SC-500: Cloud and AI Security Engineer Associate Practice Exam

What the SC-500 exam covers

• Manage Identity, Access, and Governance216 questions
• Secure Storage, Databases, and Networking260 questions
• Secure Compute228 questions
• Manage and Monitor Security Posture231 questions

Free SC-500 practice test questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 935.

1. Question 1Secure Compute

   A company is preparing to roll out Microsoft 365 Copilot and wants to identify SharePoint sites where permissions have drifted so broadly that most employees can access files that were never intended for wide distribution. Which capability should the security team use first?

   • ARun a DSPM for AI oversharing assessment in Microsoft PurviewCorrect
   • BReview the Defender for Cloud secure score for the hosting subscription
   • CCheck Entra Conditional Access sign-in logs for affected users
   • DReview the Azure Policy compliance dashboard for the subscription
   ✓ Correct answer: A

   The correct first step is running a Purview DSPM for AI oversharing assessment against the tenant's SharePoint sites, because that assessment is purpose-built to surface locations where broad groups such as 'Everyone except external users' have accumulated far wider access than intended. This matters ahead of a Copilot rollout because Copilot only ever returns content the signed-in user already has permission to see, so any oversharing gap becomes a channel for AI to surface material that was never meant for broad distribution. Running the assessment first gives the security team a ranked, permission-scope view of exactly which sites and files are exposed, rather than guessing. The other options look at different layers entirely (Azure resource posture, sign-in logs, policy compliance) and none of them read SharePoint's actual sharing configuration. Remember: oversharing is a permissions problem, so the fix always starts with a tool that inspects permissions.

   Why the other options are wrong

   • BDefender for Cloud secure score reflects Azure infrastructure security posture such as VM and network configuration; it has no visibility into SharePoint document or site permissions.
   • CConditional Access sign-in logs record authentication events like where and how a user signed in, not which files or sites that user is authorized to open.
   • DAzure Policy compliance dashboards track whether Azure resources conform to governance rules; SharePoint sharing settings sit outside that resource-configuration scope entirely.
2. Question 2Secure Compute

   A security engineer must ensure that both the OS and data disks of an Azure Windows VM are encrypted with keys managed outside the VM, using the same technology as on-premises BitLocker. Which capability should the engineer enable?

   • AAzure Disk Encryption integrated with Azure Key VaultCorrect
   • BStorage service encryption with Microsoft-managed keys
   • CAzure Backup soft delete for the VM
   • DTransparent Data Encryption on the managed disk
   ✓ Correct answer: A

   Azure Disk Encryption (ADE) encrypts both OS and data disks using the same in-guest mechanism as on-premises Windows servers, BitLocker, and it stores the resulting encryption secrets and keys in Azure Key Vault rather than on the VM itself, satisfying the requirement for externally managed keys using familiar technology. Takeaway: when a requirement explicitly calls out BitLocker parity and externally managed keys, that is Azure Disk Encryption integrated with Key Vault.

   Why the other options are wrong

   • BStorage service encryption with Microsoft-managed keys operates at the storage platform layer using platform-controlled keys, not the requested BitLocker mechanism.
   • CBackup soft delete protects backed-up data from accidental deletion; it does not encrypt the running VM's disks.
   • DTransparent Data Encryption encrypts Azure SQL database files specifically, not general-purpose VM disks.
3. Question 3Manage Identity, Access, and Governance

   A security engineer creates a custom Azure Policy definition that scans new virtual networks for the presence of a Network Security Group on each subnet. If a subnet lacks an NSG, the policy definition should mark the resource as non-compliant in the Defender for Cloud compliance view but must never prevent engineers from finishing their deployment. Which effect satisfies this requirement?

   • Adeny
   • BauditCorrect
   • Cmodify
   • DdeployIfNotExists
   ✓ Correct answer: B

   Audit creates a warning event in the activity log and marks the resource non-compliant in the compliance dashboard when the condition in the policy rule is not met, but it always allows the create or update operation to complete. This matches the requirement that deployments must never be prevented while still surfacing the gap for reporting.

   Why the other options are wrong

   • Adeny would stop the deployment outright, which the requirement explicitly forbids.
   • Cmodify actively changes properties or tags on the resource, which goes beyond simply flagging non-compliance.
   • DdeployIfNotExists triggers a related resource deployment (such as creating the missing NSG), which is more than the passive flagging the scenario asks for.
4. Question 4Manage Identity, Access, and Governance

   Which PIM feature notifies administrators when roles are assigned outside of Privileged Identity Management directly through Azure RBAC, bypassing the eligible-assignment workflow?

   • APIM alerts for role assignments made outside of PIMCorrect
   • BEntra ID sign-in risk detections
   • CAzure Monitor activity log retention policy
   • DConditional Access report-only mode
   ✓ Correct answer: A

   PIM's built-in alerting surface specifically watches for governance-bypass patterns, including roles being assigned directly through Azure RBAC or Microsoft Entra role management rather than through PIM's eligible-assignment workflow, alongside alerts like too many permanent owners for a role or duplicate assignments. This lets the security team catch an administrator (or an automated process) that circumvents the intended just-in-time model quickly, rather than discovering the bypass much later during a manual audit.

   Why the other options are wrong

   • BSign-in risk detections flag suspicious authentications, not out-of-band directory role assignments.
   • CActivity log retention preserves audit history but does not itself generate a proactive alert about bypassed PIM.
   • DReport-only mode simulates Conditional Access decisions and has no relationship to PIM assignment alerting.
5. Question 5Secure Storage, Databases, and Networking

   A company wants to allow inbound traffic to a subnet only from within the same virtual network, and explicitly deny everything else, using the lowest number of custom rules while relying on Azure defaults where possible. Which approach is correct?

   • AAdd no custom rules; AllowVnetInBound permits intra-VNet traffic and DenyAllInBound blocks the restCorrect
   • BAdd a custom allow rule for VirtualNetwork and a custom deny rule for Internet, both at priority 100
   • CRemove the NSG entirely so that only Azure Firewall filters the subnet
   • DAdd a custom rule allowing the AzureCloud service tag, since it covers only intra-VNet traffic
   ✓ Correct answer: A

   No custom rule is needed because Azure's built-in default rules already satisfy both halves of the requirement. Every NSG automatically includes AllowVnetInBound, which permits traffic sourced from the VirtualNetwork tag (that is, anything within the same virtual network), AllowAzureLoadBalancerInBound for health probes, and DenyAllInBound as the final catch-all that blocks everything not already permitted. Together, allowing intra-VNet traffic and denying all else is exactly what these defaults already do, so adding no custom rules at all meets the requirement with zero additional configuration, which is also the lowest number of custom rules the question asks for. Takeaway: know the three default rules and what each already covers before reaching for custom rules.

   Why the other options are wrong

   • BTwo rules at the same priority number is invalid, and this design duplicates behavior the defaults already provide.
   • CRemoving the NSG eliminates a layer of defense-in-depth and is unnecessary when the defaults already meet the requirement.
   • DThe AzureCloud tag represents Microsoft's broader cloud IP space across many services, not strictly intra-VNet traffic.
6. Question 6Secure Storage, Databases, and Networking

   An incident responder suspects a VM is communicating with an unexpected external host and wants to capture and inspect the actual packets being sent and received, including protocol-level detail, for offline analysis. Which Network Watcher feature should be used?

   • APacket captureCorrect
   • BEffective security rules
   • CTopology
   • DNSG diagnostics summary only
   ✓ Correct answer: A

   Packet capture is the Network Watcher feature that records the actual raw traffic to and from a specified VM, typically saving it to a storage account in a standard packet capture format for deep, protocol-level offline analysis, which is precisely what an incident responder needs to examine the real contents and behavior of a suspicious connection rather than a summary of allow or deny decisions. Remember: when the requirement is to inspect the actual bytes on the wire, packet capture is the tool that provides it.

   Why the other options are wrong

   • BEffective security rules shows which NSG rules apply to a NIC; it provides no visibility into actual packet contents or payloads.
   • CTopology visualizes network resource relationships and connectivity structure, not raw packet-level traffic content.
   • DThere is no feature called an 'NSG diagnostics summary'; the relevant deep-inspection tool for this scenario is packet capture.
7. Question 7Manage and Monitor Security Posture

   An IT administrator asks whether Security Copilot capabilities can appear directly inside the Microsoft Intune admin center to help summarize device compliance issues, without opening a separate Copilot site. Is this supported, and why?

   • AYes, because the embedded experience surfaces Copilot within supported admin portals including IntuneCorrect
   • BNo, Security Copilot is only ever available as a fully separate standalone site with no embedding
   • CNo, embedding is only supported inside Microsoft Sentinel, not Intune
   • DYes, but only through a third-party plugin built specifically for Intune
   ✓ Correct answer: A

   Yes, this is supported, because Security Copilot's embedded experience is specifically designed to surface directly inside multiple supported Microsoft admin portals, including the Microsoft Intune admin center alongside Defender XDR, Entra, and Purview, letting an IT administrator get AI-assisted summaries of device compliance issues without leaving Intune. This directly answers the administrator's question and explains the why: embedding is a native, built-in capability, not something bolted on. Remember that embedded experience support spans several first-party Microsoft admin portals, not just one.

   Why the other options are wrong

   • BSecurity Copilot is not limited to a standalone site; embedded surfaces exist in multiple admin portals, including Intune.
   • CEmbedding is not limited to Sentinel; Intune is one of several supported embedded surfaces alongside it.
   • DThe embedded experience in Intune is a native Microsoft capability, not something requiring a separate third-party plugin.
8. Question 8Manage and Monitor Security Posture

   A network security appliance produces an extremely high volume of compliance-only log data that is essentially never queried interactively and is kept solely to satisfy a regulatory retention mandate. Which table plan minimizes cost for this collect-and-retain use case?

   • AAuxiliary LogsCorrect
   • BBasic Logs, which is optimized for occasional interactive search
   • CAnalytics Logs
   • DThe free Log Analytics pricing tier
   ✓ Correct answer: A

   For extremely high-volume, compliance-only log data that is essentially never queried interactively and exists solely to satisfy a retention mandate, Auxiliary Logs is the table plan that minimizes cost, since it is purpose-built for this exact collect-and-retain pattern at the lowest per-gigabyte cost of any Log Analytics table plan. Remember the cost ladder: Analytics is most expensive and fully queryable, Basic is mid-cost with occasional search, and Auxiliary is cheapest for pure retention.

   Why the other options are wrong

   • BBasic Logs costs more than Auxiliary Logs and is designed for data that still needs occasional interactive search, not pure compliance retention with almost no querying.
   • CAnalytics Logs is the most expensive, full-capability tier and is unnecessary overhead for data that is rarely if ever queried interactively.
   • DThere is no meaningful free Log Analytics pricing tier suitable for production-scale, high-volume compliance log data like this firewall's output.
9. Question 9Secure Storage, Databases, and NetworkingSelect all that apply

   Which two are valid destinations for Azure SQL Database audit logs to be written to? (Choose TWO)

   • AAn Azure storage accountCorrect
   • BA Log Analytics workspaceCorrect
   • CA shared access signature token
   • DA network security group flow log
   • EA dynamic data masking rule set
   ✓ Correct answer: A, B

   Azure SQL auditing supports three destinations for audit records: an Azure storage account, a Log Analytics workspace, and an Event Hub, and administrators can enable more than one simultaneously if different teams need different access patterns. A storage account is typically chosen for long-term, low-cost archival of audit data that does not need frequent querying. A Log Analytics workspace is chosen when the team wants to run KQL queries, build dashboards, or correlate audit events with other security signals, often through Microsoft Sentinel. An Event Hub is chosen when audit events need to stream in near real time to an external system, such as a third-party SIEM, and would be equally valid here if it were among the listed choices. Takeaway: know all three real destinations, storage account, Log Analytics, and Event Hub, so you can recognize decoys built from unrelated Azure features.

   Why the other options are wrong

   • CA SAS token is a delegated access credential, not a log destination that audit records can be written to.
   • DNSG flow logs capture network traffic metadata for subnets and NICs; they are an entirely separate logging feature unrelated to SQL audit configuration.
   • EDynamic data masking is a query-result presentation feature, not a destination for storing audit log records.
10. Question 10Secure Storage, Databases, and Networking

    A partner company needs its users to connect to a corporate VNet over a point-to-site VPN using their existing Microsoft Entra ID credentials, subject to Conditional Access policies including MFA, rather than a static pre-issued certificate. Which P2S authentication type should be configured on the VPN gateway?

    • AAzure certificate authentication
    • BMicrosoft Entra ID authenticationCorrect
    • CRADIUS with a fixed shared secret
    • DIKEv2 with a pre-shared key
    ✓ Correct answer: B

    Configuring the point-to-site VPN gateway for Microsoft Entra ID authentication means every connection attempt is itself an Entra sign-in event, so Conditional Access policies, including requiring MFA, a compliant or hybrid-joined device, or specific locations, are evaluated on every single connection attempt from the partner's users, exactly matching the requirement to enforce Conditional Access rather than rely on a static, pre-issued credential. Takeaway: only Entra ID P2S authentication ties every VPN connection attempt to a live Conditional Access evaluation; certificates and shared secrets are both static and pre-issued.

    Why the other options are wrong

    • ACertificate authentication validates a client certificate issued ahead of time, it does not evaluate Entra sign-in or Conditional Access at connect time.
    • CRADIUS can integrate with an on-premises NPS server and MFA extension, but it does not natively evaluate Microsoft Entra Conditional Access policies.
    • DA pre-shared key is a shared secret model with no per-user identity, similar to a site-to-site setup.

Who this SC-500 practice exam is for

This practice set is for anyone preparing for the SC-500: Cloud and AI Security Engineer Associate exam at the intermediate level - from first-time candidates building a foundation to experienced Microsoft practitioners doing a final review before test day. If you learn best by working through realistic questions and reading why each answer is right or wrong, it is built for you.

How to use this SC-500 practice exam

1. Start with the free sample questions above to gauge your current baseline.
2. Read the full explanation on every question, including why each wrong option is wrong.
3. Track your weak domains and focus your study where you are losing the most marks.
4. Once you are scoring consistently well, take a timed, full-length mock exam.
5. Use your readiness score to decide when you are ready to book the real SC-500 exam.

Related Microsoft resources

• SC-500 study guideKey concepts
• Microsoft practice examsAll Microsoft
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• How these questions are written and reviewedMethodology
• Report a problem with a questionCorrections
• SC-900 practice examRelated
• AB-100 practice examRelated
• AB-620 practice examRelated

SC-500 practice exam FAQ