SC-500 validates end-to-end security controls for cloud and AI workloads. This set covers Secure storage, databases, and networking, which accounts for 25–30% of the official skills outline. The domain tests data access, SQL security, and network isolation. These SC-500 storage and network questions focus on selecting controls that meet a specific security constraint.
This is the second set in our Cloud and AI Security Engineer Associate SC-500 series (Questions 11-20). It follows SC-500 Questions 1-10 on identity and governance. Every question is an original practice scenario mapped to the official exam objectives, not a copy of a real exam item.
Check whether a problem concerns authorization, name resolution, or rule evaluation before changing permissions. A smaller priority number does not override Azure Firewall’s processing order between different rule types.
Question 11: A Subnet Changes Its Storage Path
A VM subnet and a Blob Storage account are in the same Azure region. The account restricts its public endpoint to selected networks. After an engineer enables the subnet’s storage service endpoint, an existing rule for the subnet’s public egress IP no longer permits access. The VM’s data authorization is valid. Which change restores access without allowing other subnets or deploying a private endpoint?
A) Add the VM’s private address as a storage IP network rule.
B) Add the subnet’s public egress address to the SAS token.
C) Add a storage virtual network rule for the VM’s subnet.
D) Add a trusted-service exception for all resources in Azure.
👁 Reveal Answer
Correct Answer: C
Explanation: C allows the specific subnet through the storage public-endpoint firewall. After a service endpoint is enabled, the subnet’s storage traffic no longer uses its public egress IP, so the old IP rule has no effect. A misuses an IP network rule, which allows public address ranges rather than private VM addresses. B limits SAS use but cannot grant access beyond the firewall. D is not a general exception for arbitrary Azure resources and does not establish the required subnet rule.
Reference: Firewall rules and network access for Azure Storage
Question 12: Delegate a Short Download
A download service authenticates to Azure through Microsoft Entra ID and has the permissions needed to obtain a user delegation key and read a blob. A client must download that one private blob directly for a short period. The service must not retrieve or store a storage account key. Which access mechanism should it issue?
A) A read-only user delegation SAS scoped to the blob.
B) A read-only service SAS scoped to the blob.
C) A read-only account SAS scoped to the Blob service.
D) A read-only service SAS referencing a container policy.
👁 Reveal Answer
Correct Answer: A
Explanation: A uses a user delegation key obtained with Microsoft Entra credentials, not a storage account key. Limiting its resource, permissions, and expiry meets the direct-download requirement. B is a service SAS signed with the storage account key. C also uses the account key and offers account-level delegation rather than the requested single-blob scope. D adds centrally managed constraints to a service SAS, but that SAS still relies on Shared Key signing.
Reference: Grant limited access to data with shared access signatures
Question 13: Revoke One Partner’s Tokens
A legacy partner integration uses several service SAS tokens associated with one dedicated stored access policy on a blob container. Other partners use different policies. The dedicated tokens are compromised. Shared Key access must remain enabled, and the engineer must invalidate the compromised group without rotating an account key or affecting other policies. What should the engineer do?
A) Change the compromised tokens’ expiry values in the client configuration.
B) Remove the compromised partner’s Azure RBAC data-role assignment.
C) Add a new stored policy while retaining the compromised policy.
D) Delete the dedicated stored policy while retaining the other policies.
👁 Reveal Answer
Correct Answer: D
Explanation: D removes the policy on which the compromised service SAS tokens depend, revoking that associated group without replacing the account key. Preserve the container’s other signed identifiers when updating its access control list. A changes local copies but does not invalidate tokens already held by an attacker. B does not revoke a service SAS signed with Shared Key. C creates another policy while leaving the compromised tokens’ existing association valid.
Reference: Define a stored access policy
Question 14: Missing Authentication Failures
Azure SQL Database auditing records successful sign-ins. An investigator knows that some Microsoft Entra credential checks failed before callers reached the database, but those failures are absent from the SQL audit log. The investigator needs the authentication-failure evidence without changing database auditing. Where should the investigator look?
A) In the SQL audit destination’s successful-login records.
B) In Microsoft Entra authentication logs in the Entra admin center.
C) In SQL audit files for the database’s temporary tables.
D) In SQL audit files after changing their destination format.
👁 Reveal Answer
Correct Answer: B
Explanation: B contains the Microsoft Entra authentication evidence. Microsoft documents that failed Entra logins do not appear in SQL audit logs because credentials are checked before the requested database is accessed. A provides successful activity, not the missing failures. C points to unrelated temporary-table activity and cannot recover authentication events that never reached the database. D changes how audit data is stored, not where the failed credential check occurs.
Reference: Auditing for Azure SQL Database
Question 15: Require One Authentication System
A company has configured a Microsoft Entra administrator for an Azure SQL logical server. Authorized applications already use Microsoft Entra authentication. Security policy now prohibits new SQL-authenticated connections to every database on that server, including connections using the SQL server administrator account. Which server configuration directly enforces the policy without deleting each SQL login individually?
A) Enable Microsoft Entra-only authentication on the logical server.
B) Rotate the SQL administrator password on the logical server.
C) Retain mixed authentication and enable database auditing.
D) Retain mixed authentication and remove one SQL database user.
👁 Reveal Answer
Correct Answer: A
Explanation: A disables SQL authentication at the logical-server level, including the SQL administrator, logins, and users. Existing SQL accounts are not deleted, but they cannot establish SQL-authenticated connections. B replaces one credential while leaving SQL authentication available. C records selected database activity without prohibiting this authentication method. D removes one user’s access, not SQL authentication across all databases. The configured Microsoft Entra administrator satisfies the documented prerequisite.
Reference: Microsoft Entra-only authentication with Azure SQL
Question 16: Evaluate an Exception Rule
A VM has one applicable NSG and no Virtual Network Manager security admin rules. Its NSG denies inbound TCP port 8443 from all sources at priority 210. An exception allows the approved management subnet to that port at priority 320. A new connection from that subnet is denied. Which edit admits the exception while retaining the broader denial for other sources?
A) Change the exception rule’s priority from 320 to 420.
B) Change the broad deny rule’s priority from 210 to 110.
C) Change the exception rule’s priority from 320 to 160.
D) Change the exception rule’s direction from inbound to outbound.
👁 Reveal Answer
Correct Answer: C
Explanation: C gives the narrow allow rule a lower priority number than the broad deny. NSG rules are evaluated from lower numbers to higher numbers, and processing stops on a match. A moves the exception even later. B moves the denial earlier, so it still blocks the approved subnet. D makes the exception apply to a different traffic direction. The scenario specifies a new connection so existing stateful sessions do not obscure the result.
Reference: Azure network security groups overview
Question 17: Add a Replacement Worker
An NSG allows a processing tier to reach a database tier by referencing their application security groups. A later matching deny rule blocks other sources. A replacement worker in the same virtual network has valid routes and application credentials, but its NIC is not in the processing ASG. Existing workers connect successfully. What is the smallest change that preserves the group-based policy?
A) Add the worker’s NIC to the database-tier application security group.
B) Add the worker’s NIC to the processing-tier application security group.
C) Replace the processing source ASG with the entire virtual network.
D) Remove the deny rule so every source can reach the database tier.
👁 Reveal Answer
Correct Answer: B
Explanation: B makes the new worker match the source ASG already used by the narrow allow rule. An ASG-referencing rule does not automatically include every NIC in the associated subnet. A puts the worker in the destination tier, not the required source group. C broadens the allowed source beyond the processing tier. D removes the explicit restriction on other sources and abandons the intended segmentation instead of fixing membership.
Reference: Azure application security groups overview
Question 18: Resolve the Private Storage Address
A VM uses Azure-provided DNS. An approved Blob Storage private endpoint has a reachable private IP. The correct A record exists in a private DNS zone named privatelink.blob.core.windows.net, but the zone is not linked to the VM’s virtual network. The normal blob hostname resolves to a public IP, and public storage access is disabled. Which change restores the intended path without changing the connection string?
A) Replace the normal blob hostname with the privatelink hostname in code.
B) Add a public storage IP allow rule for the VM’s private address.
C) Remove the private DNS A record so public resolution remains available.
D) Link the existing private DNS zone to the VM’s virtual network.
👁 Reveal Answer
Correct Answer: D
Explanation: D makes the existing private DNS record available to the VM’s Azure-provided resolver. The normal storage hostname can then resolve through its alias to the private endpoint IP. A changes application configuration unnecessarily; Microsoft recommends retaining the normal connection string rather than connecting with the privatelink URL. B neither fixes DNS nor grants private-endpoint access. C removes the private answer needed to use the approved endpoint and leaves the blocked public path.
Reference: Use private endpoints for Azure Storage
Question 19: A Website Denial Is Bypassed
A VM’s outbound traffic traverses Azure Firewall. One network rule allows TCP port 443 to any destination. An application rule denies HTTPS to a prohibited website, yet requests to that website are allowed by the network rule. No DNAT, threat intelligence block, or IDPS block applies. Which explanation identifies the rule-design problem?
A) Application rules only apply to HTTP and cannot evaluate HTTPS.
B) Network rules are evaluated only after every application rule fails.
C) A matching network rule terminates processing before application rules.
D) Every allow action overrides a deny action regardless of rule type.
👁 Reveal Answer
Correct Answer: C
Explanation: C explains why the hostname-specific denial is never evaluated. Azure Firewall processes network rules before application rules, and a network match terminates that rule evaluation. A is incorrect because application rules support HTTPS matching. B reverses the documented processing order. D invents a universal allow-over-deny precedence rule. Redesign broad network allows so traffic requiring application-layer restrictions reaches the application rules; simply giving the application collection a smaller number does not reverse rule-type order.
Reference: Azure Firewall rule processing logic
Question 20: Interpret a Connectivity Check
An engineer runs Network Watcher IP flow verify for an outbound TCP connection from a VM to a remote server on port 9443. It returns Access allowed and names the matching security rule, but the application still times out. The engineer must avoid treating a policy check as an end-to-end test. What does the result establish?
A) The tested packet is allowed by the applicable security and admin rules.
B) The remote application is listening and accepting requests on port 9443.
C) The VM’s guest firewall permits every packet on the tested network path.
D) The complete forward and return paths can deliver the application’s traffic.
👁 Reveal Answer
Correct Answer: A
Explanation: A matches the feature’s scope: IP flow verify evaluates the specified packet against applicable NSG and Virtual Network Manager admin rules. An allowed result is not proof that the application can connect. B requires evidence from the remote service. C extends the result to guest operating-system filtering, which this rule check does not establish. D claims end-to-end routing and return-path validation beyond the security-rule evaluation. Continue investigating the timeout without unnecessarily broadening an already-allowing rule.
Reference: IP flow verify overview
Study Tips for Storage and Network Security
- Separate network and data access. A SAS grants delegated data permissions but does not override storage firewall restrictions.
- Identify the signing key. User delegation SAS uses Microsoft Entra credentials; service and account SAS use Shared Key.
- Trace the hostname. Keep the normal storage connection string and confirm it resolves to the private endpoint IP.
- Read rule order carefully. NSGs use the first priority match, while Azure Firewall evaluates network rules before application rules.
Keep Practicing for Cloud and AI Security Engineer
Use these SC-500 storage and network questions to review the boundary between permissions and connectivity. Revisit SC-500 Questions 1-10 for identity and governance. The next set will cover compute and AI security.