Microsoft SC-500 Practice Questions with Explanations
Free Microsoft SC-500 practice questions. 24 of them, each with the correct answer, a full explanation, and the reason every other option is wrong. These are real questions from the SC-500 exam, not paraphrases, and every explanation is written out rather than just marking the right letter.
They are drawn from the same bank as the full SC-500 pack, which has 121 questions in total.
Get the full SC-500 question bank (121 questions) →
SC-500 practice questions
Question 1
You have an Azure SQL Database logical server named Server1 that contains a database named DB1. You need to configure authentication for Server1 to meet the following requirements: SQL authentication cannot be used for any databases on Server1. The solution must be enforced centrally at the server level. What should you do?
- A. Configure a Microsoft Entra administrator for Server1.
- B. Enable a managed identity for Server1.
- C. Enable Microsoft Entra-only authentication for Server1.
- D. Remove SQL logins from DB1.
Show answer and explanation ▾
Correct answer: C
Microsoft Entra-only authentication is a server-level setting on the Azure SQL logical server. Once enabled, the server refuses every SQL authentication connection across all of its databases, while existing SQL logins stay in place. That is exactly what the requirements ask for: SQL authentication unusable for any database on Server1, enforced centrally in one place rather than database by database.
Why the other options are wrong:
- A. Adding a Microsoft Entra administrator enables Entra authentication alongside SQL authentication. It permits the new method but never disables the old one.
- B. A managed identity gives Server1 an identity for reaching out to other Azure resources. It has no bearing on how clients authenticate inbound to the server.
- D. Removing SQL logins from DB1 is a per-database action that leaves other databases untouched and does not stop new SQL logins being created later. It fails the central enforcement requirement.
Question 2
You have a Microsoft Entra tenant that has the following configurations: User consent for applications is disabled. Only administrators can grant permissions to applications. You register an application named App1 that uses delegated Microsoft Graph permissions. You need to configure App1 to meet the following requirements: Enable user sign-ins without interactive consent prompts. Enable App1 to access Microsoft Graph on behalf of the signed-in user. What should you do?
- A. Configure enterprise applications to require user assignment and assign users to App1.
- B. Modify the app registration to use application permissions instead of delegated permissions.
- C. Add the required delegated Microsoft Graph permissions to the app registration and rely on user consent during sign-in.
- D. Grant admin consent to App1 for the required delegated permissions.
Show answer and explanation ▾
Correct answer: D
User consent is disabled tenant-wide, so a user can never approve the delegated permissions themselves and would be blocked at sign-in. Granting tenant-wide admin consent pre-approves the delegated Microsoft Graph permissions on behalf of the whole organization. Users then sign in with no interactive consent prompt, and because the permissions remain delegated, App1 still calls Graph as the signed-in user.
Why the other options are wrong:
- A. Requiring user assignment controls which users are allowed to access App1. It governs access, not consent, so the consent prompt still blocks sign-in.
- B. Application permissions run as the app itself with no signed-in user, which breaks the requirement that App1 act on behalf of the user.
- C. Relying on user consent during sign-in is precisely what the tenant configuration forbids, so sign-in fails.
Question 3
You have two management groups named MG1 and MG2 that contain multiple Azure subscriptions. The subscriptions are linked to a Microsoft Entra tenant. You have a user named User1 and a global administrator named Admin1. You are informed that User1 created an Azure subscription named Sub1 under the MG2 management group and is the only owner of the subscription. You need to ensure that Admin1 can remove the Owner role from User1 for Sub1. What should you do first?
- A. Move Sub1 to MG1.
- B. Assign Admin1 the User Access Administrator role for Sub1.
- C. Instruct Admin1 to use Privileged Identity Management (PIM) to request the Security Administrator role.
- D. Instruct Admin1 to enable Access management for Azure resources.
Show answer and explanation ▾
Correct answer: D
A Global Administrator has no Azure RBAC permission over subscriptions by default, which is why Admin1 cannot touch the Owner assignment. Enabling Access management for Azure resources elevates the Global Administrator and assigns them User Access Administrator at the root scope, covering every management group and subscription in the tenant. From there Admin1 can manage role assignments on Sub1.
Why the other options are wrong:
- A. Moving Sub1 between management groups changes where it sits in the hierarchy but grants Admin1 no permission over it.
- B. Assigning that role on Sub1 requires someone who already has role-assignment rights there, and User1 is the only owner. This is the problem, not the fix.
- C. Security Administrator is a Microsoft Entra role. It carries no Azure RBAC write permission over subscriptions.
Question 4
You have a management group named MG1 that contains two subscriptions named Sub1 and Sub2. Sub1 contains a resource group named RG-Exception and a resource group named RG1 that hosts Microsoft Foundry resources. You need to assign an Azure policy to force new Foundry deployments in MG1 to use private endpoints. The solution must NOT restrict deployments in RG-Exception. How should you configure the policy?
- A. Assign the policy to MG1 and exclude RG-Exception.
- B. Assign the policy to Sub1 and RG-Exception.
- C. Assign the policy to MG1 and RG-Exception.
- D. Assign the policy to Sub1 and exclude RG-Exception.
Show answer and explanation ▾
Correct answer: A
Assigning the policy at the management group means it flows down to every subscription and resource group under MG1, including ones created later. An exclusion on RG- Exception carves that single scope out of the assignment, so deployments there are unaffected while everything else is forced onto private endpoints.
Why the other options are wrong:
- B. Assigning to Sub1 covers only that subscription and misses Sub2 and any future subscription. Naming RG-Exception as a target enforces the policy there rather than exempting it.
- C. Adding RG-Exception as an assignment scope applies the policy to it. Exclusion, not assignment, is what exempts a scope.
- D. The exclusion is right but the scope is wrong. Assigning at Sub1 leaves the rest of MG1 unprotected.
Question 5
You have an Azure key vault named KV1 that uses role-based access control (RBAC) authorization. KV1 stores database connection strings for an Azure App Service web app named App1. You enable a firewall on KV1 and allow access to KV1 from only the virtual network that contains App1. You need to ensure that App1 can retrieve secrets from KV1 without using credentials stored in the application configuration. What should you create?
- A. an access policy for KV1
- B. an app registration for App1
- C. a private endpoint for KV1
- D. a managed identity for App1
Show answer and explanation ▾
Correct answer: D
A managed identity gives App1 an identity in Microsoft Entra ID that Azure manages, with no secret stored anywhere in the app configuration. App1 requests a token for Key Vault with that identity and reads the secret, which is what the credential-free requirement demands. The firewall already permits the app virtual network, so network access is not the missing piece.
Why the other options are wrong:
- A. KV1 uses RBAC authorization, so access policies are not in effect. An access policy also does nothing about where credentials are stored.
- B. An app registration needs a client secret or certificate that lives in the application configuration, which is the exact thing being eliminated.
- C. A private endpoint changes the network path to KV1. Traffic from the virtual network is already allowed, and a network path is not an identity.
Question 6
You have a Microsoft Entra tenant that has user consent for applications disabled. You register an application named App1 that requests the following Microsoft Graph delegated permissions: • User.Read • Mail.Read You need to configure tenant permissions to meet the following requirements: Enable users to grant consent for low-risk permissions without administrator interaction. Ensure that applications requesting higher-privilege permissions require administrator approval. What should you do?
- A. Grant tenant-wide admin consent to App1.
- B. Configure application assignments for App1.
- C. Configure Privileged Identity Management (PIM) role assignments.
- D. Create an app consent policy.
Show answer and explanation ▾
Correct answer: D
An app consent policy defines which permissions users are allowed to consent to on their own and which ones must be escalated to an administrator. Classifying low-risk delegated permissions lets users self-consent, while anything outside that classification falls through to the admin consent workflow. One policy delivers both halves of the requirement and applies tenant-wide rather than to a single app.
Why the other options are wrong:
- A. Tenant-wide admin consent approves permissions for App1 alone. It sets no rule for other applications and does not let users consent to anything.
- B. Application assignments decide which users may use an app. They have no effect on what permissions can be consented to.
- C. PIM governs privileged directory and Azure role activation, not application permission consent.
Question 7
You have an Azure management group named MG1 that contains two subscriptions named Sub1 and Sub2. Both subscriptions are linked to a Microsoft Entra tenant that contains a security group named Group1. You need to ensure that the members of Group1 can assign roles to the resources in Sub1 and Sub2. The solution must follow the principle of least privilege. Which role should you assign to Group1?
- A. Contributor at the MG1 scope
- B. Contributor at the Sub1 and Sub2 scopes
- C. User Access Administrator at the MG1 scope
- D. Owner at the MG1 scope
Show answer and explanation ▾
Correct answer: C
Assigning roles requires the Microsoft.Authorization/roleAssignments/write permission, which User Access Administrator carries and Contributor does not. Granting it at MG1 covers both Sub1 and Sub2 in a single assignment. It is the least privileged built-in role that can delegate access, since it adds no rights to manage the resources themselves.
Why the other options are wrong:
- A. Contributor can create and manage resources but is explicitly denied role assignment permissions at any scope.
- B. Contributor still cannot assign roles, and splitting it across two subscriptions adds administrative overhead without adding the missing permission.
- D. Owner would work but bundles full resource management with role assignment, which exceeds what the task requires.
Question 8
Overview Fabrikam, Inc. is a consulting company. The company has a main office in New York City and branch offices in Amsterdam and Singapore. Existing Environment. Network environment The on-premises network contains a datacenter in each office. Existing Environment. Cloud environment Fabrikam has two Azure subscriptions named Sub1 and Sub2 and a Microsoft 365 subscription that includes Microsoft 365 E5 licenses. All the subscriptions are linked to a Microsoft Entra tenant named fabrikam.com that contains the identities shown in the following table. The tenant contains the groups shown in the following table. All devices are enrolled in Microsoft Intune. Existing Environment. Sub1 Resources Sub1 contains a resource group named RG1 that contains the resources shown in the following table. SQLServer1 uses Microsoft SQL Server authentication. Sub1 has an Azure Web Application Firewall (WAF) named WAF1 that has the following types of rule sets: • Bot Manager 1.1 • Azure-managed Default Rule Set (DRS) Sub1 has the following compliance standards assigned in Microsoft Defender for Cloud: • NIST SP 800-53 Rev. 4 • Microsoft cloud security benchmark (MCSB) • System and Organization Controls (SOC) 2 Type 2 • Existing Environment. Sub2 Resources Sub2 contains a resource group named RG2. Planned Changes and Requirements. Planned Changes Fabrikam plans to implement the following changes: Deploy the following key vaults to RG1: • AKV2 in the West Europe Azure region • AKV3 in the Central US Azure region AKV4 in the East US Azure region Deploy the following key vaults to RG2: AKV5 in the East US region - Configure VM1 to read data from storage1. Create function apps that have the following hosting plans: • Fa1: Flex Consumption hosting plan • Fa2: Consumption hosting plan • Fa3: Dedicated hosting plan For WAF1, implement rate limiting rules based on the request location. Enable the NIST SP 800-53 Rev. 5 compliance standard in Defender for Cloud. Create a new storage account named storage2 that supports Azure Table storage. Enforce multifactor authentication (MFA) when database administrators access SQLdb1. Implement ExpressRoute circuits to the on-premises network as shown in the following table. For RG1, create a new Privileged Identity Management (PIM) eligible role assignment that assigns the Contributor role to supported groups. Planned Changes and Requirements. Technical Requirements Fabrikam has the following technical requirements: If VM1 is deleted, the permissions for VM1 must be removed automatically. The AKS1 managed identity must only be able to pull images from Registry1. The ID1 managed identity must be able to push images to and pull images from Registry1. All the data in the storage accounts must be encrypted by using Fabrikam-managed keys. All outbound traffic from the function apps to the on-premises network must use ExpressRoute circuits. ExpressRoute connectivity between the on-premises network and the Azure environment must be encrypted by using Layer 2 or Layer 3 encryption. You need to implement the planned change for storage2. The solution must meet the technical requirements for storage encryption. What should you do?
- A. Enable purge protection for storage2.
- B. Create an encryption scope in storage2.
- C. Configure storage2 to use an account encryption key.
- D. Assign an Azure role-based access control (Azure RBAC) role to storage2.
Show answer and explanation ▾
Correct answer: C
Fabrikam-managed keys means customer-managed keys, and for a storage account those are applied by pointing the account encryption key at a key held in Key Vault. That setting encrypts every service in the account, which matters here because storage2 is being created for Azure Table storage.
Why the other options are wrong:
- A. Purge protection is a Key Vault setting and a prerequisite for using customer- managed keys. It is not itself the encryption configuration, and it is not applied to a storage account.
- B. Encryption scopes apply only to blob containers and individual blobs. They cannot be used for Table storage.
- D. An Azure RBAC role controls who can reach the data. It has no effect on which key encrypts it.
Question 9
You have an Azure SQL Database logical server named Server1 that contains multiple databases. The databases contain legacy SQL authentication logins that must no longer be usable for sign-in but must NOT be removed from the databases. You need to ensure that SQL authentication is denied for connections. What should you do?
- A. Run create USER ... FROM EXTERNAL PROVIDER on each database.
- B. Create a Conditional Access policy.
- C. Enable Microsoft Entra-only authentication for Server1.
- D. Assign the SQL Server Contributor role to Server1.
Show answer and explanation ▾
Correct answer: C
Enabling Microsoft Entra-only authentication on Server1 makes the server reject all SQL authentication connections while leaving the legacy logins present in the databases. The accounts remain for auditing and future reference but can no longer be used to sign in, which is exactly the split the requirements describe.
Why the other options are wrong:
- A. Creating users from an external provider adds Microsoft Entra principals to a database. It does not block the SQL logins that already exist.
- B. Conditional Access evaluates Microsoft Entra sign-ins. SQL authentication never reaches Entra, so no policy can be applied to it.
- D. SQL Server Contributor is a management-plane role for administering the server resource, not a control over authentication methods.
Question 10
You have an Azure subscription named Sub1 that contains an Azure Database for PostgreSQL instance. Sub1 has Microsoft Defender for Cloud enabled. You need to configure Microsoft Defender for Databases to minimize costs. Which Defender plan should you enable?
- A. Microsoft Defender for Servers
- B. Microsoft Defender for Open-Source Relational Databases
- C. Microsoft Defender for SQL Servers on Machines
- D. Microsoft Defender for Azure SQL Databases
- E. Microsoft Defender for Storage
Show answer and explanation ▾
Correct answer: B
Azure Database for PostgreSQL is an open-source relational engine, so Microsoft Defender for Open-Source Relational Databases is the plan built for it. It is the narrowest plan that covers the workload, which keeps cost to a minimum because no other resource type is enrolled.
Why the other options are wrong:
- A. Defender for Servers protects virtual machines and is billed per server. It does not cover a PaaS database.
- C. Defender for SQL Servers on Machines covers SQL Server installed on virtual machines, not managed PostgreSQL.
- D. Defender for Azure SQL Databases covers Azure SQL Database and SQL Managed Instance only.
- E. Defender for Storage protects storage accounts and has no database coverage.
Question 11
You have an Azure Storage account named storage1 that contains Azure Files shares. You have an application named App1 that uses a system-assigned managed identity to access the shares. Administrators access the shares by using storage account keys. You need to ensure that App1 access the shares without using the storage account keys. What should you do on storage1?
- A. Store the storage account access keys in Azure Key Vault and regenerate them periodically.
- B. Set Allow storage account key access to Disabled.
- C. Select Default to Microsoft Entra authorization in the Azure portal.
- D. Assign the Storage File Data Privileged Reader role to the managed identity of App1.
Show answer and explanation ▾
Correct answer: D
Azure Files supports Microsoft Entra authorization for share access through built-in RBAC roles. Assigning Storage File Data Privileged Reader to the system-assigned managed identity gives App1 read access to the share data using its own identity, so no storage account key appears anywhere in the application.
Why the other options are wrong:
- A. Storing keys in Key Vault and rotating them still means App1 authenticates with a storage account key. The requirement is to stop using keys at all.
- B. Disabling key access removes the administrators current access method and still grants App1 nothing. Data-plane authorization has to be assigned before keys are turned off.
- C. Defaulting to Microsoft Entra authorization changes how the Azure portal browses data. It does not grant App1 any permission.
Question 12
You have an Azure subscription named Sub1 that contains a storage account named storage1. Sub1 has Microsoft Defender for Storage enabled. Defender for Storage has malware scanning enabled. You need to configure a solution that automates the remediation of malware detected in storage1. What should you include in the solution?
- A. Application Insights
- B. Azure Event Hubs
- C. Azure Event Grid
- D. Azure Policy
Show answer and explanation ▾
Correct answer: C
Defender for Storage malware scanning publishes its scan results as events to Azure Event Grid. Subscribing to that topic lets you trigger a Logic App or Function that deletes, quarantines, or tags the infected blob automatically, which is the pattern Microsoft documents for automated response.
Why the other options are wrong:
- A. Application Insights collects application telemetry and traces. It has no hook into malware scan results.
- B. Event Hubs is a high-throughput ingestion pipeline for streaming telemetry. Malware scan results are surfaced through Event Grid instead.
- D. Azure Policy evaluates and enforces resource configuration. It cannot act on the contents of an individual blob.
Question 13
You have an Azure virtual network that contains 100 virtual machines and an Azure Firewall instance named FW1. All the traffic from the virtual machines is routed through FW1. You need to ensure that FW1 allows access to only a URL of updates.contoso.com and blocks all other outbound traffic. What should you use?
- A. an inbound NAT rule
- B. an application rule
- C. an outbound NAT rule
- D. a network rule
Show answer and explanation ▾
Correct answer: B
Filtering outbound traffic by URL or fully qualified domain name requires an application rule, because only application rules inspect the HTTP host header and URL path. Permitting updates.contoso.com in an application rule and leaving everything else unmatched means the firewall default deny takes care of the rest.
Why the other options are wrong:
- A. An inbound NAT rule translates and forwards traffic arriving at the firewall. The requirement concerns outbound traffic.
- C. Azure Firewall performs source NAT on outbound traffic automatically. There is no outbound NAT rule type, and NAT does not filter by URL.
- D. A network rule matches on IP address, port, and protocol. It cannot express a URL, so it cannot restrict access to a single web address.
Question 14
You use Azure Virtual Network Manager to manage multiple virtual networks in a network group named Group1. You discover that the virtual machines in Group1 are accessible from the internet by using TCP port 3389. You need to block inbound TCP 3389 from the internet across all the virtual networks in Group1. The solution must minimize administrative effort. What should you use?
- A. a connectivity configuration
- B. a security admin configuration
- C. a user-defined route (UDR)
- D. a network security group (NSG)
Show answer and explanation ▾
Correct answer: B
A security admin configuration in Azure Virtual Network Manager lets you write a high- priority rule once and have it enforced across every virtual network in the target network group. A deny rule for inbound TCP 3389 from Internet applied to Group1 covers all current members and any virtual network added later. Security admin rules are evaluated before network security groups, so an existing permissive NSG cannot override the block.
Why the other options are wrong:
- A. A connectivity configuration builds the topology between virtual networks, such as a mesh or hub and spoke. It does not filter traffic.
- C. A user-defined route changes where packets are sent next. It cannot deny traffic, and it would have to be maintained per subnet.
- D. A network security group would work but has to be created and kept in sync on every virtual network or subnet individually, which is the administrative effort the question asks you to avoid. It is also overridden by security admin rules.
Question 15
You have an Azure subscription. You need to deploy an Azure virtual WAN to meet the following requirements: Create three secured virtual hubs located in the East US, West US, and North Europe Azure regions. Ensure that security rules sync between the regions. What should you use?
- A. Azure Network Function Manager
- B. Azure Firewall Manager
- C. Azure Virtual Network Manager
- D. Azure Front Door
Show answer and explanation ▾
Correct answer: B
Azure Firewall Manager is the service that converts a Virtual WAN hub into a secured virtual hub by deploying Azure Firewall into it. Rules live in an Azure Firewall policy, and one policy can be attached to the hubs in East US, West US, and North Europe at once, so a rule change propagates to all three regions from a single place.
Why the other options are wrong:
- A. Azure Network Function Manager deploys third-party network functions to Azure Stack Edge. It does not secure Virtual WAN hubs.
- C. Azure Virtual Network Manager groups and connects virtual networks and applies security admin rules. It does not create secured virtual hubs in a Virtual WAN.
- D. Azure Front Door is a global HTTP load balancer and CDN with a web application firewall. It has no role in Virtual WAN hub security.
Question 16
You have an Azure Storage account named storage1 that hosts a blob container named container1. You have an Azure Functions app named app1 that uses a managed identity. You need to configure app1 to read, write, and delete blobs in container1. The solution must follow the principle of least privilege. What should you do?
- A. Assign the Storage Account Contributor role to the managed identity of app1 at the scope of storage1.
- B. Assign the Storage Blob Delegator role to the managed identity of App1 at the scope of container1.
- C. Assign the Owner role to the managed identity of App1 at the scope of container1.
- D. Assign the Storage Blob Data Contributor role to the managed identity of App1 at the scope of container1.
Show answer and explanation ▾
Correct answer: D
Reading, writing, and deleting blobs are data-plane operations, and Storage Blob Data Contributor is the built-in role that grants exactly those. Assigning it at the scope of container1 rather than the whole storage account narrows the grant to the one container app1 actually needs, which satisfies least privilege on both the permission set and the scope.
Why the other options are wrong:
- A. Storage Account Contributor is a management-plane role. It allows managing the account and reading its keys, which is far more than reading blobs, and it does not grant data access on its own.
- B. Storage Blob Delegator only allows requesting a user delegation key for generating SAS tokens. It grants no read, write, or delete access to blob data.
- C. Owner grants full control including role assignment. It vastly exceeds what the app needs.
Question 17
You have an Azure subscription named Sub1 that contains a storage account named storage1. Sub1 has Microsoft Defender for Storage enabled. Defender for Storage has on-upload malware scanning enabled. The security team at your company requires that all malicious files be processed automatically by a serverless workflow for quarantine and notification. You need to ensure that the malware scan results trigger an automated response. The solution must minimize operational effort. What should you configure?
- A. an Azure Event Grid subscription
- B. diagnostic settings to send logs to a Log Analytics workspace
- C. lifecycle management policies
- D. an Azure Monitor alert rule
Show answer and explanation ▾
Correct answer: A
Defender for Storage publishes on-upload malware scan results directly to Azure Event Grid. An Event Grid subscription routes those events straight to a serverless target such as a Logic App or Function, which then quarantines the blob and sends the notification. Because the integration is native, there is nothing to poll and no glue code to maintain.
Why the other options are wrong:
- B. Sending logs to Log Analytics makes the results queryable after the fact. It stores data rather than triggering a workflow.
- C. Lifecycle management policies move or delete blobs on an age-based schedule. They cannot react to a scan verdict.
- D. An Azure Monitor alert rule runs on a query schedule and adds latency and configuration overhead compared to the native Event Grid events.
Question 18
Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem. After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen. You have an Azure subscription that contains two virtual machines named VM1 and VM2. Each virtual machine has system-assigned managed identity enabled. You have an Azure Storage account named storage1. Public access from all networks is enabled for storage1. You need to ensure that VM1 and VM2 can access storage1. Solution: You create a user-assigned managed identity, assign the identity to each virtual machine, and then add each managed identity to a role on storage1. Does this meet the goal?
- A. Yes
- B. No
Show answer and explanation ▾
Correct answer: A
A user-assigned managed identity is a standalone Microsoft Entra principal that can be attached to more than one virtual machine. Assigning it to VM1 and VM2 and then granting that identity an appropriate role on storage1 gives both machines authorized access. Public network access is already enabled, so the only missing piece was authorization, and this solution supplies it.
Why the other options are wrong:
- B. The solution does work. A user-assigned identity can be shared across virtual machines and granted a role on the storage account, which is a supported and common pattern.
Question 19
Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem. After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen. You have an Azure subscription that contains two virtual machines named VM1 and VM2. Each virtual machine has system-assigned managed identity enabled. You have an Azure Storage account named storage1. Public access from all networks is enabled for storage1. You need to ensure that VM1 and VM2 can access storage1. Solution: You add each virtual machine to a role on storage1. Does this meet the goal?
- A. Yes
- B. No
Show answer and explanation ▾
Correct answer: A
Both virtual machines already have system-assigned managed identities enabled, and those identities are selectable as role assignment principals. Adding each virtual machine to a role on storage1 grants its system-assigned identity that role, which is all that is needed because the storage account already permits public network access.
Why the other options are wrong:
- B. The solution does work. With system-assigned managed identity enabled, the virtual machine itself appears as an assignable principal when you add a role assignment on storage1.
Question 20
Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem. After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen. You have an Azure subscription that contains two virtual machines named VM1 and VM2. Each virtual machine has system-assigned managed identity enabled. You have an Azure Storage account named storage1. Public access from all networks is enabled for storage1. You need to ensure that VM1 and VM2 can access storage1. Solution: You add each virtual machine to a security group, and then add the security group to a role on storage1. Does this meet the goal?
- A. Yes
- B. No
Show answer and explanation ▾
Correct answer: A
Managed identities are service principals in Microsoft Entra ID, and service principals can be members of a security group. Placing VM1 and VM2 in a group and assigning the group a role on storage1 gives both machines access through a single assignment, and any virtual machine added to the group later inherits it.
Why the other options are wrong:
- B. The solution does work. Microsoft Entra security groups accept service principals, including the managed identities of virtual machines, so a group-based role assignment reaches both machines.
Question 21
Note: This section contains one or more sets of questions with the same scenario and problem. Each question presents a unique solution to the problem. You must determine whether the solution meets the stated goals. More than one solution in the set might solve the problem. It is also possible that none of the solutions in the set solve the problem. After you answer a question in this section, you will NOT be able to return. As a result, these questions do not appear on the Review Screen. You have an Azure subscription that contains two virtual machines named VM1 and VM2. Each virtual machine has system-assigned managed identity enabled. You have an Azure Storage account named storage1. Public access from all networks is enabled for storage1. You need to ensure that VM1 and VM2 can access storage1. Solution: You create a private endpoint on storage1. Does this meet the goal?
- A. Yes
- B. No
Show answer and explanation ▾
Correct answer: B
A private endpoint only changes the network path, giving storage1 a private IP inside a virtual network. Public access from all networks is already enabled, so the virtual machines can already reach the account on the network. What they lack is an RBAC role or key granting them permission to the data, and a private endpoint grants no permission at all.
Why the other options are wrong:
- A. The solution does not work. Network reachability was never the obstacle here, and a private endpoint performs no authorization.
Question 22
Overview Fabrikam, Inc. is a consulting company. The company has a main office in New York City and branch offices in Amsterdam and Singapore. Existing Environment. Network environment The on-premises network contains a datacenter in each office. Existing Environment. Cloud environment Fabrikam has two Azure subscriptions named Sub1 and Sub2 and a Microsoft 365 subscription that includes Microsoft 365 E5 licenses. All the subscriptions are linked to a Microsoft Entra tenant named fabrikam.com that contains the identities shown in the following table. The tenant contains the groups shown in the following table. All devices are enrolled in Microsoft Intune. Existing Environment. Sub1 Resources Sub1 contains a resource group named RG1 that contains the resources shown in the following table. SQLServer1 uses Microsoft SQL Server authentication. Sub1 has an Azure Web Application Firewall (WAF) named WAF1 that has the following types of rule sets: • Bot Manager 1.1 • Azure-managed Default Rule Set (DRS) Sub1 has the following compliance standards assigned in Microsoft Defender for Cloud: • NIST SP 800-53 Rev. 4 • Microsoft cloud security benchmark (MCSB) • System and Organization Controls (SOC) 2 Type 2 • Existing Environment. Sub2 Resources Sub2 contains a resource group named RG2. Planned Changes and Requirements. Planned Changes Fabrikam plans to implement the following changes: Deploy the following key vaults to RG1: • AKV2 in the West Europe Azure region • AKV3 in the Central US Azure region • AKV4 in the East US Azure region Deploy the following key vaults to RG2: AKV5 in the East US region - Configure VM1 to read data from storage1. Create function apps that have the following hosting plans: • Fa1: Flex Consumption hosting plan • Fa2: Consumption hosting plan • Fa3: Dedicated hosting plan For WAF1, implement rate limiting rules based on the request location. Enable the NIST SP 800-53 Rev. 5 compliance standard in Defender for Cloud. Create a new storage account named storage2 that supports Azure Table storage. Enforce multifactor authentication (MFA) when database administrators access SQLdb1. Implement ExpressRoute circuits to the on-premises network as shown in the following table. For RG1, create a new Privileged Identity Management (PIM) eligible role assignment that assigns the Contributor role to supported groups. Planned Changes and Requirements. Technical Requirements Fabrikam has the following technical requirements: If VM1 is deleted, the permissions for VM1 must be removed automatically. The AKS1 managed identity must only be able to pull images from Registry1. The ID1 managed identity must be able to push images to and pull images from Registry1. All the data in the storage accounts must be encrypted by using Fabrikam-managed keys. All outbound traffic from the function apps to the on-premises network must use ExpressRoute circuits. ExpressRoute connectivity between the on-premises network and the Azure environment must be encrypted by using Layer 2 or Layer 3 encryption. You need to implement the function apps to meet the technical requirements. Which apps should you include in the implementation?
- A. Fa1 and Fa2 only
- B. Fa2 and Fa3 only
- C. Fa1 and Fa3 only
- D. Fa1, Fa2, and Fa3
Show answer and explanation ▾
Correct answer: C
Routing outbound function app traffic to the on-premises network over ExpressRoute requires virtual network integration. The Flex Consumption plan used by Fa1 and the Dedicated plan used by Fa3 both support it. The legacy Consumption plan used by Fa2 does not, so Fa2 cannot meet the outbound traffic requirement and is excluded.
Why the other options are wrong:
- A. Fa2 runs on the Consumption plan, which has no virtual network integration, so its outbound traffic cannot be forced over ExpressRoute.
- B. Fa2 cannot satisfy the requirement, and leaving Fa1 out discards a plan that can.
- D. Including all three is wrong because Fa2 on the Consumption plan cannot integrate with a virtual network.
Question 23
Overview Contoso, Ltd. is a consulting company that has a main office in San Francisco and a branch office in Dallas. Contoso has a hybrid environment that contains on-premises servers connected to Azure, a Microsoft 365 E5 subscription, and an Azure subscription named Sub1. Existing Environment. Microsoft Entra tenant Contoso has a Microsoft Entra tenant named contoso.com that contains the users shown in the following table. Existing Environment. On-premises environment The on-premises network contains an Active Directory Domain Services (AD DS) forest that syncs with contoso.com. The forest contains a server named Server1 that runs Windows Server. Existing Environment. Azure subscription Sub1 contains the storage accounts shown in the following table. Sub1 contains the virtual networks shown in the following table. Sub1 contains the virtual machines shown in the following table. The network interface of VM1 is associated with an application security group named ASG1. Sub1 contains the resources shown in the following table. Vault1 stores the objects shown in the following table. Existing Environment. Privileged Identity Management (PIM) configuration You manage privileged roles by using Privileged Identity Management (PIM). The PIM role settings are configured as shown in the following table. Existing Environment. Microsoft Sentinel configuration Contoso has a Microsoft Sentinel workspace that contains the following tables. Requirements. Planned changes - Contoso plans to implement the following changes: Integrate AKS1 with Vault1. Enable Microsoft Entra Kerberos authentication for all supported storage. Configure auditing for sql1 by using the Azure portal and store audit logs in a centralized location. Requirements. Technical requirements Contoso identifies the following technical requirements: Protect Server1 by using file integrity monitoring. Protect AKS1 by using Microsoft Defender for Cloud. Configure Microsoft Sentinel to retain data for the maximum supported duration without changing the tier. Store objects used for authentication and encryption in Vault1 and ensure that Vault1 regenerates the objects every 30 days, whenever possible. You need to protect the applications hosted on AKS1. The solution must meet the technical requirements. Which Defender for Cloud plan should you enable?
- A. Microsoft Defender for Servers
- B. Microsoft Defender for App Service
- C. Microsoft Defender for Containers
- D. Microsoft Defender for Resource Manager
- E. Microsoft Defender for Storage
Show answer and explanation ▾
Correct answer: C
Microsoft Defender for Containers is the plan that covers Kubernetes, including Azure Kubernetes Service. It provides control plane threat detection, runtime protection for the nodes and workloads, and vulnerability assessment of the images, which is what protecting the applications hosted on AKS1 requires.
Why the other options are wrong:
- A. Defender for Servers protects the virtual machine operating system. It does not understand Kubernetes workloads, pods, or the AKS control plane.
- B. Defender for App Service covers applications hosted on Azure App Service, not on Kubernetes.
- D. Defender for Resource Manager watches control plane operations across the subscription. It provides no workload protection inside a cluster.
- E. Defender for Storage protects storage accounts and has nothing to do with AKS.
Question 24
You have an Azure Logic Apps Consumption workflow that uses a Request trigger. All supported authentication methods are enabled on the Request trigger. You need to ensure that the endpoint accepts only OAuth-based requests. The solution must minimize costs. What should you do?
- A. Use OAuth 2.0 authorization.
- B. Enable Secure Inputs and enable Secure Outputs for the Request trigger.
- C. Disable shared access signature (SAS) authentication for the Request trigger.
- D. Deploy Azure API Management.
Show answer and explanation ▾
Correct answer: C
Every supported authentication method is currently enabled, which means both shared access signature and OAuth are accepted. OAuth is therefore already available and nothing needs to be turned on. Disabling SAS authentication on the Request trigger removes the other accepted method, leaving OAuth as the only way in, and it costs nothing.
Why the other options are wrong:
- A. OAuth is already enabled because all supported methods are on. Enabling it again does not remove the SAS path into the endpoint.
- B. Secure Inputs and Secure Outputs hide sensitive values in run history. They do not affect how callers authenticate.
- D. Azure API Management would let you enforce OAuth in front of the workflow, but it is an additional billed service and the question asks you to minimize costs.
Get the complete SC-500 bank
These 24 questions are roughly 30% of the bank. The full pack has 121 real SC-500 questions, each with the same depth of explanation, plus a questions-only PDF for timed practice and free updates forever.