SC-500 cheat sheet
Last-minute reference for SC-500. The four areas carry near-equal weight, so a blind spot in any one is expensive.
Exam facts
| Duration | 120 minutes |
| Passing score | 700 / 1000 |
| Price | Set per country or region; shown at booking |
| Replaces | AZ-500 |
Skill areas
| Area | Weight |
|---|---|
| Secure storage, databases, and networking | 25–30% |
| Manage identity, access, and governance | 20–25% |
| Secure compute | 20–25% |
| Manage and monitor security posture | 20–25% |
Requirement to control
| Requirement | Control |
|---|---|
| No credentials stored anywhere | Managed identity |
| Elevated access for a few hours a month | Time-bound, approval-gated activation |
| Extra verification only for risky sign-ins | Risk-based conditional access |
| Reachable only from one virtual network | Private endpoint + public access disabled |
| Partner read access for seven days, no account | Scoped, time-limited user delegation SAS |
| Revoke access to data instantly | Customer-managed keys |
| Interactive VM access, no public management ports | Managed bastion host |
| Only approved executables may run | Application control with an allow-list |
| Data protected from the host during processing | Confidential computing |
| Baseline enforced on every new subscription | Policy at management group scope |
| Correlate alerts across products | SIEM |
| Track configuration improvement over time | Secure score |
Traps
- A firewall rule allowing your office IP still exposes a public endpoint. Private endpoint plus disabled public access is the answer.
- Disabling an account does not revoke live tokens. Sessions and tokens must be revoked explicitly.
- Access reviews, not activity logs, answer “is this access still needed”.
- Scan images in the pipeline and registry, not only running containers.
- Tiered retention beats deleting logs at 30 days when investigations reach back months.
- 0.0.0.0/0 is never an acceptable debugging step. Grant a scoped, time-limited rule instead.
Night-before checklist
- Four areas, roughly equal weight — name them
- Private endpoint versus firewall rule, cold
- Managed identity as the default credential answer
- Check ID and proctoring rules — see exam day
Take the 20-question practice test and check your weakest quarter.