Free SC-500 Practice Questions

A finance analyst occasionally needs Owner access on a resource group to run a monthly reconciliation task, but currently holds a permanent, standing Owner assignment used only a few hours a month.

What should you configure to reduce this standing risk?

1. A.Make the assignment eligible in Privileged Identity Management, requiring activation with justification and a time limit
2. B.Downgrade the assignment to Contributor, which is broad enough for most tasks
3. C.Leave the assignment as-is but enable Azure AD sign-in logging
4. D.Create a scheduled Logic App that removes and re-adds the role monthly

Security wants to automatically require MFA — not block outright — whenever a sign-in is flagged as medium risk by Entra ID Protection, while low-risk sign-ins proceed normally.

What should you configure?

1. A.A conditional access policy with a sign-in risk condition set to medium-and-above, requiring MFA as the grant control
2. B.A conditional access policy that blocks all sign-ins outside the corporate network
3. C.An Azure Policy definition auditing sign-in risk scores
4. D.A Key Vault access policy restricting secret retrieval to compliant devices

An Azure Function needs to retrieve a secret from Key Vault at runtime. The security team wants no credential to store, rotate, or risk leaking in application settings.

What should you implement?

1. A.A system-assigned managed identity on the Function, granted Key Vault Get permission
2. B.A service principal with a client secret stored in Function app settings
3. C.A shared access signature token embedded in the Function code
4. D.The Key Vault's own master key, retrieved once and cached indefinitely

A Key Vault must be reachable only from a specific virtual network and from trusted Azure services (like Azure Backup), with all other public internet access denied.

What should you configure?

1. A.Key Vault firewall rules scoped to the VNet, with "Allow trusted Microsoft services" enabled
2. B.An RBAC role assignment restricting Get permission to the backup service
3. C.A conditional access policy blocking public IP ranges
4. D.A Defender for Key Vault alert rule for public access attempts

An access review reveals a contractor's account holds Owner on a production subscription but has only ever used it to read resource configurations and never modified anything.

What is the correct remediation?

1. A.Reassign the account to a built-in Reader role, or a custom role scoped to only the read actions actually used
2. B.Leave the assignment unchanged since no misuse has occurred yet
3. C.Disable the account entirely, even though the contractor still needs read access
4. D.Move the account to a separate Entra tenant to isolate the risk

A storage account already restricts network access to a specific VNet via firewall rules, but the security team also wants to be alerted if a malicious file is uploaded to a container inside it.

What should you additionally enable?

1. A.Defender for Storage threat protection on the storage account
2. B.A stricter storage firewall rule with a smaller IP range
3. C.A resource lock preventing deletion of the storage account
4. D.An Azure Policy audit rule checking firewall configuration

A compliance requirement mandates that every query executed against an Azure SQL Database be logged for later review, and that anomalous query patterns (e.g., a potential SQL injection attempt) trigger a security alert.

What combination satisfies both requirements?

1. A.Enable Azure SQL Database auditing for the query log, and Defender for Databases for anomaly-based threat alerts
2. B.Enable Defender for Databases alone, since it also stores a full query log
3. C.Enable auditing alone, and manually review logs weekly for anomalies
4. D.Configure a firewall rule restricting the database to the application's subnet only

A three-tier application has web, application, and database VMs whose IP addresses change as the environment autoscales. You need firewall rules that reference the VM's role rather than its current IP address.

What should you implement?

1. A.Application security groups (ASGs) grouping VMs by role, referenced inside NSG rules instead of individual IPs
2. B.A separate NSG per individual VM, updated manually as IPs change
3. C.A single NSG rule allowing all traffic between the three subnets
4. D.Azure Firewall rules referencing each VM's current IP, refreshed nightly

An application inside a virtual network must connect to an Azure SQL Database entirely over the Microsoft backbone, with no traffic ever traversing the public internet, and the database should not be reachable from outside that VNet at all.

What should you configure?

1. A.A private endpoint for the Azure SQL Database, connected into the application's virtual network
2. B.A service endpoint on the SQL server's public firewall rules
3. C.A Private Link service exposing the application to other tenants
4. D.Microsoft Entra Private Access configured for the application's users

Remote employees need access to an internal, on-premises line-of-business application without a traditional site-to-site VPN client, and access should be governed by conditional access policies per application.

What should you implement?

1. A.Microsoft Entra Private Access, publishing the application and enforcing conditional access per app
2. B.A private endpoint connecting the on-premises app into an Azure VNet
3. C.Azure Virtual Network Manager network access policies
4. D.A Private Link service exposing the on-prem app to other Azure tenants

A VM's NSG has an explicit "Allow" rule for port 443 from a specific subnet, but the application team reports the traffic is still being blocked. Both the subnet NSG and the NIC NSG could be involved.

What should you use to determine the actual effective rule being applied?

1. A.Network Watcher's effective security rules diagnostic on the VM's network interface
2. B.A packet capture on the destination VM only
3. C.The Azure Activity Log for the NSG resource
4. D.Azure Policy compliance state for the NSG

An organization deployed a Microsoft Foundry agent with a Microsoft Entra Agent ID identity that accesses sensitive financial data. Only the finance security group should be able to invoke it — all other employees must be denied, without disabling any other application access.

What should you configure?

1. A.A conditional access policy scoped to the Entra Agent ID, granting access only to the finance security group
2. B.A Microsoft Purview DLP policy blocking financial data from leaving the tenant
3. C.An Azure Policy assignment restricting the agent's resource group
4. D.A Defender for Cloud workload protection plan for the agent's hosting resource

Before broadly enabling Microsoft Copilot, security wants to identify SharePoint sites and documents that are more broadly shared than necessary and could be surfaced by Copilot to users who should not see them.

What should you use?

1. A.Microsoft Purview Data Security Posture Management (DSPM) for AI
2. B.Defender for Cloud regulatory compliance dashboard
3. C.Microsoft Entra ID access reviews on SharePoint site owners
4. D.Azure Policy audit rules for SharePoint Online

Administrators currently RDP into VMs using a permanently open port 3389, with a public IP assigned to each VM. Security wants to eliminate the public IP exposure entirely, not just shorten how long the port stays open.

What should you implement?

1. A.Azure Bastion, removing the need for a public IP or open RDP/SSH port on the VMs at all
2. B.Just-in-time VM access, which still requires a public IP but limits the exposure window
3. C.A stricter NSG rule allowing RDP only from the office IP range
4. D.Azure Firewall DNAT rules forwarding RDP from a single public IP

A team deploys new workloads to AKS frequently and wants automatic detection of insecure configurations (like privileged containers or missing resource limits) and known vulnerabilities in container images, without manually reviewing every manifest.

What should you enable?

1. A.Defender for Containers on the AKS cluster
2. B.Azure Policy audit mode only, with no enforcement
3. C.Network Watcher flow logs on the AKS subnet
4. D.Defender for Storage on the container registry's backing storage account

An Azure Function exposes a back-end API that should only be callable through a gateway enforcing subscription-key authentication and per-client rate limiting, without modifying the Function's own code.

What should you configure?

1. A.Azure API Management in front of the Function, with subscription-key and rate-limit policies applied at the gateway
2. B.A conditional access policy on the Function App's Entra ID application registration
3. C.A Web Application Firewall policy on Azure Front Door
4. D.Azure Firewall network rules restricting inbound traffic to the Function's IP

A security team believes some subdomains and cloud resources were created outside standard provisioning processes over the years and are not tracked in the organization's current asset inventory.

What should you use to discover them?

1. A.Microsoft Defender External Attack Surface Management (EASM)
2. B.Defender Cloud Security Posture Management (CSPM)
3. C.Microsoft Defender Vulnerability Management
4. D.Azure Resource Graph queries against the current subscription

Whenever Microsoft Sentinel creates a high-severity incident involving a specific alert type, the team wants an existing Logic App that disables the affected user account to run automatically, without an analyst manually triggering it.

What should you configure?

1. A.An automation rule that triggers on the matching incident conditions and runs the existing playbook
2. B.The playbook alone, scheduled to run every five minutes regardless of incidents
3. C.A Sentinel workbook displaying the incident for manual action
4. D.A custom log table capturing the incident for later batch review

An organization runs workloads in both Azure and AWS and wants unified security posture visibility and recommendations across both clouds from a single Defender for Cloud view.

What should you configure?

1. A.Connect the AWS account to Defender for Cloud using its multicloud connector
2. B.Deploy Defender for Servers only inside Azure and manually cross-reference AWS Security Hub separately
3. C.Enable Defender CSPM in Azure only, since AWS resources cannot be evaluated by Defender for Cloud
4. D.Migrate the AWS workloads into Azure to consolidate visibility

A SOC wants analysts to use Microsoft Security Copilot to investigate incidents, pulling in context from an additional third-party threat intelligence source beyond what Copilot integrates by default.

What should you configure?

1. A.A Security Copilot workspace with the relevant plugin enabled for that data source
2. B.A Sentinel data connector only, with no Security Copilot configuration
3. C.A Defender for Cloud workload protection plan referencing the third-party source
4. D.An Azure Policy initiative requiring analysts to check the third-party source manually