SC-500 validates end-to-end security controls for cloud and AI workloads. This set covers the Manage identity, access, and governance domain, which accounts for 20–25% of the official skills outline. It tests privileged access, managed identities, Key Vault protection, and Azure governance. These SC-500 practice questions focus on choosing controls that meet a specific security constraint.
This is the first set in our Cloud and AI Security Engineer Associate SC-500 series (Questions 1-10). Every question is an original practice scenario mapped to the official exam objectives, not a copy of a real exam item.
Separate authentication, authorization, and network reachability when you diagnose access failures. Also distinguish controls that protect an Azure resource from controls that protect the data inside it.
Question 1: Access During Maintenance
A company has the licenses needed for Privileged Identity Management (PIM). Engineers need an Azure administrative role only during maintenance. Each use must require approval and expire after the approved activation period. Which assignment approach meets these requirements without manually adding and removing the role for each maintenance session?
A) Use a permanent active assignment and review access monthly.
B) Use an eligible assignment with approval-based, time-limited activation.
C) Use a time-bound active assignment spanning the maintenance quarter.
D) Use a permanent active assignment and request written justifications.
👁 Reveal Answer
Correct Answer: B
Explanation: B provides just-in-time access. An eligible engineer must activate the role, and PIM can require approval and limit the activation duration. A leaves privileges continuously available; a monthly review does not gate each use. C grants active access throughout the assigned date range rather than requiring activation for each session. D adds a process requirement but leaves the permanent active privileges available without PIM approval.
Reference: What is Privileged Identity Management?
Question 2: Reading a Policy Test Result
A security engineer tests an MFA grant requirement for a cloud application in Conditional Access report-only mode. A sign-in records Report-only: User action required. No other policy requires an MFA challenge for this sign-in. The engineer must explain the result without treating the test as enforcement. Which interpretation is correct?
A) The user was excluded, so the policy conditions did not match.
B) The policy blocked access until the user completed its MFA challenge.
C) An existing MFA claim already satisfied the policy’s grant requirement.
D) The policy matched, but its MFA requirement would need user interaction.
👁 Reveal Answer
Correct Answer: D
Explanation: D matches the documented result: the policy conditions were satisfied, but meeting the grant control would require user action. This report-only MFA policy does not prompt the user to complete its challenge. A describes a report-only not-applied result. B incorrectly treats a report-only policy as enforced. C describes a successful evaluation when an existing MFA claim already meets the requirement, not a user-action-required result.
Reference: Conditional Access policy insights: monitoring and evaluation
Question 3: Identity Across Replacements
A batch workload runs on several Azure virtual machines that are regularly replaced. All machines must use one preauthorized identity to access a downstream service that supports Microsoft Entra authentication. The identity must survive deletion of any individual machine, and developers must not manage a password or certificate. What should the engineer configure?
A) One user-assigned managed identity attached to the workload’s machines.
B) One system-assigned managed identity enabled on each workload machine.
C) One application service principal authenticated with a shared client secret.
D) One application service principal authenticated with a shared certificate.
👁 Reveal Answer
Correct Answer: A
Explanation: A has an independent lifecycle and can be associated with multiple Azure resources. Its downstream authorization can remain in place while machines are recycled, without developers managing credentials. B creates separate identities tied to the individual machines; they are not a single reusable identity. C requires managing a client secret. D replaces that secret with a certificate, but still introduces the credential management that the scenario prohibits.
Reference: Managed identities for Azure resources
Question 4: Read a Secret Without Editing It
An application can authenticate to an Azure key vault and reach its endpoint. The vault uses the Azure RBAC permission model and stores only the application’s secrets. The application must read secret values but must not create, change, or delete secrets. Which built-in role should be assigned at the vault scope for least privilege?
A) Key Vault Reader.
B) Key Vault Contributor.
C) Key Vault Secrets User.
D) Key Vault Secrets Officer.
👁 Reveal Answer
Correct Answer: C
Explanation: C allows reading secret contents without the secret-management capabilities of the officer role. The application’s dedicated vault makes vault-level scope appropriate here. A can read metadata but not sensitive secret values. B manages the vault through the control plane and does not grant access to its stored secrets. D can perform secret-management actions, including changes and deletions, so it exceeds the application’s read-only requirement.
Reference: Grant permission to applications to access an Azure key vault using Azure RBAC
Question 5: Preserve the Recovery Window
A key vault already has soft-delete enabled with a retention interval chosen at creation. Security policy requires deleted keys to remain recoverable until that interval expires, even if a caller has permission to purge them. Which additional vault feature directly enforces this requirement?
A) Enable firewall bypass for trusted Microsoft services.
B) Enable purge protection on the existing key vault.
C) Grant the caller the Key Vault Purge Operator role.
D) Keep soft-delete enabled without adding purge protection.
👁 Reveal Answer
Correct Answer: B
Explanation: B prevents a deleted vault or object from being purged before its retention interval passes. Soft-deleted objects remain recoverable during that period. A concerns network reachability, not deletion retention. C grants a purge capability rather than establishing a retention safeguard; the Purge Operator role specifically covers soft-deleted vaults. D preserves recoverability after ordinary deletion but, without purge protection, does not prevent an appropriately authorized early purge.
Reference: Azure Key Vault soft-delete
Question 6: An Authorized Client Is Blocked
A company’s external integration uses a fixed public IPv4 egress address to read a secret. Its identity and secret-reading role are valid. The key vault allows selected networks, but the integration’s address is not listed. Public network access is enabled, and no network security perimeter applies. The company must retain network filtering without adding a private connection. What is the smallest appropriate change?
A) Add the integration’s fixed public address to the vault firewall allowlist.
B) Add the integration’s identity to the Key Vault Secrets Officer role.
C) Enable trusted Microsoft services bypass for the external integration.
D) Disable the key vault firewall to admit requests from all public networks.
👁 Reveal Answer
Correct Answer: A
Explanation: A admits the known public source address while preserving the selected-network firewall configuration. Network permission and secret authorization are separate requirements, and authorization is already valid. B expands secret-management privileges without fixing the blocked network path. C is a bypass for designated Microsoft service scenarios, not arbitrary external clients. D would restore reachability by removing filtering, but it violates the requirement to retain network restrictions.
Question 7: Enforcing a Deployment Standard
An Azure Policy definition uses the Resource Manager mode and the deny effect to reject noncompliant resource configurations. The assignment enforces the policy, and the requester has sufficient RBAC permissions. A new deployment matches the definition’s noncompliance condition. The engineer must determine whether the resource provider will receive this request. What happens?
A) The resource is deployed, then immediately removed by the policy service.
B) The resource is deployed, and only its compliance status is changed.
C) The request is rewritten into a compliant configuration before deployment.
D) The request fails before it is sent to the resource provider.
👁 Reveal Answer
Correct Answer: D
Explanation: D is the Resource Manager deny behavior. Azure Policy blocks the matching create or update request before it reaches the resource provider and returns a forbidden result. A incorrectly describes deployment followed by deletion. B confuses evaluation of existing noncompliant resources with enforcement on a new request. C incorrectly attributes automatic configuration repair to deny. Sufficient RBAC access does not make the request compliant with the enforced policy.
Reference: Azure Policy definitions deny effect
Question 8: Remediation Through an SDK
An engineer uses an SDK to assign a valid custom deployIfNotExists policy. The policy’s required role IDs are defined, and its deployment template is correct. Existing resources need remediation. Which sequence completes the assignment’s remediation setup without relying on the Azure portal to grant permissions automatically?
A) Associate a managed identity, start remediation, then grant it required roles.
B) Associate a managed identity, grant the caller required roles, then start remediation.
C) Associate a managed identity, grant it required roles, then start remediation.
D) Associate a managed identity, rescan compliance without role grants, then start remediation.
👁 Reveal Answer
Correct Answer: C
Explanation: C provides the identity and permissions used to deploy the remediation template against existing resources. For SDK-created assignments, the required roles must be granted explicitly to the assignment’s managed identity. A starts remediation before its deployment identity has the required permissions. B grants permissions to the caller rather than the identity that performs the remediation deployment. D checks compliance again but leaves the deployment identity unauthorized; a compliance scan does not replace its required role assignments.
Reference: Remediate non-compliant resources with Azure Policy
Question 9: Deletion Protection With Updates
A team must protect an Azure storage account from accidental deletion through Azure Resource Manager. Authorized operators must still be able to update the account’s configuration. The team is selecting a management lock, not a data-retention feature. Which setting satisfies both requirements with the least restriction?
A) Apply a CanNotDelete lock to the storage account.
B) Apply a ReadOnly lock to the storage account.
C) Apply a ReadOnly lock to the containing resource group.
D) Leave the account unlocked while retaining operators’ existing permissions.
👁 Reveal Answer
Correct Answer: A
Explanation: A blocks deletion while allowing authorized configuration updates. It targets the account rather than unnecessarily restricting other resources. B also blocks updates, which conflicts with the operational requirement. C inherits a read-only restriction down to the account and affects other resources in the group. D adds no deletion safeguard. Management locks apply to control-plane operations; this account lock does not itself prevent deletion of blobs through the data plane.
Reference: Lock your Azure resources to protect your infrastructure
Question 10: Limit an Assignment’s Reach
A support group needs a predefined Azure role on every resource in the support-prod resource group, including resources added later. It must not receive that role on resources in other groups. No broader assignment already grants the group this role. Which scope provides the required coverage with the least ongoing assignment work?
A) Assign the role at the subscription that contains the resource group.
B) Assign the role at the support-prod resource group.
C) Assign the role separately to each resource currently in the group.
D) Assign the role at the management group that contains the subscription.
👁 Reveal Answer
Correct Answer: B
Explanation: B uses the parent-child scope hierarchy: resources inherit role permissions from their resource group, so the assignment covers the group’s resources without per-resource grants. A extends the role to other resource groups in the subscription. C limits today’s assignments but requires additional grants as resources are added. D is broader still because management-group assignments extend to resources in descendant subscriptions. Scope limits where a role applies; it does not change the role’s permissions.
Reference: Understand scope for Azure RBAC
Study Tips for Identity and Governance
- Activate, do not assume. A PIM eligible assignment requires activation before its privileges can be used.
- Separate access layers. A valid identity and RBAC role do not bypass a Key Vault network restriction.
- Know the retention safeguard. Soft-delete enables recovery; purge protection enforces the recovery interval against early purge.
- Match the governance control. Policy checks configuration standards, RBAC grants scoped permissions, and management locks restrict control-plane changes.
Keep Practicing for Cloud and AI Security Engineer
Use these SC-500 practice questions to review the difference between standing privileges and narrowly scoped access. The next set will cover storage and network security, including storage access, SQL controls, network rules, and private endpoints.