ExamSprintLab

SC-500 secure compute and AI explained

Updated September 20, 2026

Secure compute is worth 20–25% of SC-500 and contains the material that makes this exam different from the AZ-500 it succeeded. It has three parts: security for AI, security for servers and VMs, and security for application platform services. The AI part is new, it is substantial, and no AZ-500 resource covers it.

Implement security for AI

Eleven objectives. They sort into three ideas.

Agents are identities you govern. Microsoft Entra Agent ID gives an agent its own identity, which means the familiar identity toolkit applies to it:

  • Conditional access for Entra Agent ID
  • Managing Entra Agent ID access
  • Blast radius analysis using Defender XDR — what could this agent reach if compromised
  • Managing agents in the Microsoft 365 admin center

The exam’s angle is consistent: treat an agent as a principal with permissions, not as a feature.

Oversharing became an exposure. A Copilot that can read everything a user can read turns years of permissive sharing into immediate, searchable exposure:

  • Identifying overexposure of data in SharePoint
  • Identifying Copilot and AI app risks with Microsoft Purview DSPM

When a scenario describes users surfacing documents they technically may open but clearly should not, the answer is finding and fixing the overexposure — not blocking the AI tool.

AI workloads need their own protection and visibility:

  • Real-time protection for Copilot Studio agents
  • AI Gateway in Azure API Management for Microsoft Foundry — the control point in front of model traffic
  • Defender for AI Services in Cloud Workload Protection
  • Guardrails for agent security in Foundry
  • The Data and AI security dashboard in Defender for Cloud

Servers and virtual machines

Conventional and largely carried over from AZ-500:

  • Disk encryption; Azure Bastion for browser-based access without exposing RDP or SSH
  • Just-in-time VM access — ports opened on request, for a window, rather than standing open
  • Azure Arc to extend controls to hybrid and multicloud servers
  • Defender for Servers: onboarding including hybrid and multicloud, vulnerability scanning, EDR, and agentless scanning
  • VM security features: secure boot, vTPM, integrity monitoring, security type
  • Azure Machine Configuration to enforce in-guest configuration

Bastion and JIT are frequently paired in questions. Bastion removes the need for a public management endpoint; JIT limits when a port is open. A scenario worried about exposed RDP wants Bastion; one worried about standing open ports wants JIT.

Application platform services

  • Defender for Containers for misconfiguration and runtime risk
  • AKS, Container Registry, Container Instances and Container Apps security controls
  • Azure Functions, including authentication and network access
  • Logic Apps and App Service
  • Azure Web Application Firewall
  • Back-end API protection with API Management

Note that API Management appears twice in this domain — once for back-end API protection generally, and once as the AI Gateway for Foundry. That is not a coincidence: the exam treats APIM as the general-purpose control point in front of services, AI included.

Sample questions

Question 1. Administrators connect to production VMs over RDP from the internet. Security requires that no VM exposes a public management port, while administrators keep browser-based access. What should you deploy?

  • A. Just-in-time VM access on port 3389
  • B. An NSG rule restricting RDP to the office IP range
  • C. Azure Bastion
  • D. Disk encryption on all production VMs
Show answer

Answer: C

Azure Bastion provides browser-based RDP and SSH through the Azure portal without any public management port on the VM, which meets both halves of the requirement. Just-in-time access still opens a public port temporarily, an NSG rule restricts but does not remove exposure, and disk encryption protects data at rest rather than access.

Question 2. Your organisation is deploying agents built in Microsoft Foundry. Security wants a single enforcement point in front of model traffic, where policies, throttling and monitoring can be applied. What should you configure?

  • A. Azure Web Application Firewall in front of the Foundry endpoint
  • B. AI Gateway in Azure API Management for Microsoft Foundry
  • C. Azure Bastion for the Foundry resources
  • D. Disk encryption on the hosting infrastructure
Show answer

Answer: B

AI Gateway in Azure API Management is the objective describing a control point in front of Foundry model traffic where policy and monitoring are applied. A Web Application Firewall protects web applications rather than model APIs, Bastion is for administrative access, and disk encryption is unrelated.

Question 3. Security must be alerted to threats against AI services in your Azure subscriptions and see AI risks alongside other workload risks in one place. What should you enable?

  • A. Defender for AI Services, with the Data and AI security dashboard in Defender for Cloud
  • B. Purview DSPM for AI only
  • C. A conditional access policy on all AI resources
  • D. Resource locks on the AI resource group
Show answer

Answer: A

Defender for AI Services in Cloud Workload Protection provides threat protection for AI workloads, and the Data and AI security dashboard in Defender for Cloud surfaces those risks with the rest of the estate. Purview DSPM addresses data exposure in Microsoft 365 rather than Azure workload threat protection, conditional access governs sign-in, and a resource lock prevents changes.

What to practise

You can learn the servers and containers material from experience, but the AI objectives need deliberate time. Register an agent and look at what Entra Agent ID actually exposes. Open the Data and AI security dashboard in Defender for Cloud. Run a Purview DSPM assessment if you have a tenant with Copilot. These are all new surfaces, and seeing them once is worth more than reading the objective list five times.