2026 Actual Microsoft SC-500 Dumps, Updated Exam Questions for Guaranteed Pass

SC-500 free sample questions and answers

Microsoft SC-500 practice quiz with correct answers for search indexing.

1. Question 1

   Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem.

   After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.

   You have an Azure subscription that contains two virtual machines named VM1 and VM2. Each virtual machine has system-assigned managed identity enabled.

   You have an Azure Storage account named storage1. Public access from all networks is enabled for storage1.

   You need to ensure that VM1 and VM2 can access storage1.

   Solution: You create a user-assigned managed identity, assign the identity to each virtual machine, and then add each managed identity to a role on storage1.

   Does this meet the goal?

   AYes
   

   BNo
   

   Correct answer: A

   A user-assigned managed identity can be attached to multiple virtual machines and then granted an Azure Storage data role. The applications running on VM1 and VM2 can request tokens for that identity and access storage1 without account keys. Public network access is already enabled, so the missing control is authorization. Assigning the user-assigned managed identity to the correct storage role satisfies the access requirement. For SC-500, the decisive distinction is whether the control authenticates an identity, grants authorization, or merely changes configuration visibility. The incorrect choices generally either grant excessive privilege, change the application model, or operate at the wrong scope. Microsoft expects the least-privilege identity path that satisfies the scenario without introducing shared secrets or unnecessary tenant-wide rights. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > managed identities; Microsoft Learn > user-assigned managed identities and role assignment to storage.

   ==============================================================

   
   

2. Question 2

   Your organization stores sensitive customer encryption keys and database credentials in Azure Key Vault. The security team has discovered that several non-production development environments are currently able to access the production Key Vault instance due to overly permissive access policies. You need to remediate this access immediately while ensuring that authorized production workloads can still retrieve secrets and that you can track all access attempts for compliance auditing purposes.

   Which combination of actions should you take?

   ARemove the development environment's access by deleting its service principal, enable Key Vault firewall to restrict network access to production networks only, and enable Defender for Key Vault to monitor threat detection
   

   BModify the Key Vault access policy to use a deny assignment that prevents development environments from accessing any secrets, then disable Key Vault auditing to reduce noise
   

   CMove all secrets to a separate Key Vault instance dedicated to development and configure IP-based firewall rules to block all traffic except from the production subnet
   

   DImplement role-based access control (RBAC) on Key Vault by removing identity-based access policies entirely and assigning only custom Azure roles to production identities, with no logging enabled
   

   EDelete the current Key Vault and recreate it with a more restrictive default access policy, configure Key Vault firewall settings to allow only production resources, and enable Defender for Key Vault with threat protection
   

   Correct answer: A

   The correct answer is to remove the development environment's access by deleting its service principal, enable Key Vault firewall to restrict network access to production networks only, and enable Defender for Key Vault to monitor threat detection. This approach addresses the immediate security issue (overly permissive access), implements network-level controls (firewall), and adds threat detection and monitoring capabilities that are essential for production security. Defender for Key Vault provides real-time threat protection and alerts on suspicious access patterns.

   Why the other options are incorrect:

   • Deny assignments are not the primary mechanism for controlling Key Vault access; the standard approach is to remove inappropriate access policies.
   • Disabling auditing compromises compliance and leaves no record of access attempts.
   • Simply moving secrets to another vault does not fix the underlying access control problem.
   • Removing all identity-based access policies and relying solely on custom RBAC can complicate management; both approaches can be used together.
   • Deleting and recreating the Key Vault is disruptive and unnecessary; remediation of access policies is the appropriate first step.

3. Question 3

   You have an Azure subscription that contains a resource group named RG1 and has Microsoft Defender tor Cloud enabled.

   You connect an Amazon Web Services (AWS) account to Defender for Cloud by creating the AW5 connector in RG1.

   You have a Microsoft Entra group named Group1 that contains the UMf accounts of (he security analysts at your company.

   You need to ensure that the members of Group1 can view multicloud recommendations and security alerts 'or the connected AWS account. The solution must follow the principle of least privilege

   Which role should you assign to Group1 for RG1?

   AOwner
   

   BSecurity Administrator
   

   CSecurity Reader
   

   DReader
   

   Correct answer: C

   To enable members of Group1 to view multicloud recommendations and security alerts for the connected AWS account while following the principle of least privilege, you should assign the Security Reader role to Group1 for RG1.

   Role comparison:

   • Security Reader: Read-only access to security recommendations and alerts across all resources, including multicloud connectors. This is the least privileged role that provides the necessary visibility.
   • Contributor or Owner: Provides too much access and violates least privilege principle
   • Reader: Does not provide specific security insights

   The Security Reader role allows security analysts to:

   • View recommendations from Defender for Cloud
   • View security alerts and incidents
   • Access multicloud recommendations from connected AWS accounts
   • Investigate security posture
   • Cannot make changes or remediate issues

   This is the appropriate role for security analysts who need read-only access to security information without administrative capabilities.

4. Question 4

   SIMULATION

   Lab Task

   use the following login credentials as needed:

   To enter your username, place your cursor in the Sign in box and click on the username below.

   To enter your password. place your cursor in the Enter password box and click on the password below.

   Azure Username: Userl -28681041@ExamUsers.com

   Azure Password: GpOAe4@lDg

   If the Azure portal does not load successfully in the browser, press CTRL-K to reload the portal in a new browser tab.

   The following information is for technical support purposes only:

   Lab Instance: 28681041

   Task 4

   You need to ensure that a user named user2-28681041 can manage the properties of the virtual machines in the RG1lod28681041 resource group. The solution must use the principle of least privilege.

   ACheck below steps in explanation for Task
   

   Correct answer: A

   To ensure that a user named user2-28681041 can manage the properties of the virtual machines in the RG1lod28681041 resource group using the principle of least privilege, you can follow these steps:

   In the Azure portal, search for and select the resource group named RG1lod28681041.

   In the left pane, selectAccess control (IAM).

   SelectAdd.

   In the Add role assignment pane, enter the following information:

   Role: Select the appropriate role for your scenario. For example,Virtual Machine Contributor.

   Assign access to: SelectUser, group, or service principal.

   Select: Enter the name of the user you want to assign the role to. For example, user2-28681041.

   SelectSave.

   https://docs.microsoft.com/en-us/azure/role-based-access-control/role-assignments-portal

   
   

5. Question 5

   You are deploying a containerized microservices application to Azure Kubernetes Service (AKS) and want to implement defense-in-depth security controls. Defender for Containers has flagged vulnerabilities in your container images during the build pipeline, and you need to prevent deployment of images with critical vulnerabilities. Additionally, you need runtime protection to detect and respond to suspicious container behavior such as unexpected process execution or network connections to known malicious domains. You also want to enforce pod-level security policies to restrict privileged operations.

   Which three configurations are required to implement this comprehensive container security posture?

   AConfigure Azure Container Registry (ACR) image scanning with vulnerability thresholds to block image push operations for critical vulnerabilities, enable Defender for Containers runtime protection, and implement Kubernetes network policies to restrict inter-pod communication
   

   BDeploy Azure Policy for Kubernetes to enforce pod security standards (such as restricting privileged containers and enforcing read-only filesystems), enable Defender for Containers for runtime monitoring, and configure ACR image scanning with critical vulnerability blocks
   

   CUse Pod Security Policies (PSPs) to enforce all container security controls at the pod level, enable image scanning in Docker Hub, and manually review all container runtime alerts before taking action
   

   DConfigure AppArmor profiles on all AKS nodes to prevent container escape attacks, disable Defender for Containers to reduce alert noise, and rely on image scanning at ACR build-time only
   

   EImplement Istio service mesh for mutual TLS between services and automatic sidecar injection, enable Defender for Containers EDR capabilities for runtime detection, and configure Azure Policy for Kubernetes to enforce security baselines for pods
   

   Correct answer: A, B, E

   The correct answers are options 1, 2, and 5, each representing a valid multi-layered approach:

   Option 1 is correct because it addresses build-time security (ACR vulnerability scanning with enforcement), runtime protection (Defender for Containers), and network-level segmentation (Kubernetes network policies) across the container lifecycle.

   Option 2 is correct because Azure Policy for Kubernetes enforces pod-level security standards that prevent privileged containers and enforce immutability, Defender for Containers provides behavioral runtime protection, and ACR scanning blocks vulnerable images at the source—this aligns with SC-500 content on AKS security and Defender for Containers configurations.

   Option 5 is correct because it combines service mesh encryption/authentication (Istio mTLS), runtime detection (Defender for Containers EDR), and policy-based enforcement (Azure Policy for Kubernetes), providing comprehensive defense-in-depth.

   Option 3 is incorrect because Pod Security Policies are deprecated in modern Kubernetes versions (removed in Kubernetes 1.25+) and should not be relied upon. Relying on Docker Hub scanning is also incorrect as ACR is the recommended Azure container registry. Option 4 is incorrect because disabling Defender for Containers removes critical runtime visibility, and AppArmor alone does not provide sufficient container threat protection compared to purpose-built container runtime security solutions like Defender for Containers.