SC-500 Part 10: Practice Exam and Answer Rationales

These 25 scenario-based questions match SC-500 exam difficulty. The exam targets security engineers configuring Azure, M365, and AI security controls. Answer independently before reading rationales.

Target score: 20+ out of 25 before scheduling the exam.

Domain 1: Identity, Access, and Governance (Questions 1–6)

Q1

A security engineer needs to ensure that members of the Global Administrator role can only activate that role for a maximum of 2 hours, must use phishing-resistant MFA, and require approval from a second administrator. Which feature should they configure?

A. Conditional Access policy with authentication strength

B. Microsoft Entra PIM role settings for Global Administrator

C. Azure Policy with a deny effect for role assignment

D. Access review for the Global Administrator group

Correct answer: B

Rationale: PIM role settings control activation duration, MFA requirement, and approval workflow per role. Conditional Access operates at sign-in time but does not control PIM activation requirements directly. Access reviews periodically validate membership but do not control how activation works.

Q2

An Azure Function App must read secrets from Azure Key Vault. The developer asks how to authenticate without storing any credentials in code or configuration. What should they use?

A. A service principal with client secret stored in an App Setting

B. A system-assigned managed identity on the Function App with Key Vault Secrets User RBAC role

C. A storage account key with connection string in environment variables

D. A user account with Key Vault Contributor role

Correct answer: B

Rationale: A system-assigned managed identity eliminates all credential management — Azure handles the identity lifecycle and token issuance. The Function App needs the Key Vault Secrets User (read secrets) role, not Key Vault Contributor (manage the vault resource). A is a security anti-pattern — secrets in config are rotation burdens and exposure risks.

Q3

A company must block access to all cloud apps from anonymous proxy IP addresses, regardless of user credentials. They want to allow normal access from company offices and compliant managed devices. Which Conditional Access control achieves this?

A. Grant: Require MFA

B. Grant: Require compliant device

C. Block: Exclude named locations (office IPs), include anonymous IP condition, block

D. Session: Sign-in frequency set to 1 hour

Correct answer: C

Rationale: Blocking anonymous IPs requires a CA policy that targets the Anonymous IP address risk condition (or a named location blocking list) and applies a Block grant control. MFA does not block access — it challenges. Session controls do not block — they modify session behavior.

Q4

Security auditors require that all Key Vault secret read operations in production are logged and that those logs are retained for 365 days. What configuration achieves this at minimum cost?

A. Enable Microsoft Defender for Key Vault

B. Enable Diagnostic Settings on the vault, route AuditEvent to a Log Analytics workspace with 365-day retention

C. Enable Key Vault Firewall logging

D. Export Key Vault access policy to Azure Storage

Correct answer: B

Rationale: Diagnostic Settings route Key Vault audit logs (category: AuditEvent) to Log Analytics, Storage Account, or Event Hub. Log Analytics retention can be set per workspace. Defender for Key Vault sends alerts on anomalous access but does not provide the full read-operation audit log. Firewall logging tracks network traffic, not data-plane operations.

Q5

After a policy review, the security team must deny all deployments of virtual machines outside of approved Azure regions (West Europe and North Europe). Which service enforces this proactively, before resources are created?

A. Azure RBAC deny assignment

B. Azure Policy with a Deny effect and condition on allowedLocations

C. Conditional Access policy for Azure Portal

D. Microsoft Sentinel analytics rule

Correct answer: B

Rationale: Azure Policy with Deny effect blocks non-compliant resource creation at the ARM layer — before the resource is deployed. RBAC deny assignments restrict actions but do not filter by location. Sentinel analytics rules detect after the fact. Conditional Access controls identity-level sign-in, not resource deployment.

Q6

A developer is building an application that will call the Microsoft Graph API. During review, the security team notices the app registration has been granted User.ReadWrite.All (application permission) instead of User.Read (delegated). Why is this a problem?

A. Application permissions require MFA

B. Application permissions act as the app identity without user context and grant write access to all users, violating least privilege

C. Delegated permissions are faster than application permissions

D. User.ReadWrite.All is only available in Graph Beta

Correct answer: B

Rationale: Application permissions run without user context — the app itself has the permission to read/write all users without impersonating anyone. User.ReadWrite.All grants write access to all user accounts, far exceeding what the app needs. The correct scope is User.Read (delegated) — the app reads only the signed-in user's own profile.

Domain 2: Storage, Databases, and Networking (Questions 7–11)

Q7

A security engineer discovers that a storage account's SAS token was accidentally committed to a public GitHub repository 6 hours ago. The SAS token expires in 30 days. What is the fastest way to revoke access?

A. Delete the storage account

B. Rotate the storage account key that was used to sign the SAS token

C. Change the SAS token's expiry to 1 minute from now

D. Remove public access on the storage account

Correct answer: B

Rationale: Service SAS tokens are signed with a storage account key. Rotating the key immediately invalidates all SAS tokens signed with that key. You cannot modify or revoke an individual SAS token once issued (unlike User Delegation SAS which can be revoked via Entra ID). Option C is not possible — you cannot edit an issued SAS token. Option D would deny all public access but not kill authenticated SAS access.

Q8

A company wants to prevent their Azure SQL Database from being accessible from the internet while still allowing access from their App Service in the same virtual network. What network control achieves this?

A. Azure SQL Database server-level firewall allowing App Service outbound IP

B. Private Endpoint for Azure SQL Database with public network access disabled

C. Virtual network service endpoint on the App Service subnet

D. Azure Firewall Premium with FQDN rule for the SQL server

Correct answer: B

Rationale: Private Endpoint + public access disabled removes the SQL server from the internet entirely. The App Service connects via the private IP within the VNet. Service endpoints (Option C) allow traffic from the subnet but do not disable public access completely. Firewall IP allowlisting (Option A) still leaves the public endpoint exposed.

Q9

Defender for Storage generates an alert: "Unusual quantity of files extracted from a blob storage account." What is the most appropriate first investigation step?

A. Delete the storage account

B. Review Storage Diagnostic Logs (StorageBlobLogs) to identify the identity, IP, and files accessed

C. Disable storage account keys immediately

D. Add the alert to a Sentinel workbook

Correct answer: B

Rationale: Before taking containment action, scope the incident: who accessed what, from where, and when. StorageBlobLogs in Log Analytics show every object operation with identity, IP, status, and object path. Disabling keys (Option C) contains a key-based attack but may disrupt legitimate operations — do after scoping. Deleting the account destroys evidence.

Q10

A virtual machine is receiving a volumetric DDoS attack on its public IP address. The organization has Azure DDoS Protection Standard enabled on the VNet. What action should the security team take?

A. Manually block the attacker IPs in the NSG

B. Enable DDoS Protection Standard on the specific VM NIC

C. No immediate action required — DDoS Protection Standard automatically detects and mitigates the attack

D. Move the VM to a different Azure region

Correct answer: C

Rationale: DDoS Protection Standard activates mitigation automatically when attack traffic exceeds the normal traffic baseline. The team should monitor the DDoS Protection telemetry and review post-mitigation reports, but no manual intervention is needed for volumetric mitigation. DDoS Protection is applied at the VNet level — Option B is not how it works.

Q11

Defender for DNS generates an alert indicating a VM is making DNS queries to a known command-and-control domain. The VM is running a web application. What does this indicate?

A. The VM's DNS server needs to be updated

B. The web application or a dependency may be compromised; the DNS query is likely C2 beaconing

C. Azure DNS is misconfigured on the VNet

D. The alert is a false positive from CDN traffic

Correct answer: B

Rationale: DNS queries to known C2 domains from a server-class workload almost always indicate malware beaconing — establishing contact with the attacker's infrastructure. Immediate actions: isolate the VM via NSG, collect a memory dump and disk snapshot, review process and network logs for the malicious process making the DNS queries.

Domain 3: Secure Compute (Questions 12–15)

Q12

A security audit finds that multiple production VMs have RDP (port 3389) and SSH (port 22) permanently open via NSG rules to 0.0.0.0/0. What is the correct remediation from a Defender for Cloud recommendation?

A. Change the NSG rule to allow only port 3389, not 3388

B. Enable Just-In-Time VM Access to close ports by default and open only on approved request

C. Use Azure Bastion instead and keep the ports open

D. Move the VMs to a private subnet

Correct answer: B

Rationale: JIT VM Access closes high-risk ports (RDP, SSH, WinRM) via NSG deny rules by default and creates time-limited allow rules only when access is approved through Defender for Cloud or Azure Portal. Azure Bastion (Option C) is a valid alternative browser-based approach but still requires closing the direct NSG rules; enabling Bastion does not automatically close them.

Q13

A container image in Azure Container Registry is found to have a critical CVE in one of its base layers. The image has already been deployed to production AKS. What is the correct response sequence?

A. Patch the CVE in the base image, rebuild and push to ACR, update the AKS deployment to the new image version

B. Delete the AKS node pool and redeploy from scratch

C. Disable the ACR repository until the CVE is fixed

D. Acknowledge the CVE in Defender for Containers and close the alert

Correct answer: A

Rationale: Container vulnerabilities are remediated by updating the base image, rebuilding, and redeploying — not by deleting infrastructure. After rebuilding, Defender for Containers will rescan the new image and confirm the CVE is resolved. Acknowledging/closing the alert (Option D) suppresses the finding but does not fix the vulnerability.

Q14

An organization is deploying a sensitive multi-tier application to Azure App Service. The team needs to ensure the app cannot be accessed by other tenants and cannot share compute resources with other customers. What pricing tier and configuration achieves this?

A. Standard tier with custom domain

B. App Service Environment (ASE) deployed into a dedicated VNet

C. Premium tier with VNet integration

D. Isolated tier with Application Gateway WAF

Correct answer: B

Rationale: App Service Environment (ASE) provides single-tenant dedicated infrastructure for App Service, fully deployed inside a VNet. The application runs on hardware dedicated to the tenant. Premium tier with VNet integration allows outbound VNet traffic but does not provide compute isolation — the App Service still runs on shared multi-tenant infrastructure.

Q15

Defender for Servers detects that a VM is running a process matching known ransomware behavior: it is enumerating shares and encrypting files in rapid succession. What immediate automated response can be configured via Defender for Cloud?

A. Automatically delete the VM

B. Trigger a Logic App playbook that isolates the VM by removing its NSG allow rules

C. Send an email to the security team

D. Take an automatic disk snapshot

Correct answer: B

Rationale: Automated response in Defender for Cloud / Sentinel uses Logic App playbooks triggered by alert conditions. A playbook can call the Azure REST API to remove NSG rules (isolating the VM from the network) within seconds of the alert. Option C is notification, not response. Option A is destructive and destroys forensics.

Domain 4: Security Posture and Monitoring (Questions 16–20)

Q16

An analyst wants to find all sign-ins in the last 7 days from countries not in the approved list (US, FI, SE). Which KQL query is most appropriate?

A. SigninLogs | where Location !in ("US", "FI", "SE") | where TimeGenerated > ago(7d)

B. AuditLogs | where ActivityDateTime > ago(7d) | where Country !in ("US", "FI", "SE")

C. SecurityEvent | where EventID == 4625 | where Country !in ("US", "FI", "SE")

D. AADNonInteractiveUserSignInLogs | summarize count() by Country

Correct answer: A

Rationale: SigninLogs (from Entra ID) contains the Location field representing sign-in country. The !in operator filters rows where Location is not in the approved set. AuditLogs tracks directory changes, not sign-ins. SecurityEvent 4625 is on-premises Windows failed logon, not Entra sign-ins. Option D counts but doesn't filter by country.

Q17

A Sentinel analytics rule creates a high-severity incident whenever a user is added to the Global Administrator role. The SOC team wants the incident automatically assigned to a specific analyst group and tagged as "PrivilegedAccess" without running a Logic App. What Sentinel feature handles this?

A. Analytics rule incident creation settings

B. Automation rule with conditions matching the incident and actions: assign owner, add tag

C. Playbook triggered by alert

D. Workbook with saved filter for Global Admin alerts

Correct answer: B

Rationale: Automation rules (not playbooks) handle incident routing, assignment, tagging, and severity changes without requiring a Logic App. They evaluate conditions (e.g., analytics rule name, severity) and apply actions directly in Sentinel. Playbooks run Logic Apps — adding one for simple tagging/assignment is unnecessary overhead. Analytics rule settings control incident creation but not post-creation routing.

Q18

Defender for Cloud shows a Secure Score of 42%. An engineer wants to improve it most efficiently. Which approach has the highest expected impact?

A. Enable Microsoft Defender for all resource types across all subscriptions

B. Sort recommendations by Score Impact (descending) and remediate the highest-impact items first

C. Review all resource health alerts and close the oldest ones first

D. Add more subscriptions to the management group

Correct answer: B

Rationale: Each Defender for Cloud recommendation has a specific score impact. Sorting by descending impact and remediating the top items delivers the fastest Secure Score improvement. Enabling Defender plans (Option A) adds workload protection and may add new recommendations, but does not directly improve Secure Score for existing recommendations already identified.

Q19

The security team needs a dashboard in Sentinel showing the number of high-severity incidents per day over the last 30 days, broken down by incident source. What Sentinel component provides this?

A. Analytics rule

B. Automation rule

C. Workbook with KQL visualization queries

D. Threat Intelligence feed

Correct answer: C

Rationale: Sentinel Workbooks provide interactive dashboards with KQL-backed visualizations (charts, tables, time series). A workbook query like SecurityIncident | where Severity == "High" | summarize count() by bin(CreatedTime, 1d), ProviderName produces the required view. Analytics rules detect threats; they do not display dashboards.

Q20

An organization is evaluating Microsoft Security Copilot for their SOC. Which task represents a valid and documented use of Security Copilot?

A. Replacing the SIEM by ingesting and storing raw log data

B. Generating natural language summaries of Sentinel incidents, writing KQL queries from plain text prompts, and correlating threat intelligence

C. Automatically patching vulnerabilities found in Defender for Cloud

D. Replacing Conditional Access policies with AI-generated risk decisions

Correct answer: B

Rationale: Security Copilot is an AI assistant for security analysts — it accelerates investigation by summarizing incidents, translating natural language to KQL, explaining alerts, and enriching context from MDTI. It does not replace a SIEM, patch systems, or replace security controls.

Domain 5: AI Workload Security (Questions 21–23)

Q21

A production LLM application receives user messages that include: "". Defender for AI generates an alert. What attack is this and what Azure control detects it at the input layer?

A. SQL injection — detected by Azure Web Application Gateway

B. Prompt injection — detected by Azure AI Content Safety with jailbreak detection

C. Cross-site scripting — detected by Azure Firewall

D. Credential stuffing — detected by Entra ID Protection

Correct answer: B

Rationale: Prompt injection embeds attacker instructions in data passed to an LLM. Azure AI Content Safety's jailbreak detection classifies inputs attempting to override system instructions. This is distinct from XSS (browser-level injection) or SQL injection (database query manipulation).

Q22

An Azure OpenAI deployment is used internally by developers. The security team wants to prevent developers from being able to deploy new models or modify deployment configuration, but still allow them to run inference. Which RBAC role should developers receive?

A. Cognitive Services Contributor

B. Cognitive Services OpenAI Contributor

C. Cognitive Services OpenAI User

D. Reader

Correct answer: C

Rationale: Cognitive Services OpenAI User grants inference (completions, chat) access only. Cognitive Services OpenAI Contributor allows managing deployments, fine-tuning, and model configuration. Least privilege means giving developers only what they need to call the API.

Q23

Which OWASP LLM Top 10 category covers AI agents taking actions beyond their intended scope — such as deleting records or sending emails — based on instructions in a prompt injection payload?

A. LLM01 — Prompt Injection

B. LLM06 — Sensitive Information Disclosure

C. LLM08 — Excessive Agency

D. LLM02 — Insecure Output Handling

Correct answer: C

Rationale: LLM08 Excessive Agency describes AI systems that can take consequential actions (delete, send, modify) and do so based on injected instructions. The mitigation is least privilege for AI agents: agents should require human confirmation before destructive or high-risk actions, and their permissions should be scoped to minimum necessary.

Domain 6–8: Incident Response, XDR, and Hunting (Questions 24–25)

Q24

During a threat hunt, an analyst writes this Sentinel KQL query and finds unusual results:

SigninLogs
| where TimeGenerated > ago(24h)
| summarize FailedLogins = countif(ResultType != "0"),
            SuccessLogins = countif(ResultType == "0")
  by UserPrincipalName, IPAddress
| where FailedLogins > 15 and SuccessLogins > 0
| order by FailedLogins desc

What attack pattern does a high failed-to-success login ratio indicate?

A. Password spray (many accounts, few attempts each)

B. Successful brute force — attacker failed many times before succeeding with the correct password

C. MFA fatigue attack

D. Service principal token theft

Correct answer: B

Rationale: The query groups by both user and IP — the combination of many failures followed by a success from the same IP against the same user is the classic brute force pattern. Password spray shows many failures spread across many users. MFA fatigue shows successful authentication after MFA approval, not failed logins. Service principal token theft would show successful authentications only — no password-based failures.

Q25

After a ransomware incident, the forensics team needs to analyze the file system and running processes of a compromised VM without risking further contamination. The VM is still running. What is the correct approach?

A. Log into the VM via RDP and run analysis tools directly

B. Shut down the VM and delete it after exporting logs

C. Take a snapshot of the OS disk while the VM is still running, then isolate the VM via NSG — analyze the snapshot in an isolated forensic environment

D. Reimage the VM from the last known-good backup and compare changes

Correct answer: C

Rationale: Disk snapshots preserve the state without disrupting the VM. Taking the snapshot before isolation captures the file system as-is. After snapshotting, isolate the VM via NSG to prevent C2 communication and lateral movement. Connecting via RDP could destroy volatile state and alert the attacker process. Reimaging (Option D) destroys evidence needed for understanding the attack vector.

Answer Key

QADomain
1BIdentity
2BIdentity
3CIdentity
4BIdentity
5BIdentity
6BIdentity
7BStorage/Network
8BStorage/Network
9BStorage/Network
10CStorage/Network
11BStorage/Network
12BCompute
13ACompute
14BCompute
15BCompute
16APosture/Monitoring
17BPosture/Monitoring
18BPosture/Monitoring
19CPosture/Monitoring
20BPosture/Monitoring
21BAI Security
22CAI Security
23CAI Security
24BHunting/IR
25CHunting/IR