the traffic from reaching the destination, independently of ordinary NSG permissions.

A routing configuration controls routing behavior rather than organizational security segmentation. IPAM manages address-space planning and allocation, while a scope defines which resources Virtual Network Manager can manage; neither directly satisfies these two traffic-control requirements.

Apply a Read-only lock directly to VNet1 . Azure management locks operate independently of Azure RBAC and override permissions such as Owner. A ReadOnly lock prevents authorized users from both updating and deleting the locked resource, which exactly satisfies the protection requirement for VNet1. Microsoft documents that a ReadOnly lock effectively restricts authorized users to read operations for the locked resource.

The lock must be scoped specifically to VNet1 , not RG1. Locks applied at a parent scope are inherited by child resources. Therefore, applying ReadOnly to RG1 would also prevent modifications to storage1 and other resources in RG1, violating the requirement that engineers must remain able to update those resources.

A Delete lock is insufficient because CanNotDelete permits users to modify a resource while preventing only deletion. The question explicitly requires preventing updates and deletions , so ReadOnly is necessary.

This aligns with the SC-500 governance objective covering enforcement of security controls for Azure resources. The current study guide places governance and security-control enforcement under Manage identity, access, and governance .

===============

Configure an inbound access restriction on App1 that explicitly allows the partner ' s public IP address. Azure Functions running on App Service infrastructure support access restriction rules that operate as an inbound network ACL. Microsoft states that these rules can contain individual IPv4/IPv6 addresses or ranges and that once one or more rules are configured, unmatched traffic can be denied. This directly supports the requirement to accept HTTP requests only from the specified partner IP.

The existing virtual network integration does not control inbound access. Microsoft specifically defines VNet integration as an outbound networking capability. Consequently, an NSG associated with the integration subnet affects traffic originating from the Function App but does not filter requests arriving at the Function App ' s public endpoint.

A private endpoint would eliminate normal public access and therefore would not support a partner that connects from a public Internet IP unless additional private connectivity were implemented. Azure Bastion is for administrative connectivity to VMs, while NAT Gateway controls outbound source addressing.

The SC-500 study guide explicitly includes configuring Azure Functions authentication and network access under Secure compute.

===============

For external threat detection and real-time agent protection to work, Defender must receive app activity through the Microsoft 365 app connector. Session policies in Defender for Cloud Apps govern user sessions, Global Secure Access controls network access, and a Sentinel connector is for log ingestion and investigation. The Microsoft 365 app connector is the required Defender portal-side integration for this runtime protection scenario. For SC-500, compute controls are evaluated by workload type: VM, Arc server, AKS, container registry, container group, Functions, Logic Apps, App Service, and AI agent runtime. The right answer uses the Microsoft control that is native to that workload. Broad Azure roles or unrelated monitoring services would either overgrant access or fail to enforce the required security state. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > AI workload runtime protection; Microsoft Learn > Microsoft 365 app connector and Copilot agent protection.

==============================================================

An app consent policy allows the tenant to define which delegated permissions are considered low risk and may be consented to by users. Higher-privilege permissions can remain subject to admin consent. Tenant-wide admin consent would approve App1 broadly rather than creating an ongoing policy boundary. Application assignments and PIM role assignments control user access or privileged roles, not delegated permission consent behavior. This domain is tested through precise scope control: tenant, subscription, resource, application, and data-plane authorization are not interchangeable. The correct choice applies the smallest identity or governance control that enforces the stated requirement. Options that only add users, create registrations, or provide broad administrator access fail because they do not directly enforce the requested access behavior. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > app consent settings; Microsoft Learn > app consent policies.

==============================================================

Security Copilot workspaces have membership and capacity associations. Before routing embedded experience traffic to Workspace1, User1 must be granted access to that workspace. Assigning a generic Security Operator role in Microsoft Entra does not make the user a member of the Security Copilot workspace. Disassociating capacity from the default workspace or creating more capacity does not resolve the user-access error. This domain is tested through precise scope control: tenant, subscription, resource, application, and data-plane authorization are not interchangeable. The correct choice applies the smallest identity or governance control that enforces the stated requirement. Options that only add users, create registrations, or provide broad administrator access fail because they do not directly enforce the requested access behavior. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > Security Copilot workspaces; Microsoft Learn > workspace access and capacity.

==============================================================

Plan: Defender Cloud Security Posture Management (CSPM); Feature: Agentless machine scanning

The scenario asks for plaintext token and SSH private key discovery on virtual machines with minimal changes to the machines. Defender CSPM with agentless machine scanning is the correct combination because it scans disks without requiring an agent deployment to each VM. Defender for Key Vault protects secrets stored in the vault but does not detect developers placing credentials on VM file systems. Azure Monitor Agent would add operational overhead and still would not provide this secret scanning capability. This answer also follows operational scalability. Microsoft security architecture favors policy-driven deployment, agentless assessment, managed identities, and Defender workload plans where possible. Those mechanisms reduce manual configuration while keeping enforcement tied to the resource type, which is why the selected choice is stronger than manual or after-the-fact alternatives. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > Defender CSPM secret scanning; Microsoft Learn > agentless machine scanning.

==============================================================

To use Microsoft Authenticator as a primary authentication method , Group1 must be enabled for passwordless authentication . Passwordless phone sign-in allows users to authenticate directly by using Microsoft Authenticator instead of first supplying a password. Microsoft describes Authenticator passwordless sign-in as a primary sign-in method in which the user approves a number challenge and then completes biometric or PIN verification on the registered device.

The Microsoft Entra Authentication methods policy supports targeting specific users and groups and controlling whether they can use Authenticator for push MFA, passwordless authentication, or both . Enabling the passwordless mode for Group1 therefore directly meets the stated requirement.

Push authentication is primarily used as an MFA verification mechanism and does not by itself make Authenticator the user ' s primary authentication method. One-time passcodes are also verification codes used for MFA scenarios rather than passwordless primary sign-in. Revoking sessions simply forces users to authenticate again and does not enable a new authentication method.

The SC-500 study guide explicitly includes implementing and configuring authentication methods, including MFA and passwordless authentication , under the Manage identity, access, and governance domain.

===============

Defender for Storage can be configured at the subscription level and overridden at the individual storage account level. Because the subscription cap is 10,000 GB but storage1 needs its own 2,000 GB monthly cap, the correct action is to enable the storage-account override and configure the account-specific malware scanning limit. Sentinel ingestion caps and DCR filtering affect logs, not the malware scanning volume cap. For this domain, least privilege means granting only the required data operation or allowing only the required network flow. The correct response avoids shared keys, broad peering, general contributor roles, or log-only controls when the scenario demands prevention, routing, event triggering, or account-specific configuration. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > Defender for Storage configurations; Microsoft Learn > override subscription-level Defender for Storage settings.

==============================================================