ExamSprintLab

Free SC-500 sample questions with answers

Updated September 20, 2026

Try these before reading the answers. One comes from each domain, plus an extra from the new AI security material.

Question 1. Administrators need standing access removed. They should request elevation to a privileged role, be approved, and hold it only for a limited period, with an audit trail. What should you implement?

  • A. A permanent Owner role assignment for each administrator
  • B. Privileged Identity Management with approval and time-bound activation
  • C. A conditional access policy requiring MFA
  • D. A resource lock on the subscription
Show answer

Answer: B

Privileged Identity Management provides time-bound, approval-based, audited elevation into privileged roles, which is precisely the requirement. A permanent role assignment is the thing being removed, conditional access governs the conditions of sign-in rather than role duration, and a resource lock prevents resource changes rather than managing role access.

Question 2. An Azure SQL Database must not be reachable over the public internet, and an application in a virtual network must still connect to it. What should you configure?

  • A. A private endpoint for the database, with public network access disabled
  • B. A SQL firewall rule permitting the application’s public IP
  • C. A network security group on the application subnet
  • D. Disable auditing to reduce the exposed surface
Show answer

Answer: A

A private endpoint gives the PaaS resource an address inside your virtual network so traffic never traverses the public internet, which is what the requirement states. A firewall rule allowing a public IP still exposes a public endpoint, an NSG filters traffic but does not remove public reachability, and disabling auditing weakens security without addressing connectivity.

Question 3. Your organisation has deployed Microsoft 365 Copilot. Security is concerned that users will surface documents they technically have access to but should not, because of years of permissive SharePoint sharing. What addresses this first?

  • A. Block Microsoft 365 Copilot for all users
  • B. Require MFA for all Copilot users
  • C. Identify data overexposure in SharePoint and assess risk using Purview DSPM
  • D. Deploy a Web Application Firewall in front of SharePoint
Show answer

Answer: C

Identifying data overexposure in SharePoint and assessing Copilot risk with Purview DSPM targets the actual cause, which is pre-existing overpermissioning that Copilot makes newly visible. Blocking Copilot removes the benefit rather than fixing the problem, MFA addresses authentication not authorisation, and a WAF protects web applications.

Question 4. An autonomous agent registered with Microsoft Entra Agent ID has been granted access to several systems. Security wants to understand what it could reach if it were compromised. What should you use?

  • A. Delete the agent and rebuild it with fewer permissions
  • B. Enable disk encryption on the hosting virtual machines
  • C. Enforce just-in-time VM access
  • D. Analyse blast radius for the Entra Agent ID using Defender XDR
Show answer

Answer: D

Blast radius analysis for Entra Agent ID in Defender XDR is the objective that answers exactly this question about reachable scope if an agent identity is compromised. Deleting the agent removes the capability rather than assessing it, disk encryption protects data at rest, and JIT VM access controls virtual machine access rather than agent permissions.

Question 5. You must collect Windows Security events from on-premises servers into Microsoft Sentinel, with control over which event IDs are ingested. What should you implement?

  • A. A custom log table in the workspace
  • B. Data collection rules for Windows Security events, with WEF where appropriate
  • C. An automation rule and playbook
  • D. A resource lock on the Sentinel workspace
Show answer

Answer: B

Data collection rules govern Windows Security event collection into Sentinel and let you control what is ingested, with Windows Event Forwarding where appropriate. A custom log table stores data but does not collect it, a playbook automates response, and a resource lock prevents resource changes.

How did you do?

Question 3 and 4 are the ones with no AZ-500 equivalent. If those felt unfamiliar while the rest did not, you are in the position most experienced Azure security engineers are in — see week 4 of the study plan, which is dedicated to exactly that material.