Free SC-500 practice test: 20 questions
Twenty questions across the four SC-500 skill areas, weighted roughly as the real exam is. These are scenario questions: read what the requirement actually demands before picking the control.
Manage identity, access, and governance
Question 1. A contractor needs elevated access to one subscription for four hours a month to run a maintenance task. What should you implement?
- A. A permanent owner role assignment
- B. A shared administrator account
- C. Time-bound, approval-gated privileged access activation
- D. A long-lived service principal secret
Show answer
Answer: C
Just-in-time privileged access grants the role only for an approved window and removes it automatically, which matches a short recurring need. A permanent assignment leaves standing privilege between uses.
Question 2. An application running on a virtual machine must read secrets from a vault with no credentials stored on the machine. What should you use?
- A. A system-assigned managed identity with a vault access role
- B. A service principal secret in a local config file
- C. A shared account password in an environment variable
- D. A certificate emailed to the administrator
Show answer
Answer: A
A managed identity gives the VM an Entra ID identity the platform maintains, so no secret is stored or rotated by you. Every other option puts a credential on the host.
Question 3. Sign-ins from unfamiliar locations must trigger an additional verification step, but routine sign-ins from the corporate network should not. What fits?
- A. Require MFA for every sign-in without exception
- B. Block all sign-ins outside the corporate network
- C. Disable MFA entirely for trusted users
- D. Conditional access policies keyed to sign-in risk and location
Show answer
Answer: D
Risk-based conditional access evaluates signals such as location and behaviour and applies multi-factor authentication only when risk is elevated. Blanket MFA or blanket blocking ignores the ’not for routine sign-ins’ part.
Question 4. An auditor asks who approved each elevated role assignment in the last quarter, and whether those people still need the access. Which capability answers both?
- A. Network flow logs
- B. Access reviews with an approval trail
- C. Antivirus reports
- D. Backup reports
Show answer
Answer: B
Access reviews record approvals and periodically re-certify whether access is still required, covering both halves of the question. Activity logs alone show use, not necessity or approval.
Question 5. A departed employee's account was disabled but their personal access tokens kept working for several hours. What is the underlying problem?
- A. The account was never disabled
- B. Multi-factor authentication was not enabled
- C. Existing tokens and sessions were not revoked
- D. The password policy was too weak
Show answer
Answer: C
Tokens already issued remain valid until they expire or are explicitly revoked, so disabling an account does not immediately stop existing sessions. Revocation of active sessions and tokens is the missing step.
Secure storage, databases, and networking
Question 6. A storage account must be reachable only from a specific virtual network, never from the public internet. What should you configure?
- A. A private endpoint with public network access disabled
- B. A SAS token with a short expiry
- C. A firewall rule allowing the office public IP
- D. Encryption at rest with a customer-managed key
Show answer
Answer: A
A private endpoint places the service on your virtual network with a private address and public access disabled. Firewall IP rules still traverse the public endpoint, and SAS tokens control authorisation, not network path.
Question 7. A partner needs read access to one container for seven days, with no account in your tenant. What is the most appropriate mechanism?
- A. Share the storage account key
- B. A user delegation SAS scoped to the container and time-limited
- C. Make the container publicly readable
- D. Add the partner as a subscription owner
Show answer
Answer: B
A user delegation SAS scoped to the container with a seven-day expiry grants exactly that access without provisioning an identity. Sharing an account key grants full control and cannot be scoped.
Question 8. Compliance requires that your organisation controls the encryption keys for a database and can revoke access to the data instantly. What should you implement?
- A. Platform-managed keys only
- B. TLS for connections
- C. Transparent compression
- D. Customer-managed keys held in a key vault you control
Show answer
Answer: D
Customer-managed keys in a vault you control let you revoke key access, rendering data unreadable. Platform-managed keys do not offer that control, and TLS protects data in transit only.
Question 9. Database queries from an application must never traverse the public internet, and the database must reject any other source. Which combination applies?
- A. Private endpoint plus public network access disabled
- B. A firewall rule for the application’s public IP
- C. A stronger database password
- D. Query auditing
Show answer
Answer: A
A private endpoint provides the private path and disabling public network access enforces the restriction. Firewall rules alone still expose a public endpoint.
Question 10. An engineer requests that a storage firewall allow 0.0.0.0/0 temporarily to debug a failing job. What is the correct response?
- A. Approve it and review next quarter
- B. Approve it permanently to avoid repeat requests
- C. Refuse, and grant a scoped, time-limited rule for the specific source instead
- D. Disable the firewall entirely
Show answer
Answer: C
Opening the service to the entire internet is never an acceptable debugging step. Granting a scoped, time-limited exception for the specific source preserves the control while unblocking the work.
Question 11. You must detect unusual data exfiltration patterns from a storage account, such as a sudden bulk download. Which capability applies?
- A. Encryption at rest
- B. Threat detection alerts on anomalous storage access
- C. Blob versioning
- D. Lifecycle management rules
Show answer
Answer: B
Threat detection for storage analyses access patterns and alerts on anomalies like unusual bulk access. Encryption and versioning protect and preserve data but do not detect misuse.
Secure compute
Question 12. Virtual machines must not be reachable over SSH or RDP from the internet, but administrators still need interactive access. What should you use?
- A. Open SSH and RDP to the office IP range
- B. Disable all remote access
- C. A public load balancer in front of the VMs
- D. A managed bastion host with no public management ports on the VMs
Show answer
Answer: D
A managed bastion service brokers the session over the portal without exposing management ports publicly. Opening ports to office IPs still exposes them, and disabling access entirely breaks the requirement.
Question 13. Container images must be checked for known vulnerable packages before they reach production. Where does this belong?
- A. Image scanning in the build pipeline and registry, gating promotion
- B. Scanning only containers already running in production
- C. Annual manual review of base images
- D. Relying on the base image publisher
Show answer
Answer: A
Scanning in the build pipeline and in the registry catches vulnerable images before deployment. Scanning only running production containers means the vulnerable image already shipped.
Question 14. A virtual machine must be prevented from running unapproved executables, with a maintained allow-list. Which control fits?
- A. A host firewall rule
- B. Disk encryption
- C. Application control with an approved executable list
- D. Automatic patching
Show answer
Answer: C
Application control restricts execution to approved binaries. Antimalware detects known-bad rather than enforcing an allow-list, and a firewall governs network traffic.
Question 15. Regulatory rules require that data in memory is protected from the hosting platform itself during processing. Which capability addresses this?
- A. Encryption at rest on the OS disk
- B. Confidential computing with a hardware trusted execution environment
- C. TLS between services
- D. A private endpoint
Show answer
Answer: B
Confidential computing uses hardware-based trusted execution environments that keep data encrypted in use, including from the host. Disk and transit encryption do not protect data while it is being processed.
Question 16. Security patches must be applied to a fleet of servers on a schedule, with reporting on which hosts are non-compliant. What should you implement?
- A. A managed update service with scheduled deployments and compliance reporting
- B. Manual patching during maintenance windows
- C. Rebooting servers weekly
- D. Antimalware definition updates
Show answer
Answer: A
A managed update service applies patches on a schedule and reports compliance per host. Manual patching and auto-restart do not give the reporting the requirement asks for.
Manage and monitor security posture
Question 17. Leadership wants a single score showing whether the environment's security configuration is improving month over month. What provides this?
- A. The number of alerts raised per month
- B. Total log volume ingested
- C. A secure score derived from configuration assessments
- D. The number of virtual machines deployed
Show answer
Answer: C
A secure score aggregates configuration assessments into a trackable figure. Raw alert counts and log volume measure activity, not posture.
Question 18. Every new subscription must automatically enforce a baseline of required security settings, without relying on teams to remember. What should you use?
- A. A written onboarding checklist
- B. Policy assigned at management group scope with enforcement effects
- C. A monthly email reminder
- D. A shared spreadsheet of settings
Show answer
Answer: B
Policy assigned at management group scope applies automatically to subscriptions beneath it, including new ones. Documentation and checklists depend on people following them.
Question 19. Alerts from several security products must be correlated into a single incident and investigated together. Which capability does this?
- A. Each product’s own console
- B. Archiving logs to cold storage
- C. A network packet capture
- D. A SIEM that correlates multi-source signals into incidents
Show answer
Answer: D
A SIEM ingests signals from multiple sources and correlates them into incidents. Individual product consoles show only their own alerts, and log archiving stores without correlating.
Question 20. An analyst must be able to investigate an incident from three months ago, but log storage costs are high. What is the appropriate design?
- A. Tiered retention with archived logs that can be restored for investigation
- B. Delete all logs after 30 days
- C. Keep everything in the hottest tier indefinitely
- D. Store logs only on the source hosts
Show answer
Answer: A
Tiered retention keeps recent data in hot, queryable storage and older data in cheaper archive that can be restored for investigation. Deleting logs after 30 days would make the three-month investigation impossible.
How did you do?
Sixteen or more correct suggests you are close. Below fourteen, the domain guides in this section are the fastest fix — SC-500 rewards knowing which control satisfies a requirement, not just what each service does.