Important Microsoft SC-500 Exam Questions

CertPrep • Microsoft • SC-500 Exam Questions

Select Certification Providers

Select Certification Exam

Get Full Version

Microsoft Implementing End-to-End Security Controls for Cloud and AI Workloads SC-500 Exam

Attempt the Cloud and AI Security Engineer Associate practice test and solve real exam-like SC-500 questions to prepare efficiently and increase your chances of success. Our Microsoft SC-500 practice questions match the actual Implementing End-to-End Security Controls for Cloud and AI Workloads exam format, helping you enhance confidence and improve performance. With our SC-500 practice exam software, you can analyze your performance, identify weak areas, and work on them effectively to boost your final Cloud and AI Security Engineer Associate exam score.

Vendor:	Microsoft
Exam Name:	Implementing End-to-End Security Controls for Cloud and AI Workloads
Registration Code:	SC-500
Related Certification:	Microsoft Cloud and AI Security Engineer Associate Certification
Exam Audience:	Security Engineers,

Total Questions

Last Updated

06-08-2026

Exam Duration

120 MINUTES

Upgrade to Premium

GET FULL PDF

Question: 1

You have an Azure subscription named Sub1 that contains multiple virtual machines.

You have a Microsoft 365 E5 subscription that contains devices onboarded to Microsoft Defender for Endpoint.

You have an on-premises datacenter that contains multiple servers.

You plan to onboard all existing and future on-premises servers to Azure Arc.

You need to ensure that the Azure Arc-enabled servers are protected by using the same security features as the Microsoft 365 devices immediately after the servers are onboarded. The solution must minimize administrative effort.

What should you do?

AOnboard each server to Microsoft Defender for Endpoint by using Group Policy.

BOnboard each server to Microsoft Defender for Endpoint by using a local installation script.

CFor Sub1, enable the Microsoft Defender for Servers plan in Microsoft Defender for Cloud.

DConfigure an Azure Policy assignment.

Answer: C

Explanation:

When on-premises servers are onboarded to Azure Arc, Microsoft Defender for Servers can extend Microsoft Defender for Endpoint integration and server protection policies to them centrally. Enabling the Defender for Servers plan in the subscription minimizes manual effort and applies protection as Arc resources come under Defender for Cloud. Local scripts or Group Policy deployments protect current servers only and are weaker for future automatic onboarding. For SC-500, compute controls are evaluated by workload type: VM, Arc server, AKS, container registry, container group, Functions, Logic Apps, App Service, and AI agent runtime. The right answer uses the Microsoft control that is native to that workload. Broad Azure roles or unrelated monitoring services would either overgrant access or fail to enforce the required security state. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > onboard servers to Defender for Servers; Microsoft Learn > Defender for Servers and Azure Arc integration.

==============================================================

Question: 2

Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem.

After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.

You have an Azure subscription that contains two virtual machines named VM1 and VM2. Each virtual machine has system-assigned managed identity enabled.

You have an Azure Storage account named storage1. Public access from all networks is enabled for storage1.

You need to ensure that VM1 and VM2 can access storage1.

Solution: You add each virtual machine to a security group, and then add the security group to a role on storage1.

Does this meet the goal?

AYes

BNo

Answer: B

Explanation:

Adding virtual machines to a security group does not by itself grant Azure Storage access. The authorization principal used by Azure RBAC must be the managed identity or another supported security principal that the workload uses to request tokens. The solution also fails to state that the system-assigned managed identities are added to the group. Because the compute resources themselves are not the authenticating principals, this solution does not meet the goal. This domain is tested through precise scope control: tenant, subscription, resource, application, and data-plane authorization are not interchangeable. The correct choice applies the smallest identity or governance control that enforces the stated requirement. Options that only add users, create registrations, or provide broad administrator access fail because they do not directly enforce the requested access behavior. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > Azure RBAC and identities; Microsoft Learn > role assignment requires an identity principal at the scope.

==============================================================

Question: 3

You have an Azure management group named MG1 that contains two subscriptions named Sub1 and Sub? Both subscriptions are linked to a Microsoft Entra tenant that contains a security group named Group!

You need to ensure that the members of Group1 can assign roles to the resources in Sub1 and Sub2. The solution must follow the principle of least privilege.

Which role should you assign to Group1?

AContributor at the MG1 scope

BContributor at the Sub1 and Sub2 scopes

CUser Access Administrator at the MG1 scope

DOwner at the MG1 scope

Answer: C

Explanation:

User Access Administrator is the least-privilege Azure built-in role for managing role assignments without full resource ownership. Assigning it at the MG1 scope covers both Sub1 and Sub2 because management group scope flows down to child subscriptions. Contributor cannot assign Azure roles. Owner would work but grants more than role-assignment authority, violating least privilege. Assigning separately at each subscription adds unnecessary administration. For SC-500, the decisive distinction is whether the control authenticates an identity, grants authorization, or merely changes configuration visibility. The incorrect choices generally either grant excessive privilege, change the application model, or operate at the wrong scope. Microsoft expects the least-privilege identity path that satisfies the scenario without introducing shared secrets or unnecessary tenant-wide rights. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > manage Azure built-in role assignments; Microsoft Learn > User Access Administrator role.

==============================================================

Question: 4

You have two management groups named MG1 and MG2 that contain multiple Azure subscriptions. The subscriptions are linked to a Microsoft Entra tenant.

You have a user named User1 and a global administrator named Admin 1

You are informed that User1 created an Azure subscription named Sub1 under the MG2 management group and is the only owner of the subscription.

You need to ensure that Admin1 can remove the Owner role from User1 for Sub1.

What should you do first?

AMove Sub1 to MG1.

BAssign Admin1 the User Access Administrator role for Sub1.

CInstruct Admin1 to use Privileged Identity Management (PIM) to request the Security Administrator role.

DInstruct Admin1 to enable Access management for Azure resources.

Answer: D

Explanation:

A Global Administrator does not automatically have access to every Azure subscription. The first step is to enable Access management for Azure resources, which elevates the global administrator to manage Azure role assignments at the root scope. After that elevation, Admin1 can remove the Owner assignment from User1 on Sub1. Moving subscriptions or requesting Security Administrator would not provide the Azure RBAC authority needed to modify ownership. The exam objective emphasizes practical identity enforcement rather than cosmetic configuration. A valid answer must identify who authenticates, what permission is granted, where the scope is applied, and whether the method continues to work without passwords or secrets. That is why the selected answer is preferred over broader administrative roles or unrelated access settings. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > Azure role assignments; Microsoft Learn > elevate access to manage Azure resources.

==============================================================

Question: 5

You have a Microsoft Entra tenant that uses Privileged Identity Management (PIM).

You need to modify the AI Administrator role settings to meet the following requirements:

*Elevated access must be evaluated by another administrator before it is granted

*Privileged access must be removed automatically after a fixed period.

Which two settings should you configure? Each correct answer presents part of the solution.

NOTE: Each correct selection is worth one point.

AExpire active assignments after

BRequire approval to activate

CRequire justification on activation

DExpire eligible assignments after

EActivation maximum duration

Answer: B, E

Explanation:

Approval before elevation is implemented by requiring approval to activate the PIM role. Automatic removal after a fixed active period is controlled by the activation maximum duration. Expiring active or eligible assignments governs the assignment lifecycle, not the duration of each activation session. Requiring justification can improve audit quality, but it does not ensure that another administrator evaluates the request or that access ends after the configured active window. This domain is tested through precise scope control: tenant, subscription, resource, application, and data-plane authorization are not interchangeable. The correct choice applies the smallest identity or governance control that enforces the stated requirement. Options that only add users, create registrations, or provide broad administrator access fail because they do not directly enforce the requested access behavior. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > Privileged Identity Management; Microsoft Learn > configure role activation settings.

==============================================================

SAVE TIME & QUICKLY PREPARE WITH REAL QUESTIONS

GET FULL ACCESS

Other Microsoft Certification Exams

AB-410 Exam

Building Intelligent Applications

AB-620 Exam

Designing and Building Integrated AI Agent Solutions in Copilot Studio

DP-750 Exam

Implementing Data Engineering Solutions Using Azure Databricks

AZ-400 Exam

Designing and Implementing Microsoft DevOps Solutions

AZ-140 Exam

Configuring and Operating Microsoft Azure Virtual Desktop

AZ-104 Exam

Microsoft Azure Administrator Exam