SC-500 storage, databases and networking
Secure storage, databases, and networking is worth 25–30% of SC-500 — the largest domain, though only just. It is also the most conventional: this is classic Azure security engineering, largely unchanged from AZ-500 apart from two newer networking objectives.
Storage accounts
Four objectives: security configuration, storage firewall rules, Defender for Storage threat protection, and managing access including access policies.
The pattern the exam uses is layering. A storage account is not secured by one control:
- Network: firewall rules and private endpoints decide who can reach it.
- Authorisation: Entra identities and RBAC, or SAS and access policies, decide who can read it.
- Detection: Defender for Storage spots malicious activity such as unusual access or malware upload.
Questions usually describe a gap in one layer while the others are fine. Identify which layer the scenario is actually about.
Databases
Three objectives: platform-level security in Azure SQL, auditing for Azure SQL Database and SQL Managed Instance, and Defender for Databases across Azure database services.
Keep the three straight. Platform-level configuration is prevention. Auditing is the record of what happened. Defender for Databases is detection of threats such as SQL injection or anomalous access. A question asking “how would you know this occurred” wants auditing; “how would you be alerted” wants Defender.
Networking
The longest list in the domain, and where the newer material sits:
| Control | What it is for |
|---|---|
| NSGs and ASGs | Filtering traffic; ASGs group workloads so rules follow the role, not the IP |
| Azure Virtual Network Manager | Network access policies at scale across many networks |
| Virtual WAN security | Securing a hub-and-spoke WAN topology |
| VPN security | Securing site-to-site and point-to-site connections |
| Microsoft Entra Private Access | Identity-centric access to private apps without a classic VPN |
| Private endpoints | Giving a PaaS resource an address inside your VNet |
| Private Link services | Exposing your own service privately to consumers |
| Azure Firewall | Centralised, stateful egress and inspection |
| Network Watcher diagnostics | Evaluating effective security rules when they conflict |
Three distinctions the exam leans on:
Private endpoint versus service firewall. A firewall rule still leaves a public endpoint that merely refuses most callers. A private endpoint removes public reachability. Requirements phrased as “must not traverse the public internet” want the private endpoint.
Private endpoint versus Private Link service. A private endpoint is how you consume a service privately. A Private Link service is how you publish your own service for others to consume privately.
NSG versus Azure Firewall. NSGs filter at the subnet or interface with simple rules. Azure Firewall is centralised, application-aware and the answer for controlled egress.
Finally, Network Watcher effective security rules is the answer whenever a scenario says traffic is blocked or allowed unexpectedly and nobody can work out which rule is winning.
Sample questions
Question 1. An application team reports that traffic to a VM is being blocked, but they believe their NSG rule allows it. Several NSGs apply at subnet and interface level. What should you use to determine what is actually in force?
- A. Add a broader allow rule and see whether traffic flows
- B. Deploy Azure Firewall in front of the subnet
- C. Delete the subnet NSG and test again
- D. Evaluate effective security rules using Network Watcher diagnostics
Show answer
Answer: D
Network Watcher effective security rules shows the combined result of all applicable NSGs, which is exactly what is needed when overlapping rules make the outcome unclear. Adding a rule guesses at the cause, Azure Firewall is a different control, and deleting NSGs removes protection rather than diagnosing it.
Question 2. Your organisation publishes an internal service running behind a standard load balancer, and partner organisations must reach it privately from their own Azure networks, without exposure to the internet. What should you configure?
- A. A private endpoint in your own virtual network
- B. An Azure Private Link service in front of the load balancer
- C. A public IP address restricted by Azure Firewall rules
- D. A site-to-site VPN gateway to each partner
Show answer
Answer: B
A Private Link service is how you publish your own service for private consumption by others, which matches publishing to partners. A private endpoint is how a consumer reaches a service, a public IP with a firewall still exposes the internet surface, and a VPN gateway builds a different kind of connection than the requirement describes.
Question 3. Auditors ask who read a particular table in an Azure SQL Database last quarter. Which capability provides that record?
- A. Database auditing configured on the Azure SQL Database
- B. Defender for Databases threat alerts
- C. A private endpoint on the database
- D. Encryption at rest on the database
Show answer
Answer: A
Database auditing records data access events and is the objective that produces a retrospective record of who did what. Defender for Databases alerts on threats rather than providing a full audit trail, a private endpoint controls reachability, and transparent encryption protects data at rest without logging access.
What to practise
Build one storage account and one SQL database, then lock each down three ways: network, authorisation and detection. Add a private endpoint and confirm the public endpoint is genuinely gone. Then deliberately create two conflicting NSG rules and use Network Watcher to work out which one wins. That last exercise teaches a question type that appears on almost every sitting.