SC-500 Practice Test

Sample SC-500 Practice Questions

10 real questions from the free SC-500bank. Pick an answer in your head, then open “Show answer” for the explanation.

1. 1. A compliance team requires that every permission an application could ever request appear in a single admin consent screen for one-time review and sign-off. The application's developers separately want end users to be prompted for new scopes only as new features are used, without waiting for another admin consent event each time. Which statement correctly describes how Microsoft Entra ID reconciles these two requirements?

   • A. Using the .default scope for the compliance review is incompatible with any later dynamic scope requests; the app must request each scope it will use through .default again at runtime
   • B. Dynamic, incremental scope requests are limited to applications that have not previously used the .default scope
   • C. Admin consent granted through .default applies mainly to application permissions, so delegated permissions still require a separate per-scope consent event even after admin consent
   • D. Granting admin consent with .default authorizes every permission declared in the app registration at once; the app can still request additional delegated scopes incrementally afterward, and each token includes all previously granted scopes
   Show answer

   Correct answer: D

   Static consent using the .default scope requests all permissions declared in the app registration in one review, and Microsoft Entra ID includes all previously granted scopes in each subsequent token, so the app can still request additional delegated scopes incrementally afterward. A wrongly claims the two approaches are mutually exclusive. B invents a restriction that does not exist. C wrongly limits .default to application permissions only, when it covers both delegated and application permissions declared in the registration.

2. 2. A vendor's multitenant SaaS application will be used by multiple customer organizations. In the vendor's home tenant, how many application objects exist for this single app, regardless of how many customer tenants install it?

   • A. Exactly one application object, with a separate service principal created in each tenant where it is used
   • B. One application object per customer tenant that installs the app
   • C. A single service principal created once in the home tenant, shared across customer tenants without additional service principal objects
   • D. Multitenant apps skip the application object and rely on service principal objects created per tenant to represent identity
   Show answer

   Correct answer: A

   A multitenant app has exactly one application object in its home tenant, which serves as the template for a distinct service principal created in every tenant where the app is consented for use. B wrongly multiplies the application object per customer. C and D both incorrectly claim no per-tenant service principal exists or that the application object itself never gets created.

3. 3. Security wants to require passkey (FIDO2) sign-in for a sensitive finance application, but only when the credential comes from one of the organization's approved hardware security key models, not from synced consumer passkeys or Authenticator-based passkeys. Which Conditional Access configuration achieves this without also affecting users of other approved MFA methods on less sensitive apps?

   • A. Enable the built-in phishing-resistant authentication strength as a tenant-wide Conditional Access policy covering the whole application catalog
   • B. Scope a Conditional Access policy to the finance application, requiring a custom authentication strength limited to the approved FIDO2 security key models or providers
   • C. Disable synced passkeys and Authenticator passkeys tenant-wide so hardware FIDO2 keys become the remaining passkey option everywhere
   • D. Require the built-in Multifactor authentication authentication strength for the finance application, assuming it already restricts users to hardware keys
   Show answer

   Correct answer: B

   A custom authentication strength can be built to allow passkey (FIDO2) sign-in for only a specific security key model or provider, and scoping that Conditional Access policy to the finance application avoids affecting other apps. A applies a phishing-resistant requirement broadly rather than to the one sensitive app, which goes beyond what was asked. C disables passkey options tenant-wide, breaking approved methods for less sensitive apps. D is wrong because the built-in Multifactor authentication authentication strength accepts many methods, not solely hardware FIDO2 keys.

4. 4. Your fleet includes both Microsoft Entra hybrid joined and Microsoft Entra joined Windows devices, all currently running Windows 10 version 1909, and you want to enable FIDO2 security key sign-in fleet-wide. Based on the documented minimum version requirements, what should you do before rolling out FIDO2 sign-in?

   • A. Proceed as-is; version 1909 already meets the documented minimum Windows 10 version for both device types
   • B. Assume hybrid-joined devices have no minimum version requirement and leave the fleet as it is
   • C. Upgrade the hybrid-joined devices to at least Windows 10 version 2004, because hybrid-joined devices require a higher minimum version than Microsoft Entra joined devices
   • D. Upgrade both device types to Windows 10 version 2004, treating that version as a general baseline for Windows FIDO2 sign-in
   Show answer

   Correct answer: C

   Microsoft Entra joined devices need at least Windows 10 version 1909, which the fleet already meets, while Microsoft Entra hybrid joined devices need at least Windows 10 version 2004, which the fleet does not meet at 1909. A wrongly assumes both device types share the same minimum. B wrongly claims hybrid-joined devices have no requirement, when they actually have a higher one. D unnecessarily upgrades the Microsoft Entra joined devices, which already comply.

5. 5. You want a helpdesk group's members to be eligible to activate membership in a second, role-assignable group that in turn carries an active Microsoft Entra role assignment, so helpdesk staff get just-in-time access without directly holding the privileged role. The helpdesk group itself is not role-assignable. Which statement correctly describes whether this design works in PIM for Groups?

   • A. It fails, because a non-role-assignable group cannot be an eligible member of a role-assignable group
   • B. It works, because a group can be an eligible member of another group even when one of the groups is role-assignable; only active membership of one role-assignable group inside another is disallowed
   • C. It works if the helpdesk group is converted to role-assignable and both groups are merged into one, but not in its current, unmodified form
   • D. It fails, because role-assignable groups are restricted to individual user members and do not support nested groups
   Show answer

   Correct answer: B

   A group can be an eligible member of another group even if one of those groups is role-assignable; the nesting restriction applies specifically to active membership of one role-assignable group inside another. A and D both overstate the restriction as applying to eligible membership as well. C invents an unnecessary merge requirement that the documented design does not need.