The Best SC-500 Exam Study Material Premium Files and Preparation Tool (Oct-2026) [Q54-Q68]

October 5, 2026 admin 0

Rate this post

The Best SC-500 Exam Study Material Premium Files and Preparation Tool (Oct-2026)

Get Instant Access to SC-500 Practice Exam Questions

Microsoft SC-500 Exam Syllabus Topics:

Section	Weight	Objectives
Topic 1: Manage identity, access, and governance	20-25%	– Implement governance with Azure Policy and Defender for Cloud – Secure secrets and keys using Azure Key Vault – Secure access to resources using Microsoft Entra ID
Topic 2: Secure compute	20-25%	– Implement security for servers and virtual machines (VMs) – Implement security for application platform services – Implement security for AI workloads
Topic 3: Manage and monitor security posture	20-25%	– Implement activity and event collection in Microsoft Sentinel – Implement Microsoft Security Copilot configuration – Manage security posture using Microsoft Defender for Cloud
Topic 4: Secure storage, databases, and networking	25-30%	– Implement security for storage accounts – Implement security for databases – Implement security for Azure network services

QUESTION 54
Case Study 2 – Fabrikam, Inc.
Overview
Fabrikam, Inc. is a consulting company. The company has a main office in New York City and branch offices in Amsterdam and Singapore.
Existing Environment. Network environment
The on-premises network contains a datacenter in each office.
Existing Environment. Cloud environment
Fabrikam has two Azure subscriptions named Sub1 and Sub2 and a Microsoft 365 subscription that includes Microsoft 365 E5 licenses.
All the subscriptions are linked to a Microsoft Entra tenant named fabrikam.com that contains the identities shown in the following table.

The tenant contains the groups shown in the following table.

All devices are enrolled in Microsoft Intune.
Existing Environment. Sub1 Resources
Sub1 contains a resource group named RG1 that contains the resources shown in the following table.

SQLServer1 uses Microsoft SQL Server authentication.
Sub1 has an Azure Web Application Firewall (WAF) named WAF1 that has the following types of rule sets:
– Bot Manager 1.1
– Azure-managed Default Rule Set (DRS)
Sub1 has the following compliance standards assigned in Microsoft Defender for Cloud:
– NIST SP 800-53 Rev. 4
– Microsoft cloud security benchmark (MCSB)
– System and Organization Controls (SOC) 2 Type 2
Existing Environment. Sub2 Resources
Sub2 contains a resource group named RG2.
Planned Changes and Requirements. Planned Changes
Fabrikam plans to implement the following changes:
– Deploy the following key vaults to RG1:
AKV2 in the West Europe Azure region

AKV3 in the Central US Azure region

AKV4 in the East US Azure region

– Deploy the following key vaults to RG2:
AKV5 in the East US region

– Configure VM1 to read data from storage1.
– Create function apps that have the following hosting plans:
Fa1: Flex Consumption hosting plan

Fa2: Consumption hosting plan

Fa3: Dedicated hosting plan

– For WAF1, implement rate limiting rules based on the request
location.
– Enable the NIST SP 800-53 Rev. 5 compliance standard in Defender for
Cloud.
– Create a new storage account named storage2 that supports Azure Table storage.
– Enforce multifactor authentication (MFA) when database administrators access SQLdb1.
– Implement ExpressRoute circuits to the on-premises network as shown
in the following table.

– For RG1, create a new Privileged Identity Management (PIM) eligible role assignment that assigns the Contributor role to supported groups.
Planned Changes and Requirements. Technical Requirements
Fabrikam has the following technical requirements:
– If VM1 is deleted, the permissions for VM1 must be removed
automatically.
– The AKS1 managed identity must only be able to pull images from
Registry1.
– The ID1 managed identity must be able to push images to and pull
images from Registry1.
– All the data in the storage accounts must be encrypted by using
Fabrikam-managed keys.
– All outbound traffic from the function apps to the on-premises
network must use ExpressRoute circuits.
– ExpressRoute connectivity between the on-premises network and the
Azure environment must be encrypted by using Layer 2 or Layer 3
encryption.
You need to implement the function apps to meet the technical requirements. Which apps should you include in the implementation?

Fa1 and Fa2 only

Fa2 and Fa3 only

Fa1 and Fa3 only

Fa1, Fa2, and Fa3

QUESTION 55
You have an Azure subscription named Sub1 that contains a storage account named storage1 Sub1 has Microsoft Defender for Storage enabled. Defender for Storage has on-upload malware scanning enabled.
The security team at your company requires that all malicious files be processed automatically by a serverless workflow for quarantine and notification.
You need to ensure that the malware scan results trigger an automated response. The solution must minimize operational effort.
What should you configure?

An Azure Event Grid subscription

Diagnostic settings to send logs to a Log Analytics workspace

Lifecycle management policies

An Azure Monitor alert rule

QUESTION 56
You have an Azure API Management instance named APIM1 that publishes an API named OrdersAPI. Applications call OrdersAPI by using Microsoft Entra access tokens.
A security review finds that requests that do NOT contain a valid access token can still be forwarded to OrdersAPI.
You need to ensure that APIM1 rejects requests that do NOT contain a valid Microsoft Entra token before the requests reach OrdersAPI.
What should you configure?

the rate-limit-by-key policy

the set-backend-service policy

a subscription scope for OrdersAPI

the validate-jwt policy

QUESTION 57
Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem.
After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen.
You have a Microsoft Sentinel workspace.
You have a multi-tier Security Operations Center (SOC) team.
You need to ensure that all new security incidents are assigned immediately to the Tier 1 analysts group and flagged for triage.
Solution: You create an automation rule.
Does this meet the goal?

Yes

QUESTION 58
Drag and Drop Question
You have an Azure virtual network named VNet1 that contains an AzureBastionSubnet. VNet1 contains a subnet named Subnet1. Subnet1 contains multiple virtual machines.
You plan to deploy Azure Bastion to provide secure RDP access to the virtual machines on Subnet1. You associate a network security group (NSG) named NSG1 to AzureBastionSubnet.
You need to configure rules for NSG1. The solution must meet the following requirements:
– Allow required inbound access to Azure Bastion from the internet.
– Allow user access to the virtual machines by using Azure Bastion.
Which TCP ports should you allow for the NSG1 rules? To answer, drag the appropriate ports to the correct rules. Each port may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.

QUESTION 59
You have a management group named MG1 that contains two subscriptions named Sub1 and Sub2 Sub1 contains a resource group named RG-Exception and a resource group named RG1 that hosts Microsoft Foundry resources.
You need to assign an Azure policy to force new Foundry deployments in MG1 to use private endpoints. The solution must NOT restrict deployments in RG-Exception.
How should you configure the policy?

Assign the policy to MG1 and exclude RG-Exception.

Assign the policy to Sub1 and RG-Exception.

Assign the policy to MG1 and RG-Exception.

Assign the policy to Sub1 and exclude RG-Exception.

QUESTION 60
You have a Microsoft Sentinel workspace named Workspace1
You have 100 on-premises servers that run Linux and have the Azure Monitor Agent installed.
You need to collect Syslog events from the Linux servers. The solution must meet the following requirements:
*Ensure that filtering occurs before data is written to Workspace1
*Reduce ingestion costs by excluding low value Syslog messages.
What should you include in the solution?

An Advanced Security Information Model (ASIM) parser

A data collection rule (DCR)

An analytics rule

A table-level filter and split transformation

QUESTION 61
A company wants to continuously assess cloud resources for security weaknesses and regulatory compliance issues. Which Microsoft security service provides this capability?

Microsoft Defender for Cloud

Azure Front Door

Azure Backup

Azure Container Registry

QUESTION 62
You have an Azure management group named MG1 that contains two subscriptions named Sub1 and Sub2. Both subscriptions are linked to a Microsoft Entra tenant that contains a security group named Group1.
You need to ensure that the members of Group1 can assign roles to the resources in Sub1 and Sub2. The solution must follow the principle of least privilege.
Which role should you assign to Group1?

Contributor at the MG1 scope

Contributor at the Sub1 and Sub2 scopes

User Access Administrator at the MG1 scope

Owner at the MG1 scope

QUESTION 63
You have an Azure subscription named Sub1 that contains an Azure Database for PostgreSQL instance Sub1 has Microsoft Defender for Cloud enabled.
You need to configure Microsoft Defender for Databases to minimize costs.
Which Defender plan should you enable?

Microsoft Defender for Servers

Microsoft Defender for Open-Source Relational Databases

Microsoft Defender for SQL Servers on Machines

Microsoft Defender for Azure SQL Databases

Microsoft Defender for Storage

QUESTION 64
Case Study 2 – Fabrikam, Inc.
Overview
Fabrikam, Inc. is a consulting company. The company has a main office in New York City and branch offices in Amsterdam and Singapore.
Existing Environment. Network environment
The on-premises network contains a datacenter in each office.
Existing Environment. Cloud environment
Fabrikam has two Azure subscriptions named Sub1 and Sub2 and a Microsoft 365 subscription that includes Microsoft 365 E5 licenses.
All the subscriptions are linked to a Microsoft Entra tenant named fabrikam.com that contains the identities shown in the following table.

The tenant contains the groups shown in the following table.

All devices are enrolled in Microsoft Intune.
Existing Environment. Sub1 Resources
Sub1 contains a resource group named RG1 that contains the resources shown in the following table.

SQLServer1 uses Microsoft SQL Server authentication.
Sub1 has an Azure Web Application Firewall (WAF) named WAF1 that has the following types of rule sets:
– Bot Manager 1.1
– Azure-managed Default Rule Set (DRS)
Sub1 has the following compliance standards assigned in Microsoft Defender for Cloud:
– NIST SP 800-53 Rev. 4
– Microsoft cloud security benchmark (MCSB)
– System and Organization Controls (SOC) 2 Type 2
Existing Environment. Sub2 Resources
Sub2 contains a resource group named RG2.
Planned Changes and Requirements. Planned Changes
Fabrikam plans to implement the following changes:
– Deploy the following key vaults to RG1:
AKV2 in the West Europe Azure region

AKV3 in the Central US Azure region

AKV4 in the East US Azure region

– Deploy the following key vaults to RG2:
AKV5 in the East US region

– Configure VM1 to read data from storage1.
– Create function apps that have the following hosting plans:
Fa1: Flex Consumption hosting plan

Fa2: Consumption hosting plan

Fa3: Dedicated hosting plan

– For WAF1, implement rate limiting rules based on the request
location.
– Enable the NIST SP 800-53 Rev. 5 compliance standard in Defender for
Cloud.
– Create a new storage account named storage2 that supports Azure Table storage.
– Enforce multifactor authentication (MFA) when database administrators access SQLdb1.
– Implement ExpressRoute circuits to the on-premises network as shown
in the following table.

– For RG1, create a new Privileged Identity Management (PIM) eligible role assignment that assigns the Contributor role to supported groups.
Planned Changes and Requirements. Technical Requirements
Fabrikam has the following technical requirements:
– If VM1 is deleted, the permissions for VM1 must be removed
automatically.
– The AKS1 managed identity must only be able to pull images from
Registry1.
– The ID1 managed identity must be able to push images to and pull
images from Registry1.
– All the data in the storage accounts must be encrypted by using
Fabrikam-managed keys.
– All outbound traffic from the function apps to the on-premises
network must use ExpressRoute circuits.
– ExpressRoute connectivity between the on-premises network and the
Azure environment must be encrypted by using Layer 2 or Layer 3
encryption.
Hotspot Question
You need to implement the planned change for the PIM role assignment.
Which users can perform the planned change, and for which groups? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

QUESTION 65
You have a Microsoft Copilot Studio agent.
A Microsoft Power Platform administrator configures external threat detection for the agent by using a Microsoft Entra application.
You need to ensure that real-time protection is enabled during agent runtime.
What should you do in the Microsoft Defender portal?

Configure Microsoft Defender for Cloud Apps session policies.

Connect the Microsoft 365 app connector.

Enable Global Secure Access for Agents.

From Microsoft Sentinel, configure the Microsoft Purview data connector.

QUESTION 66
You have a Microsoft Entra tenant that uses Privileged Identity Management (PIM).
You need to modify the AI Administrator role settings to meet the following requirements:
*Elevated access must be evaluated by another administrator before it is granted
*Privileged access must be removed automatically after a fixed period.
Which two settings should you configure? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.

Expire active assignments after

Require approval to activate

Require justification on activation

Expire eligible assignments after

Activation maximum duration

QUESTION 67
Hotspot Question
You are implementing security controls for an Azure Storage account by using infrastructure as code (IaC).
You deploy the following Bicep code.

For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.

Explanation:
Box 1: No
No, a container in this storage account cannot be successfully configured for anonymous read access Why Anonymous Access is Blocked Even if you try to change the access policy settings at the individual container level, public anonymous access is fully prevented by two explicit configurations in your Bicep script:
allowBlobPublicAccess: false
This property acts as a strict, account-level security master switch.
Setting this to false overrides any container-level configurations. It completely blocks all anonymous public read access to all blobs and containers within this storage account.
defaultAction: ‘Deny’ (within networkAcls)This configuration enables the Azure Storage Firewall.
It blocks all incoming traffic by default, except for requests originating from the specific subnet listed under virtualNetworkRules or trusted AzureServices.
Because anonymous public requests come from the public internet (and not your private subnet), they will be automatically blocked by the firewall.
Box 2: Yes
Yes, a resource in the specified subnet can access the storage account
The provided Bicep template configures Azure Storage network security controls that explicitly permit this access route:defaultAction: ‘Deny’: This setting locks down the storage account, blocking all public internet traffic and traffic from unauthorized networks by default.
virtualNetworkRules: This block acts as a specific firewall exception list. By including the block
{ id: subnetResourceID }, you explicitly allow traffic originating from that exact subnet to bypass the default deny rule and connect to the storage account.
Box 3: No
No, a client connection originating from an unlisted public IP address cannot access the storage account.
Why Access is Denied
Default Network Action is Blocked: The Bicep configuration sets defaultAction: ‘Deny’ inside the networkAcls block. This establishes a firewall rule that blocks all network traffic by default unless explicitly allowed.
IP Address is Unlisted: Because the public IP address is unlisted, it does not match any allowed public IP rules (ipRules) in the configuration.
Virtual Network Restriction: The only network traffic allowed to bypass the firewall is traffic coming from the specific subnet defined in virtualNetworkRules and trusted AzureServices (via the bypass property).
TLS Version is Irrelevant Here: While the connection successfully uses TLS 1.2 (satisfying the minimumTlsVersion: ‘TLS1_2’ requirement), it fails the primary network firewall check first.

QUESTION 68
You have a Microsoft Entra tenant that contains a user named User1.
You have an Azure Arc-enabled server named SRV1 that runs Windows Server. SRV1 is configured for Microsoft Entra sign-in.
User1 reports that when they use their Microsoft Entra credentials to sign in to SRV1 over RDP, they receive the following message:
“Your account is configured to prevent you from using this device.”
You need to ensure that User1 can sign in to SRV1 over RDP. The solution must follow the principle of least privilege.
What should you do?

Assign User1 the Virtual Machine Administrator Login role for SRV1.

Create a Conditional Access policy that requires multifactor authentication (MFA).

Add User to the local Remote Desktop Users group on SRV1.

Assign User1 the Virtual Machine User Login role for SRV1.