SC-500: Cloud and AI Security Engineer Associate Practice Exam

What the SC-500 exam covers

• Manage Identity, Access, and Governance210 questions
• Secure Storage, Databases, and Networking253 questions
• Secure Compute222 questions
• Manage and Monitor Security Posture225 questions

Free SC-500 sample questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 910.

1. Question 1Secure Compute

   A company is preparing to roll out Microsoft 365 Copilot and wants to identify SharePoint sites where permissions have drifted so broadly that most employees can access files that were never intended for wide distribution. Which capability should the security team use first?

   • ARun a Purview DSPM for AI oversharing assessment on the tenant's SharePoint sitesCorrect
   • BReview the Defender for Cloud secure score for the hosting subscription
   • CCheck Entra Conditional Access sign-in logs for affected users
   • DReview the Azure Policy compliance dashboard for the subscription
   ✓ Correct answer: A

   Microsoft Purview Data Security Posture Management (DSPM) for AI includes an oversharing assessment that specifically surfaces SharePoint sites where broad groups such as 'Everyone except external users' have unusually wide access, the exact risk that a Copilot rollout can amplify. It maps permission scope directly to what AI apps could later surface.

   Why the other options are wrong

   • BSecure score reflects Azure resource security posture, not SharePoint document permission scope.
   • CSign-in logs show authentication events, not what files a user is permitted to access.
   • DAzure Policy compliance targets Azure resource configuration, not SharePoint sharing settings.
2. Question 2Secure Compute

   A security engineer must ensure that both the OS and data disks of an Azure Windows VM are encrypted with keys managed outside the VM, using the same technology as on-premises BitLocker. Which capability should the engineer enable?

   • AAzure Disk Encryption integrated with Azure Key VaultCorrect
   • BStorage service encryption with Microsoft-managed keys
   • CAzure Backup soft delete for the VM
   • DTransparent Data Encryption on the managed disk
   ✓ Correct answer: A

   ADE encrypts OS and data disks in-guest using BitLocker (Windows) or DM-Crypt (Linux), and the keys/secrets live in Key Vault rather than on the VM. This satisfies the requirement for key management outside the VM.

   Why the other options are wrong

   • BStorage service encryption protects data at the storage platform layer with Microsoft-managed keys by default; it is not the in-guest BitLocker mechanism requested.
   • CBackup soft delete protects backup data from accidental deletion, it does not encrypt the running VM's disks.
   • DTransparent Data Encryption encrypts database files inside Azure SQL, not general-purpose VM disks.
3. Question 3Manage Identity, Access, and Governance

   A retail company assigns a built-in Azure Policy definition at the subscription scope that requires all new storage accounts to use only HTTPS for data transfer. When a developer tries to create a storage account with 'Secure transfer required' disabled, the deployment fails immediately with a policy violation message. Which policy effect is configured on this definition?

   • AdenyCorrect
   • Baudit
   • Cappend
   • DauditIfNotExists
   ✓ Correct answer: A

   The deny effect evaluates a resource before it is created or updated and, if the request does not match the policy rule's conditions, stops the request with an error before it reaches the resource provider. This is why the deployment fails immediately rather than succeeding and later showing up as non-compliant. Deny is the correct choice whenever a scenario describes a create/update request being actively blocked at deployment time.

   Why the other options are wrong

   • Baudit only marks the resource as non-compliant in the portal after creation; it never blocks the deployment.
   • Cappend adds specified fields or values to the request rather than blocking it, so the deployment would still succeed.
   • DauditIfNotExists evaluates related resources and only flags non-compliance; it cannot stop a deployment.
4. Question 4Manage Identity, Access, and Governance

   A company wants a set of Azure resource roles bundled so that engineers activate one PIM-eligible group membership instead of activating each role individually every time. Which feature should be used?

   • APrivileged Identity Management for GroupsCorrect
   • BEntra ID dynamic security groups
   • CAzure Policy initiative assignment
   • DConditional Access named locations
   ✓ Correct answer: A

   When a group is enabled for PIM, membership in it can be configured as eligible rather than permanent. Because Azure RBAC or Entra roles can be assigned to the group, activating the single group membership grants all bundled roles at once.

   Why the other options are wrong

   • BDynamic groups auto-populate membership by rule but are not time-bound or activatable through PIM.
   • CInitiatives bundle Azure Policy definitions for compliance, not role activations for users.
   • DNamed locations define network conditions used by Conditional Access, unrelated to bundling role activations.
5. Question 5Secure Storage, Databases, and Networking

   A team wants to allow their web-tier VMs to reach Azure SQL Database over its public endpoint without allowing broad internet access, and without maintaining a list of Azure SQL IP ranges that can change. Which NSG configuration achieves this?

   • AAn outbound rule permitting the Sql service tag on port 1433Correct
   • BAn outbound rule permitting the Internet service tag on port 1433
   • CAn inbound rule permitting the Storage service tag on port 1433
   • DAn application security group containing the Azure SQL logical server
   ✓ Correct answer: A

   Using the Sql service tag as the destination in an outbound NSG rule restricts egress to Microsoft's published Azure SQL address ranges (optionally per region), giving least-privilege access to the database service tier while automatically tracking Microsoft's IP range updates.

   Why the other options are wrong

   • BThe Internet tag would allow traffic to any public destination, far broader than the intended SQL-only access.
   • CThe Storage tag scopes traffic to Azure Storage, not Azure SQL Database, and this rule direction is also inbound rather than outbound.
   • DApplication security groups group Azure VM NICs, not external PaaS services like a SQL logical server.
6. Question 6Secure Storage, Databases, and NetworkingSelect all that apply

   Which two statements correctly describe Azure Firewall rule collection types? (Choose TWO)

   • ANetwork rule collections filter based on source/destination IP or service tag, port, and protocol (L3/L4)Correct
   • BApplication rule collections can filter outbound HTTP/HTTPS traffic based on FQDNCorrect
   • CNAT rule collections are used exclusively to filter outbound internet traffic by domain name
   • DApplication rule collections are evaluated without any priority; they always run last
   • ENetwork rule collections can perform HTTP header inspection for SQL injection attempts
   ✓ Correct answer: A, B

   Azure Firewall's three rule collection types serve distinct purposes: network rule collections match L3/L4 attributes (IP/tag, port, protocol); application rule collections match FQDNs for HTTP, HTTPS, and MSSQL traffic; and NAT (DNAT) rule collections handle inbound destination translation, not outbound FQDN filtering.

   Why the other options are wrong

   • CNAT rule collections perform inbound destination network address translation; they are not used for outbound FQDN-based filtering, which is the role of application rules.
   • DAll rule collections, including application rule collections, are evaluated according to assigned priority values, not in a fixed 'always last' order.
   • EHTTP payload inspection for attacks like SQL injection is the specialized role of a Web Application Firewall, not Azure Firewall network rule collections.
7. Question 7Manage and Monitor Security Posture

   A SOC wants a recurring, largely automated workflow in Security Copilot that triages incoming phishing-reported emails and recommends a disposition without an analyst manually prompting it each time. What should they configure?

   • AA Security Copilot agent built for phishing triageCorrect
   • BA one-time manual prompt re-typed for every email
   • CA Defender for Cloud governance rule
   • DAn Azure Policy initiative
   ✓ Correct answer: A

   Security Copilot agents are purpose-built, largely autonomous workflows that run on a trigger or schedule to perform a recurring task, such as triaging phishing submissions, reducing the need for an analyst to manually re-prompt for each occurrence.

   Why the other options are wrong

   • BManually re-typing a prompt for every email is the repetitive, non-automated approach an agent is meant to replace.
   • CGovernance rules manage Defender for Cloud recommendation ownership, unrelated to Copilot workflow automation.
   • DAzure Policy initiatives enforce resource configuration compliance, not Copilot task automation.
8. Question 8Manage and Monitor Security Posture

   Compliance requires 2 years of interactive query access to sign-in logs, not just archived access, but the workspace default retention is 90 days. What should be configured?

   • AIncrease interactive retention up to the supported maximumCorrect
   • BEnable Basic Logs, which supports unlimited interactive retention
   • CMove the data into Microsoft Purview Audit instead
   • DReduce the ingestion volume of the sign-in connector
   ✓ Correct answer: A

   Interactive retention can be extended beyond the default 90 days at the workspace or table level, up to a maximum supported duration, at additional cost, to satisfy longer compliance query needs.

   Why the other options are wrong

   • BBasic Logs has its own limited retention behavior and reduced query features, not unlimited retention.
   • CPurview Audit is a separate M365 activity record store, not a substitute for workspace retention.
   • DReducing ingestion volume does not extend how long already-ingested data is retained.
9. Question 9Secure Storage, Databases, and Networking

   An application uses Always Encrypted with deterministic encryption on a 'NationalID' column so that equality searches (WHERE clause lookups) still function. What is the security trade-off of choosing deterministic over randomized encryption for this column?

   • ADeterministic encryption always yields the same ciphertext per value, letting an observer infer duplicate patternsCorrect
   • BDeterministic encryption disables Transparent Data Encryption on the entire database
   • CDeterministic encryption requires the database engine to store the encryption key alongside the data
   • DDeterministic encryption prevents the use of Microsoft Entra authentication for that database
   ✓ Correct answer: A

   Randomized encryption is more secure because it produces different ciphertext each time, but it prevents equality searches, joins, and grouping on that column. Deterministic encryption sacrifices some of that protection (an observer can tell which rows share the same underlying value) in exchange for query functionality.

   Why the other options are wrong

   • BAlways Encrypted's encryption type choice has no relationship to whether TDE is enabled at the database level.
   • CAlways Encrypted keys are stored outside the database engine (such as in Azure Key Vault or a certificate store), regardless of deterministic or randomized mode.
   • DThe choice of deterministic versus randomized encryption for a column has no bearing on whether Microsoft Entra authentication is available for the database.
10. Question 10Secure Storage, Databases, and NetworkingSelect all that apply

    A retailer must protect a table of loyalty-card numbers so the SQL engine never processes them as plaintext, while application code must still run equality lookups on the card number during a return, with the comparison itself computed inside a hardware-protected boundary. Which two elements must be configured together? (Choose TWO)

    • AAlways Encrypted with secure enclaves enabled on the databaseCorrect
    • BDynamic data masking on the card number column
    • CA column encryption key with randomized encryption for that columnCorrect
    • DTransparent Data Encryption with a Microsoft-managed key
    • ERow-level security predicate on the loyalty table
    ✓ Correct answer: A, C

    Secure enclaves must be enabled at the database level to allow rich in-place computations, and the column itself must use a column encryption key so its values are actually encrypted; together, this lets the engine compute the equality comparison inside the hardware-protected enclave without ever exposing plaintext to the query processor.

    Why the other options are wrong

    • BMasking only changes displayed output, it performs no encrypted computation.
    • DTDE alone protects data at rest but does not provide enclave-based computation on an encrypted column.
    • ERow-level security filters row visibility, it does not encrypt or compute on column values.

Who this SC-500 practice exam is for

This practice set is for anyone preparing for the SC-500: Cloud and AI Security Engineer Associate exam at the intermediate level - from first-time candidates building a foundation to experienced Microsoft practitioners doing a final review before test day. If you learn best by working through realistic questions and reading why each answer is right or wrong, it is built for you.

How to use this SC-500 practice exam

1. Start with the free sample questions above to gauge your current baseline.
2. Read the full explanation on every question, including why each wrong option is wrong.
3. Track your weak domains and focus your study where you are losing the most marks.
4. Once you are scoring consistently well, take a timed, full-length mock exam.
5. Use your readiness score to decide when you are ready to book the real SC-500 exam.

Related Microsoft resources

• SC-500 study guideKey concepts
• Microsoft practice examsAll Microsoft
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• SC-200 practice examRelated
• AZ-140 practice examRelated
• AZ-900 practice examRelated

SC-500 practice exam FAQ