SC-500 practice questions

Question 1. A Security Administrator's account needs SSPR configured. Which combination is correct for this account under Microsoft's guidance?

1. One method is sufficient, since administrators are trusted users
2. Two methods are required, and security questions may be used as one of them for convenience
3. Two methods are required, security questions cannot be used at all, and email reset is not recommended
4. Email-based reset alone is recommended, since it is the fastest option for a privileged user to regain access

Question 2. A developer wants to hardcode an API key directly into a declarative agent plugin's configuration so it's easy to find during debugging. What's the recommended approach instead, and why?

1. Hardcode it as requested, since declarative agent plugins run in a trusted environment
2. Store the key in the Microsoft 365 vault and reference it by vault entry ID, so it can be rotated without redeploying the plugin and is never exposed to the client
3. Email the key to the whole development team so anyone can update it manually when needed
4. Store the key in a public GitHub repository so it's easy to locate later

Question 3. A vault holds encryption keys for customer data and must have no internet exposure at all, reachable only from its VNet and an ExpressRoute circuit. Which network configuration meets this?

1. A firewall rule allowlisting the office's public IP range
2. A VNet service endpoint on the application's subnet
3. A private endpoint with public network access disabled
4. Leaving the vault on its default public endpoint and relying on RBAC alone

Question 4. Defender CSPM's agentless scanning flags a database connection string hardcoded in a Bicep template. After moving the secret into Key Vault and updating the template to reference it via managed identity, the finding still shows as open. What's missing?

1. Nothing; the finding auto-resolves within 24 hours regardless of further action
2. The plaintext credential must actually be removed from the template; leaving it alongside the new vault reference doesn't resolve the finding
3. Defender for Key Vault, not Defender CSPM, needs to be enabled to clear this specific finding
4. The secret needs to be re-scanned manually from the Key Vault portal blade

Question 5. You just toggled a new regulatory standard on for a subscription in Defender for Cloud's security policies. Roughly how long before the first assessment results populate the compliance dashboard?

1. Up to 12 hours
2. Up to 7 days
3. Up to 30 days
4. Instantly

Question 6. A tagging policy has run in Audit for three weeks. The team remediates everything it surfaced and completes the audit-first rollout by switching the effect to Deny. A week later the compliance dashboard still lists 40 noncompliant resources. What is the most likely explanation?

1. Switching to Deny resets compliance state, so these are stale entries that clear on the next evaluation
2. Deny is not supported for tag policies, so the assignment silently fell back to Audit
3. Those resources were created or last updated before the switch, and Deny only evaluates create and update requests, so it never fixes or removes what already exists
4. The assignment needs a managed identity before a Deny effect takes effect

Question 7. Which authentication method keeps working after Shared Key authorization is disabled on a storage account?

1. Account SAS signed with the storage account key
2. Service SAS signed with the storage account key
3. User delegation SAS signed with Microsoft Entra ID credentials
4. Direct use of a storage account access key

Question 8. A polymorphic malware sample is uploaded to blob storage, using a modified signature not present in any known malware hash database. Which Defender for Storage detection method is designed to still catch it?

1. Hash reputation analysis only
2. Sensitive data threat detection
3. Full content scanning using the Defender Antivirus engine
4. Trusted services bypass

Question 9. A Retail Banking user with UNMASK permission on the CreditCardNumber column queries the Transactions table, which also has a Row-Level Security FILTER predicate scoping rows to their own division. What do they see?

1. Only Retail Banking division rows, with the credit card number unmasked
2. Only Retail Banking division rows, with the credit card number still masked
3. Every division's rows, with the credit card number still masked
4. Every division's rows, with the credit card number unmasked

Question 10. An AI fraud-detection service begins querying customer tables at 3am with ten times its normal daily volume, using entirely valid, unrevoked credentials. Which Defender for SQL capability is responsible for surfacing this as worth investigating?

1. Vulnerability assessment baselining
2. Anomalous database access and query pattern detection, based on a learned behavioural baseline
3. Transparent Data Encryption alerts
4. The SQL Security Manager RBAC role

Question 11. An engineer needs to determine exactly why traffic from one specific IP address on a specific port to a database VM is being blocked, identifying the exact rule responsible. Which Network Watcher capability is designed for this specific question?

1. Effective security rules, since it lists every rule affecting the NIC
2. NSG flow logs, since they record historical traffic
3. IP flow verify, since it tests one specific flow and reports the allow/deny result plus the exact rule responsible
4. Connection Monitor, since it continuously tracks connectivity over time

Question 12. A company still needs to support a legacy application that depends on broad SMB file-share access across an entire subnet, which can't easily be segmented into individual application entries. What is the most appropriate access method for this specific scenario?

1. Per-app Microsoft Entra Private Access for each individual file
2. Quick Access in Microsoft Entra Private Access, or continued VPN use, since this scenario genuinely needs network-layer connectivity
3. Azure Private Link Service
4. Disabling remote access to the file share entirely

Question 13. An organisation wants to enable real-time runtime protection for its Copilot Studio agents. Which two teams need to coordinate, and where is protection ultimately enabled?

1. Security and Power Platform administrators, enabled through the Microsoft Defender portal's Security for AI settings
2. Only Microsoft support, since this cannot be self-configured
3. Only the Power Platform team, entirely within Copilot Studio itself
4. Only the network team, through Azure Firewall policy

Question 14. A team wants Azure AI services workloads to be actively monitored for threats and to appear in the Data and AI security dashboard. What is the correct first step?

1. Assign the SQL Security Manager RBAC role
2. Create a Conditional Access policy scoped to the workload's service principal
3. Configure a custom IPsec/IKE policy
4. Enable the Defender for AI Services plan on the relevant Azure subscription

Question 15. A rootkit attempts to load an unsigned, malicious bootloader during a VM's startup sequence. Which Trusted Launch component is specifically responsible for blocking this?

1. Secure Boot, since it validates boot components using digital signatures before allowing them to load
2. The vTPM's credential storage function
3. Microsoft Defender for Cloud integrity monitoring, since it runs before boot
4. Measured Boot

Question 16. Which Defender for Servers capability specifically analyses a server's disk contents for vulnerabilities, secrets, and malware without requiring an agent to be installed?

1. File integrity monitoring
2. Agent-based vulnerability assessment
3. Agentless scanning, which runs automatically roughly every 24 hours
4. Just-in-time VM access

Question 17. A team wants group membership changes in Microsoft Entra ID to automatically update who can perform actions inside an AKS namespace, without editing any cluster configuration when membership changes. What should they configure?

1. The Azure Kubernetes Service Cluster Admin role for every group member
2. A ClusterRoleBinding scoped to the whole cluster for convenience
3. A Kubernetes RoleBinding whose subject is the Microsoft Entra group's object ID
4. A static kubeconfig file distributed to each group member

Question 18. A security engineer sees an empty attack paths list for a subscription in Defender CSPM. What does this most directly indicate?

1. Agentless scanning is disabled
2. No confirmed externally exploitable attack paths were found
3. Defender CSPM is not enabled on the subscription
4. The cloud security graph has not been updated yet

Question 19. A security team wants to reduce ingestion costs from the Microsoft Entra ID connector because they don't use automated user provisioning. What should they do?

1. Move all Entra logs to the Basic plan and take no other action
2. Create a restore job that excludes provisioning events
3. Disable ingestion of the provisioning log category while keeping other Entra log categories enabled
4. Disconnect the Microsoft Entra connector entirely

Question 20. A managed security provider runs Security Copilot for several client teams from one tenant. Each team needs its own capacity budget, its own plugin configuration, and session data kept in its client's region. What should the provider set up?

1. One workspace with a promptbook per team
2. One workspace and a custom plugin per team
3. A separate Microsoft Entra tenant per team
4. A separate Security Copilot workspace per team, each with its own capacity and data storage location