logo

Microsoft SC-500 Exam Questions & Verified Answers

Prepare for Cloud and AI Security Engineer Associate with expert-reviewed SC-500 questions and answers. Try free samples, strengthen your understanding and rehearse your timing in the simulator.

242
Practice questions
Previews from the SC-500 free simulator sample

Try Free SC-500 Practice Questions

Explore the questions below, browse the question library or try a free five-question simulator sample to find the study format that works for you.

View 121 free questions
Question 1
Note: This section contains one or more sets of questions with the same scenario and problem . Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem. After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen. You have an Azure subscription that contains two virtual machines named VM1 and VM2 and a storage account named storage1. An application runs on VM1 and VM2. The application is being migrated from storage account key authentication to Microsoft Entra authentication. You review the current configuration and identify the following: VM1 and VM2 each have a system-assigned managed identity. Each application instance requests tokens by using only the local system-assigned managed identity. Network access to storage1 from VM1 and VM2 is allowed. No Azure RBAC data roles are assigned to the managed identities on storage1. You need to enable the application on VM1 and VM2 to read and write blob data in storage1 by using Microsoft Entra authentication without changing how the application requests tokens. Solution: You add the system-assigned managed identities of VM1 and VM2 to a Microsoft Entra security group, and assign the group the Storage Blob Data Contributor role scoped to storage1. Does this meet the goal?
Question 2
Note: This section contains one or more sets of questions with the same scenario and problem . Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem. After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen. You have an Azure subscription that contains two virtual machines named VM1 and VM2 and a storage account named storage1. An application runs on VM1 and VM2. The application is being migrated from storage account key authentication to Microsoft Entra authentication. You review the current configuration and identify the following: VM1 and VM2 each have a system-assigned managed identity. Each application instance requests tokens by using only the local system-assigned managed identity. Network access to storage1 from VM1 and VM2 is allowed. No Azure RBAC data roles are assigned to the managed identities on storage1. You need to enable the application on VM1 and VM2 to read and write blob data in storage1 by using Microsoft Entra authentication without changing how the application requests tokens. Solution: You create a private endpoint for the blob service of storage1. Does this meet the goal?
Question 3
Note: This section contains one or more sets of questions with the same scenario and problem . Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem. After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen. You have an Azure subscription that contains two virtual machines named VM1 and VM2 and a storage account named storage1. An application runs on VM1 and VM2. The application is being migrated from storage account key authentication to Microsoft Entra authentication. You review the current configuration and identify the following: VM1 and VM2 each have a system-assigned managed identity. Each application instance requests tokens by using only the local system-assigned managed identity. Network access to storage1 from VM1 and VM2 is allowed. No Azure RBAC data roles are assigned to the managed identities on storage1. You need to enable the application on VM1 and VM2 to read and write blob data in storage1 by using Microsoft Entra authentication without changing how the application requests tokens. Solution: You assign the system-assigned managed identities of VM1 and VM2 the Storage Account Contributor role scoped to storage1. Does this meet the goal?
Question 4
You have an Azure subscription that contains the virtual machines shown in the following table. Name Connected to VM1 VNet1/Subnet1 VM2 VNet1/Subnet2 Subnet1 and Subnet2 have an associated network security group (NSG). The NSG has an outbound rule that has the following configurations: Port: Any Source: Any Priority: 100 Action: Deny Protocol: Any Destination: Storage The subscription contains a storage account named storage1. You create a private endpoint named Private1 that has the following settings: Resource type: Microsoft.Storage/storageAccounts Resource: storage1 Target sub-resource: blob Virtual network: VNet1 Subnet: Subnet1 For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point .
Question 5
You have an Azure subscription that is linked to a Microsoft Entra tenant and contains the virtual machines shown in the following table. Name Connected to Private IP address Public IP address VM1 VNET1/Subnet1 10.1.1.5 20.224.219.170 VM2 VNET1/Subnet2 10.1.2.5 20.224.219.230 VM3 VNET2/Subnet1 10.11.1.5 40.122.155.212 The subnets of the virtual networks have the service endpoints shown in the following table. Subnet Service endpoint VNET1/Subnet1 Microsoft.Storage VNET1/Subnet2 Microsoft.KeyVault VNET2/Subnet1 Microsoft.Storage, Microsoft.KeyVault You create the resources shown in the following table. Name Type storage1 Azure Storage account Vault1 Azure Key Vault For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point .
Question 6
You have a Microsoft 365 tenant that uses Microsoft Security Copilot and Microsoft Defender XDR. Access to Microsoft Defender XDR is managed by using Microsoft Entra global roles. The Phishing Triage Agent is available in Microsoft Defender. The required agent prerequisites and approvals are complete. Two users will perform the following tasks: User1 will enable and manage the Phishing Triage Agent settings. User2 will use Security Copilot in Microsoft Defender XDR to manage phishing incidents identified by the agent. You need to assign the least-privileged built-in Microsoft Entra role and Security Copilot role combination to each user. Which roles should you assign to each user? To answer, select the appropriate options in the answer area.

Download SC-500 Sample Questions

Download up to 10 single-answer or multiple-answer questions with recorded answers from the latest five captured sessions. The sample uses questions from the free half first, then the paid half if needed.

Study Tools for Your SC-500 Preparation

Start with a sample, then choose the study tools that fit your revision. Paid access covers this exam for the duration of your selected plan.

Check Your Knowledge with Verified Answers

Work through questions checked by expert trainers before publication. Review your answers to identify what you understand and where to spend more time.

Practise Exam Timing in the Simulator

Use learning, practice or timed exam mode to build familiarity and work on pacing. Vendor-style layouts and supported interactions vary by exam.

Choose How You Read and Review

With paid access, display 6, 10, 25, 50 or 100 questions per page, choose a question range, focus on hot questions and show answers while reading.

Discuss Individual Questions

Ask about a question, compare perspectives and contribute an answer vote. Use the discussion to explore reasoning alongside the expert-reviewed answer.

Download Questions for Offline Revision

Try a PDF sample of up to 10 questions. Paid reading access also offers PDF export for supported single- and multiple-choice questions, answers and images. Interactive formats stay on the website.

Keep Track of Your Exam Access

Unlock the full question bank and simulation features without CAPTCHA checks. Find purchased exams, direct study links and expiry dates in your profile.

Cloud and AI Security Engineer Associate

SC-500 Exam Topics and Study Plan

Skills Covered by the Exam

Use these topics from the linked official guide to plan your preparation for SC-500. Check the current guide before booking, because objectives can change.

  • Manage identity, access, and governance20–25%
  • Secure storage, databases, and networking25–30%
  • Secure compute20–25%
  • Manage and monitor security posture20–25%

Official exam weights describe the vendor’s blueprint. They do not measure coverage in this question bank.

Recommended Experience Before You Start

Before preparing for SC-500, check Microsoft's current eligibility and experience guidance. Compare the published objectives with work you have completed and plan hands-on practice for gaps.

Plan Your Revision

Suggested preparation sequence; adjust the pace to your experience.

  1. 1

    Check the current objectives

    Make a checklist from the official SC-500 objectives and mark the skills you can already demonstrate.

  2. 2

    Build understanding

    Study one objective at a time. Use official documentation and practical exercises to work on gaps.

  3. 3

    Practise and review

    Use the SC-500 question library to check your understanding. Review why each answer is correct before moving on.

  4. 4

    Rehearse and revisit

    With paid access, run a timed simulation. Revisit weaker topics and repeat practical exercises before booking your exam.

Official Microsoft Study Resources

This date refers to the exam guide, not the review date of every question.

SC-500 Practice and Access FAQs

Understand review, study tools and access before choosing your next step.

Who verifies the questions and answers?

Subject matter expert trainers in each niche review every question and answer before it enters the ExamPrepare database. Answer votes and discussions add perspectives after publication; they do not replace this review. Learn more on our methodology page.

How closely does the simulator match an exam?

The simulator uses vendor-style layouts and supported question interactions to help you practise navigation and pacing. Choose learning, practice or timed exam mode. Formats vary by exam; try the five-question sample to see the experience available for your certification.

What are hot questions?

Hot questions help you prioritise questions with stronger reporting or answer-vote activity. In the reading library, the filter selects questions with at least three recorded sightings or at least three votes for an answer. It has no recency cutoff and does not predict your exam questions. Use it alongside weaker topics and the exam objectives.

Can I read questions without starting a simulation?

Yes. Paid reading access lets you display 6, 10, 25, 50 or 100 questions per page, select a question range, filter for hot questions and show answers while reading. Choose the simulator whenever you want a learning, practice or timed exam session.

Can I download questions and answers as a PDF?

Each exam overview offers a free PDF sample of up to 10 supported questions. With paid reading access, you can also export supported single- and multiple-choice questions with their answers and images. Interactive question formats need the website and are not included as interactive PDF exercises.

How do votes and discussions relate to verified answers?

SME trainers review the questions and answers before publication. Imported answer reports show aggregate responses, while on-site votes and comments reflect participation on ExamPrepare. Use discussion to compare reasoning and investigate disagreements; a majority vote alone does not prove an answer correct.

What does a purchase unlock?

A purchase unlocks the complete question bank for the selected exam, access without CAPTCHA checks, reading controls, supported PDF exports and full learning, practice and timed simulation features. It covers that exam for the duration of the plan you choose, rather than every certification in the catalogue.

Where can I find my purchased exams and expiry dates?

Sign in to the account used for your purchase and open your profile. Your purchased exam library shows study links and access expiry dates so you can return to an exam and check how much access time remains.

View all feature FAQs
bg

Find Your Next Certification Practice Exam

Choose your certification to explore verified answers, free question samples and exam simulations.