Microsoft Cloud and AI Security Engineer (SC-500) practice questions

Domain coverage 4 domains

• Manage identity, access, and governance (20–25%)
• Secure storage, databases, and networking (25–30%)
• Secure compute (20–25%)
• Manage and monitor security posture (20–25%)

Sample questions 10 of 100 shown

1. Q1 Manage Identity, Access, and Governance (20-25%)

   Which Microsoft Entra ID feature provides just-in-time, time-bound activation of privileged role assignments with approval workflows and access reviews?

   1. Conditional Access
   2. Privileged Identity Management (PIM)
   3. Entra ID Protection
   4. Managed identities

   Privileged Identity Management (PIM) allows you to make role assignments eligible rather than permanent, so users activate the role on-demand for a limited time window. PIM also supports approval workflows, MFA on activation, justification, and periodic access reviews, reducing standing privileged access.
2. Q2 Manage Identity, Access, and Governance (20-25%)

   A Conditional Access policy needs to require multi-factor authentication only when a user's sign-in is flagged as high risk. Which condition should the policy use?

   1. User risk
   2. Sign-in risk
   3. Device platform
   4. Named locations

   Sign-in risk represents the probability that a specific authentication request is not authorized, calculated in real time by Entra ID Protection. Targeting the sign-in risk condition allows the policy to require MFA only for that high-risk sign-in. User risk reflects the likelihood the account itself is compromised over time.
3. Q3 Manage Identity, Access, and Governance (20-25%)

   Which authentication method provides the strongest phishing-resistant passwordless sign-in for Microsoft Entra ID?

   1. SMS one-time passcode
   2. FIDO2 security keys
   3. Security questions
   4. Email one-time passcode

   FIDO2 security keys are phishing-resistant because the credential is bound to the legitimate domain and never leaves the hardware key, defeating replay and credential phishing attacks. SMS and email OTP are susceptible to interception and phishing, making them weaker methods.
4. Q4 Manage Identity, Access, and Governance (20-25%)

   You want an Azure virtual machine to read secrets from Azure Key Vault without storing any credentials in code. What should you configure?

   1. A service principal with a client secret stored in app settings
   2. A system-assigned managed identity granted Key Vault access
   3. A shared access signature token embedded in the VM image
   4. A user account with Key Vault Administrator role

   A system-assigned managed identity gives the VM an Azure-managed Entra identity that can authenticate to Key Vault without storing any credentials. You grant the identity access via a Key Vault access policy or Azure RBAC, eliminating credentials in code.
5. Q5 Manage Identity, Access, and Governance (20-25%)

   Which setting in Microsoft Entra ID restricts which applications users can consent to and allows administrator approval for risky permission requests?

   1. User consent settings and the admin consent workflow
   2. Cross-tenant access settings
   3. Authentication strength policies
   4. Token lifetime policies

   User consent settings control which OAuth permissions users can grant to applications, while the admin consent workflow lets users request admin approval for permissions they cannot self-consent to. Together they help mitigate consent grant attacks where an attacker tricks a user into granting permissions to a malicious app.
6. Q6 Manage Identity, Access, and Governance (20-25%)

   Which Key Vault configuration restricts vault access to specific virtual networks and trusted Azure services while blocking all other public traffic?

   1. Soft-delete and purge protection
   2. Key Vault firewall with network rules and the trusted services exception
   3. Role-based access control assignments
   4. Key rotation policies

   The Key Vault firewall allows you to deny public network access by default and selectively allow only chosen virtual networks, IP ranges, and trusted Microsoft services. This network-layer control complements data-plane authorization to ensure even authenticated requests must come from approved networks.
7. Q7 Manage Identity, Access, and Governance (20-25%)

   An administrator must enforce that all new storage account deployments require secure transfer (HTTPS). Which service provides a built-in policy definition to audit or deny non-compliant deployments?

   1. Azure Policy
   2. Azure Blueprints
   3. Microsoft Sentinel
   4. Azure Advisor

   Azure Policy provides built-in definitions that can audit or deny resource configurations that do not meet requirements, such as storage accounts not requiring secure transfer. Assigning these policies enforces governance at deployment time and continuously evaluates existing resources for compliance.
8. Q8 Manage Identity, Access, and Governance (20-25%)

   Your security team must continuously evaluate the Azure environment against the Microsoft cloud security benchmark and a PCI DSS regulatory standard, and see a compliance score per standard. Which tool provides this?

   1. Azure Policy compliance state on a single custom initiative
   2. The regulatory compliance dashboard in Microsoft Defender for Cloud
   3. Microsoft Sentinel workbooks built on the AzureActivity table
   4. Azure Resource Graph queries scheduled through a Logic App

   Defender for Cloud's regulatory compliance dashboard maps your environment against assigned security standards — the Microsoft cloud security benchmark, PCI DSS, ISO 27001, and others — and reports a per-standard compliance score with drill-down to failing controls. A single Azure Policy initiative does not give per-regulatory-standard scoring.
9. Q9 Manage Identity, Access, and Governance (20-25%)

   A privileged administrator only needs the User Access Administrator role for the four hours it takes to complete a quarterly access review. Security policy forbids standing privileged access. Which Microsoft Entra capability should you configure?

   1. A conditional access policy that blocks the role outside business hours
   2. Privileged Identity Management (PIM) with an eligible assignment and time-bound activation
   3. An access review that removes the role after 30 days
   4. A custom Entra role scoped to the access-review blade only

   Privileged Identity Management with an eligible (not active) assignment is the supported pattern for just-in-time privileged access: the administrator activates the role for a bounded window, optionally with approval and MFA, and it expires automatically. Conditional access governs sign-in conditions, not role activation lifetime.
10. Q10 Manage Identity, Access, and Governance (20-25%)

    An Azure Function needs to read secrets from Azure Key Vault without any credentials stored in code or app settings. What is the correct configuration?

    1. Store the Key Vault access key in an encrypted app setting
    2. Use a Key Vault access policy with a service principal and a client secret rotated every 90 days
    3. Enable a system-assigned managed identity on the Function and grant it Key Vault access via RBAC or an access policy
    4. Embed an Entra ID app registration certificate in the deployment package

    A system-assigned managed identity gives the Function an Entra identity with no credentials to store or rotate — Azure handles the lifecycle — and you grant that identity Get/List on secrets through RBAC or a Key Vault access policy. Encrypted app settings and rotated client secrets both still store a credential.

Answer all 100 questions with instant feedback →

Reader reviews 117 ratings

• These Microsoft exam dumps for SC-500 saved me weeks of study time. The questions cover every domain thoroughly.

  ★★★★★ Jessica W.

• My boss asked me to get the SC-500 cert for work. This was the best study tool I found. Passed in three weeks.

  ★★★★★★ Austin P.

• Detailed, organized, and accurate. Exactly what you want in SC-500 prep material. The explanations deserve special mention.

  ★★★★★★ Gabriel L.

• Passed the SC-500 exam today! The scenario-based questions here were extremely similar to what I saw on the test.

  ★★★★★ Riley B.

• Comprehensive coverage for SC-500. Every domain is represented and the question difficulty ramps up nicely.

  ★★★★★★ Emma J.

• The SC-500 certification opened up a promotion for me at work. These practice questions were a big part of that success.

  ★★★★★★ Ryan J.

Frequently asked questions

Free study resources

Community-verified analysis of 41 questions from real test-taker discussions — 8 deep analyses and 0 FAQs.

More Microsoft exams