SC-500 — Microsoft Cloud and AI Security Engineer
Microsoft

Microsoft Cloud and AI Security Engineer (SC-500) Practice Questions

★★★★★★ 4.7 105 verified reviews
100 questions
June 13, 2026 updated
✓ Online quiz simulator
▶ Start Free Practice Exam

Domain coverage

  • Manage identity, access, and governance (20–25%)
  • Secure storage, databases, and networking (25–30%)
  • Secure compute (20–25%)
  • Manage and monitor security posture (20–25%)

Sample Questions (10 of 100 shown)

Q1 Manage Identity, Access, and Governance (20-25%)
Which Microsoft Entra ID feature provides just-in-time, time-bound activation of privileged role assignments with approval workflows and access reviews?
  1. Conditional Access
  2. Privileged Identity Management (PIM)
  3. Entra ID Protection
  4. Managed identities
✓ Correct Answer: B
Privileged Identity Management (PIM) allows you to make role assignments eligible rather than permanent, so users activate the role on-demand for a limited time window. PIM also supports approval workflows, MFA on activation, justification, and periodic access reviews, reducing standing privileged access.
Q2 Manage Identity, Access, and Governance (20-25%)
A Conditional Access policy needs to require multi-factor authentication only when a user's sign-in is flagged as high risk. Which condition should the policy use?
  1. User risk
  2. Sign-in risk
  3. Device platform
  4. Named locations
✓ Correct Answer: B
Sign-in risk represents the probability that a specific authentication request is not authorized, calculated in real time by Entra ID Protection. Targeting the sign-in risk condition allows the policy to require MFA only for that high-risk sign-in. User risk reflects the likelihood the account itself is compromised over time.
Q3 Manage Identity, Access, and Governance (20-25%)
Which authentication method provides the strongest phishing-resistant passwordless sign-in for Microsoft Entra ID?
  1. SMS one-time passcode
  2. FIDO2 security keys
  3. Security questions
  4. Email one-time passcode
✓ Correct Answer: B
FIDO2 security keys are phishing-resistant because the credential is bound to the legitimate domain and never leaves the hardware key, defeating replay and credential phishing attacks. SMS and email OTP are susceptible to interception and phishing, making them weaker methods.
Q4 Manage Identity, Access, and Governance (20-25%)
You want an Azure virtual machine to read secrets from Azure Key Vault without storing any credentials in code. What should you configure?
  1. A service principal with a client secret stored in app settings
  2. A system-assigned managed identity granted Key Vault access
  3. A shared access signature token embedded in the VM image
  4. A user account with Key Vault Administrator role
✓ Correct Answer: B
A system-assigned managed identity gives the VM an Azure-managed Entra identity that can authenticate to Key Vault without storing any credentials. You grant the identity access via a Key Vault access policy or Azure RBAC, eliminating credentials in code.
Q5 Manage Identity, Access, and Governance (20-25%)
Which setting in Microsoft Entra ID restricts which applications users can consent to and allows administrator approval for risky permission requests?
  1. User consent settings and the admin consent workflow
  2. Cross-tenant access settings
  3. Authentication strength policies
  4. Token lifetime policies
✓ Correct Answer: A
User consent settings control which OAuth permissions users can grant to applications, while the admin consent workflow lets users request admin approval for permissions they cannot self-consent to. Together they help mitigate consent grant attacks where an attacker tricks a user into granting permissions to a malicious app.
Q6 Manage Identity, Access, and Governance (20-25%)
Which Key Vault configuration restricts vault access to specific virtual networks and trusted Azure services while blocking all other public traffic?
  1. Soft-delete and purge protection
  2. Key Vault firewall with network rules and the trusted services exception
  3. Role-based access control assignments
  4. Key rotation policies
✓ Correct Answer: B
The Key Vault firewall allows you to deny public network access by default and selectively allow only chosen virtual networks, IP ranges, and trusted Microsoft services. This network-layer control complements data-plane authorization to ensure even authenticated requests must come from approved networks.
Q7 Manage Identity, Access, and Governance (20-25%)
An administrator must enforce that all new storage account deployments require secure transfer (HTTPS). Which service provides a built-in policy definition to audit or deny non-compliant deployments?
  1. Azure Policy
  2. Azure Blueprints
  3. Microsoft Sentinel
  4. Azure Advisor
✓ Correct Answer: A
Azure Policy provides built-in definitions that can audit or deny resource configurations that do not meet requirements, such as storage accounts not requiring secure transfer. Assigning these policies enforces governance at deployment time and continuously evaluates existing resources for compliance.
Q8 Manage Identity, Access, and Governance (20-25%)
Your security team must continuously evaluate the Azure environment against the Microsoft cloud security benchmark and a PCI DSS regulatory standard, and see a compliance score per standard. Which tool provides this?
  1. Azure Policy compliance state on a single custom initiative
  2. The regulatory compliance dashboard in Microsoft Defender for Cloud
  3. Microsoft Sentinel workbooks built on the AzureActivity table
  4. Azure Resource Graph queries scheduled through a Logic App
✓ Correct Answer: B
Defender for Cloud's regulatory compliance dashboard maps your environment against assigned security standards — the Microsoft cloud security benchmark, PCI DSS, ISO 27001, and others — and reports a per-standard compliance score with drill-down to failing controls. A single Azure Policy initiative does not give per-regulatory-standard scoring.
Q9 Manage Identity, Access, and Governance (20-25%)
A privileged administrator only needs the User Access Administrator role for the four hours it takes to complete a quarterly access review. Security policy forbids standing privileged access. Which Microsoft Entra capability should you configure?
  1. A conditional access policy that blocks the role outside business hours
  2. Privileged Identity Management (PIM) with an eligible assignment and time-bound activation
  3. An access review that removes the role after 30 days
  4. A custom Entra role scoped to the access-review blade only
✓ Correct Answer: B
Privileged Identity Management with an eligible (not active) assignment is the supported pattern for just-in-time privileged access: the administrator activates the role for a bounded window, optionally with approval and MFA, and it expires automatically. Conditional access governs sign-in conditions, not role activation lifetime.
Q10 Manage Identity, Access, and Governance (20-25%)
An Azure Function needs to read secrets from Azure Key Vault without any credentials stored in code or app settings. What is the correct configuration?
  1. Store the Key Vault access key in an encrypted app setting
  2. Use a Key Vault access policy with a service principal and a client secret rotated every 90 days
  3. Enable a system-assigned managed identity on the Function and grant it Key Vault access via RBAC or an access policy
  4. Embed an Entra ID app registration certificate in the deployment package
✓ Correct Answer: C
A system-assigned managed identity gives the Function an Entra identity with no credentials to store or rotate — Azure handles the lifecycle — and you grant that identity Get/List on secrets through RBAC or a Key Vault access policy. Encrypted app settings and rotated client secrets both still store a credential.

You've viewed 3 of 100 questions. Start the free practice exam to answer all questions with instant feedback.

Exam overview

Microsoft's SC-500 exam validates the skills of the Cloud and AI Security Engineer who designs and implements comprehensive security controls across Azure infrastructure, AI workloads, and the Microsoft security suite. Delivered through Pearson VUE as a proctored exam, passing SC-500 awards the Microsoft Certified: Cloud and AI Security Engineer Associate credential and demonstrates hands-on competence in Defender for Cloud, Microsoft Sentinel, Entra ID governance, and AI workload protection—including the newly integrated Generative AI security capabilities that distinguish this exam from its predecessor, AZ-500.

Candidates preparing for SC-500 should have solid, practical experience administering Azure compute, network, and storage resources, along with a working knowledge of Microsoft Entra ID and Microsoft 365 administration. The most effective preparation combines the official multi-day SC-500T00-A instructor-led course with extensive hands-on time in an Azure trial subscription, where you can configure Defender CSPM attack path analysis, deploy Microsoft Security Copilot with native plugins, harden AI Gateway policies in Azure API Management, and test Entra Agent ID credential isolation for Copilot Studio agents.

The exam spans four domains: managing identity, access, and governance (20–25%), securing storage, databases, and networking (25–30%), securing compute including AI workloads (20–25%), and managing and monitoring security posture (20–25%). The newly integrated AI security structures are the primary pitfall: candidates consistently struggle with configuring AI Gateway policies in Azure API Management, assigning proper RBAC roles for Microsoft Copilot Studio agents, and distinguishing when to use user-assigned versus system-assigned managed identities across multi-cloud infrastructure patterns. Our practice questions target these exact pain points with scenario-based items that mirror the real exam's case-study format.

Our practice questions replicate the SC-500 question formats you will face on exam day: complex case studies with locked question blocks, hot-area selections for Defender for Cloud recommendation navigation, drag-and-drop matching for Azure Policy assignment scopes, and drop-down configuration scenarios for Key Vault network firewall rules and Private Endpoint DNS integration. Each question includes a detailed answer explanation that walks through the reasoning and references the specific Microsoft Learn documentation path, while the downloadable PDF packages the same question bank for offline review during commutes or in environments without stable internet.

Official Exam Domains & Weighting

To successfully pass the SC-500 exam, candidates must master the following core domains:
  • Domain 1: Manage identity, access, and governance (20–25%)
Covers Privileged Identity Management (PIM) for just-in-time role activation, advanced Conditional Access policy design, and passwordless infrastructure with FIDO2. Key skills include managing application registrations and OAuth consent grants, implementing system-assigned and user-assigned managed identities for Azure resources, deploying Azure Key Vault with RBAC access policies and network firewalls, and enforcing compliance using built-in and custom Azure Policy definitions within Defender for Cloud.
  • Domain 2: Secure storage, databases, and networking (25–30%)
Focuses on Azure Storage firewall rules, Shared Access Signature (SAS) lifecycle management, and activating Defender for Storage threat detection. Candidates must master Azure SQL Database platform-level security including Transparent Data Encryption (TDE) and advanced auditing, plus advanced networking with NSGs, Application Security Groups, Azure Firewall, Private Endpoints, Private Link, and Microsoft Entra Private Access for secure remote traffic.
  • Domain 3: Secure compute (20–25%)
Tests your ability to harden VMs via Defender for Cloud, implement container security across Azure Kubernetes Service (AKS) and Azure Container Registry, and secure serverless elements including Azure Functions and App Services. The core SC-500 differentiator: implementing AI workload security guardrails including configuring Microsoft Copilot Studio agent protections, Entra Agent ID isolation, Azure AI Studio hub hardening, AI Gateway policy enforcement in Azure API Management, prompt injection mitigation, and Defender for AI coverage.
  • Domain 4: Manage and monitor security posture (20–25%)
Covers Defender Cloud Security Posture Management (Defender CSPM) for attack path analysis and exposed secret scanning, plus designing and deploying Microsoft Sentinel workspaces with data connectors, Data Collection Rules (DCRs), analytics rules, and automated playbooks. Also includes deploying and assigning permissions within Microsoft Security Copilot workspaces, configuring native and Security Store plugins, and operationalizing Generative AI security operations across the Defender XDR suite.

What Our Customers Say 105 verified reviews

4.7 ★★★★★★ Based on 105 reviews
★★★★★
I had almost given up on SC-500 after failing twice. These questions pinpointed exactly what I was missing. Third time’s the charm!
— Noah S.
★★★★★★
Really well-structured SC-500 practice set. I like that you can attempt questions multiple times and it tracks your progress.
— Lucas W.
★★★★★★
I was nervous about the SC-500 exam because it had been years since my last cert. These questions got me back on track fast.
— Aurora C.
★★★★★
Was on the fence about buying the SC-500 practice test, but man am I glad I did. Nailed my certification today.
— Tyler M.
★★★★★★
I scored 890 on the SC-500 exam. Went through about 80% of this question bank and it was more than enough to pass.
— Levi C.
★★★★★★
Took the SC-500 exam today and passed with 87%. Used this as my main prep material for about a month.
— Grace L.

Log in to rate this exam and leave a review.

Submitted for moderation before publishing. Keep it helpful and respectful.

Frequently Asked Questions

The most common stumbling blocks center on the newly integrated AI security structures. Candidates struggle with configuring AI Gateway policies in Azure API Management, establishing proper RBAC roles for Microsoft Copilot Studio agents, and distinguishing when to use user-assigned versus system-assigned managed identities across multi-cloud infrastructure patterns. Another frequent mistake is misconfiguring Defender CSPM attack path rules versus classic Defender for Cloud security policies. Our practice questions include targeted scenario items that force you to reason through both of these exactly as the real exam presents them, with case studies that simulate multi-tier AI workload protection designs.

SC-500 is the modernization of the cloud security engineer role, with significantly expanded coverage of Generative AI workload protection, Microsoft Security Copilot, and integrated security suites like Defender XDR and Sentinel. AZ-500 is officially scheduled for complete retirement on August 31, 2026. If you are currently holding AZ-500 or preparing for it, SC-500 is the exam you should target. Our practice question bank is fully aligned to the SC-500 blueprint and does not contain legacy AZ-500 content that has been deprecated.

The primary resource is the interactive learning path series linked from the official Microsoft Learn SC-500 certification page. Microsoft also releases official Practice Assessments via the Learn platform roughly 8 weeks after the exam moves past its initial beta phase, allowing you to sample actual test layouts for free. Our practice question bank is aligned to the same May 2026 updated blueprint and includes detailed answer explanations that call out the exact distractor logic Microsoft uses, especially for the new AI security domains that test takers consistently report as the hardest section.

After a failed first attempt, you must wait 24 hours before rescheduling. A third or subsequent attempt requires a 14-day waiting period between sittings, and you are capped at five attempts within any rolling 12-month period. Each attempt requires a new registration fee unless you purchased a Microsoft Exam Replay bundle. Our mock exam mode is designed to simulate the real timing and question distribution, so you can identify domain-level gaps—especially in AI workload security and Defender CSPM—and avoid needing a retake in the first place.

The real SC-500 exam gives you 120 minutes of active time for 40–60 questions, including complex case studies with locked question blocks that simulate multi-tier cloud security designs spanning identity, networking, compute, and AI protection. Our mock exam mode enforces the same 120-minute clock and case-study format, so you learn exactly how fast you need to move through Defender CSPM attack path questions versus Azure Key Vault RBAC drag-and-drop items. Practicing under time pressure is the only way to avoid running out of minutes on exam day—especially given that case study questions cannot be reviewed once you submit that block.

Yes—the downloadable PDF packages the full question bank in a print-friendly format that you can use on flights, commutes, or anywhere without reliable internet. The PDF includes the same detailed answer explanations as the online version, with references to the specific Microsoft Learn documentation paths for AI Gateway policy enforcement in Azure API Management, Microsoft Security Copilot workspace RBAC, Entra Agent ID credential isolation, and Defender for AI content filtering rules. Many candidates use the PDF for a final review of managed identity assignment patterns and Private Endpoint DNS integration the morning of their exam sitting.

The credential expires exactly one year from the date it is issued. Microsoft opens a 6-month renewal eligibility window before expiration, during which you can pass a short, unproctored online assessment on Microsoft Learn at no cost—it covers only platform feature updates since your last exam (for example, the latest Microsoft Security Copilot plugin expansions and Defender CSPM attack path enhancements). Our PDF download includes a certification timeline checklist so you do not miss the renewal window.