SC-500: Implementing End-to-End Security Controls for Cloud and AI Workloads

By Microsoft · Browse Mode
About the Exam

This exam is for security engineers who protect Azure, Microsoft 365, hybrid, and AI-enabled environments. It covers identity, access, governance, storage, databases, networking, compute, and security posture management, including Microsoft Defender for Cloud and Microsoft Sentinel. Passing demonstrates that you can implement and manage end-to-end security controls across cloud and AI workloads.

Exam Topics

  • Manage identity, access, and governance20–25%
  • Secure storage, databases, and networking25–30%
  • Secure compute20–25%
  • Manage and monitor security posture20–25%

How to Use This Practice Exam

  1. Browse — Read each question, select your answer, and reveal the explanation.
  2. Exam Mode — Simulate real exam conditions with a timed session and score report.
  3. Learn Mode — Spaced repetition schedules questions you struggle with for long-term retention.

Download the Full Exam PDF

Get every question and answer in a clean, printable PDF built for offline study. Purchase once, keep permanent access, and re-download the latest version anytime.

Get PDF
Learn More

Last updated August 3, 2026 at 10:09 AM

Topic filter
Retired questions
Question sort
Questions per page

QuestionQ1

Secure storage, databases, and networking

You have an Azure virtual network containing 100 virtual machines and an Azure Firewall instance named FW1. All traffic from the virtual machines is routed through FW1.

You need to ensure that FW1 permits access only to the URL updates.contoso.com and blocks all other outbound traffic.

What should you use?

Explanation

Azure Firewall application rules filter outbound HTTP/S traffic at Layer 7 by fully qualified domain name (FQDN), URL, or web category. An allow rule for updates.contoso.com, with no broader allow rules, permits that destination while unmatched outbound traffic remains blocked. NAT rules perform address translation, and network rules are intended for Layer 3/4 address, port, and protocol filtering.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!

QuestionQ2

Manage identity, access, and governance

You have a Microsoft Entra tenant with the following configurations:

  • User consent for applications is disabled.
  • Only administrators can grant permissions to applications.

You register an application named App1 that uses delegated Microsoft Graph permissions.

You need to configure App1 to meet the following requirements:

  • Enable user sign-ins without interactive consent prompts.
  • Enable App1 to access Microsoft Graph on behalf of the signed-in user.

What should you do?

Explanation

Delegated permissions allow an application to access Microsoft Graph on behalf of the signed-in user. When user consent is disabled, an administrator must grant consent; granting tenant-wide admin consent to the required delegated permissions lets users sign in without being prompted to consent.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!

QuestionQ3

Secure compute

You have an Azure subscription named Sub1 that contains an Azure Kubernetes Service (AKS) cluster named cluster1 and an Azure container registry named ACR1. Microsoft Defender for Containers is enabled for Sub1, and runtime protection is active on cluster1.

Your company’s developers deploy pods with elevated privileges, and those deployments are created in cluster1.

You need to prevent pods with elevated privileges from being accepted by cluster1.

What should you do?

Explanation

Azure Policy for Kubernetes can enforce admission controls in AKS. Its built-in policy, Kubernetes cluster should not allow privileged containers, prevents creation of privileged containers, whereas Defender runtime protection detects activity after deployment and image vulnerability assessment evaluates image vulnerabilities.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!

QuestionQ4

Manage identity, access, and governance

You have two management groups, MG1 and MG2, which contain multiple Azure subscriptions. The subscriptions are associated with a Microsoft Entra tenant.

You have a user named User1 and a global administrator named Admin1.

You learn that User1 created an Azure subscription named Sub1 under the MG2 management group and is its only owner.

You need to ensure that Admin1 can remove User1's Owner role on Sub1.

What should you do first?

Explanation

A Microsoft Entra Global Administrator does not automatically have Azure RBAC access to every subscription. Enabling Access management for Azure resources elevates the signed-in Global Administrator by assigning the Azure User Access Administrator role at the root scope. That role permits management of role assignments across subscriptions and management groups in the tenant, including removal of User1’s Owner assignment on Sub1.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!

QuestionQ5

Manage and monitor security posture

HOTSPOT -

Overview -

Contoso, Ltd. is a consulting company with a main office in San Francisco and a branch office in Dallas. Contoso has a hybrid environment that includes on-premises servers connected to Azure, a Microsoft 365 E5 subscription, and an Azure subscription named Sub1.

Existing Environment. Microsoft Entra tenant

Contoso has a Microsoft Entra tenant named contoso.com that contains the users shown in the following table.

Question Image

Existing Environment. On-premises environment

The on-premises network contains an Active Directory Domain Services (AD DS) forest that syncs with contoso.com. The forest includes a server named Server1 that runs Windows Server.

Existing Environment. Azure subscription

Sub1 contains the storage accounts shown in the following table.

Question Image

Sub1 contains the virtual networks shown in the following table.

Question Image

Sub1 contains the virtual machines shown in the following table.

Question Image

The network interface of VM1 is associated with an application security group named ASG1.

Sub1 contains the resources shown in the following table.

Question Image

Vault1 stores the objects shown in the following table.

Question Image

Existing Environment. Privileged Identity Management (PIM) configuration

You manage privileged roles by using Privileged Identity Management (PIM). The PIM role settings are configured as shown in the following table.

Question Image

Existing Environment. Microsoft Sentinel configuration

Contoso has a Microsoft Sentinel workspace that contains the following tables.

Question Image

Requirements. Planned changes -

Contoso plans to implement the following changes:

  • Integrate AKS1 with Vault1.
  • Enable Microsoft Entra Kerberos authentication for all supported storage.
  • Configure auditing for sql1 by using the Azure portal and store audit logs in a centralized location.

Requirements. Technical requirements

Contoso identifies the following technical requirements:

  • Protect Server1 by using file integrity monitoring.
  • Protect AKS1 by using Microsoft Defender for Cloud.
  • Configure Microsoft Sentinel to retain data for the maximum supported duration without changing the tier.
  • Store objects used for authentication and encryption in Vault1 and ensure that Vault1 regenerates the objects every 30 days, whenever possible.

You need to configure Server1 to meet the technical requirements. What should you do?

Select
Install on Server1:
Deploy to Sub1:
Explanation

File Integrity Monitoring in Microsoft Defender for Cloud’s Defender for Servers Plan 2 uses the Microsoft Defender for Endpoint agent to collect changes to files and Windows registry entries. The resulting change-event data is stored in a selected Log Analytics workspace for access and analysis.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!
Know a question that should be here? Contribute to this exam
Back home