Free SC-500 sample questions
Real questions from the Implementing End-to-End Security Controls for Cloud and AI Workloads practice bank, with the correct answer and an explanation for each one. No junk, no filler.
Try them in the simulator Same questions, with study, timed and flashcard modes.
Showing 6 of 12 free sample questions.
An organization deploys an internal multi-tenant enterprise application integrated with Microsoft Entra ID. The enterprise application object has the property 'Assignment required?' set to 'Yes'. A team of data analysts who have not been assigned to the application attempt to access it and grant delegated user consent for basic profile read permissions. The tenant's global consent policy allows user consent for verified publishers. What occurs when the unassigned analysts attempt to consent and access the application?
A lead security architect is designing an automated secrets discovery mechanism across 400 Azure virtual machines. The security team requires discovery of plaintext connection strings, unprotected SSH private keys, and cloud storage Shared Access Signature (SAS) tokens without installing software agents, impacting host VM CPU utilization, or degrading network throughput. Which Microsoft Defender for Cloud capability and tier combination satisfies these operational requirements?
You enable agentless secrets scanning across your production Azure subscriptions using Microsoft Defender CSPM. Discovered secrets are cataloged and ingested into the cloud security graph. In which TWO surfaces within the Microsoft Defender for Cloud portal can security engineers investigate these discovered secrets? (Select TWO)
Contoso Pharmaceuticals maintains critical clinical trial database backups in Azure Recovery Services vaults. A recent threat assessment revealed that rogue administrators or compromised credentials could delete backup data or disable security configurations to facilitate ransomware extortion. The enterprise requirements are: 1. Prevent any operation that could cause loss of recovery points by enforcing WORM (write once, read many) storage in an irreversible state. 2. Ensure critical backup management actions (such as disabling soft delete or modifying retention) mandate approval from an independent security team using a separate authorization object. 3. Elevate the vault security posture to achieve the 'Excellent (Maximum)' vault security level in Azure Backup. Which combination of Azure Backup security features must you implement to fulfill these requirements? sequenceDiagram autonumber participant Admin as Backup Administrator participant RG as Resource Guard (Security Subscription) participant Vault as Recovery Services Vault participant Storage as Immutable WORM Storage Admin->>RG: Request authorization for critical operation RG-->>Admin: Approval granted via MUA Admin->>Vault: Submit modify/delete command with MUA token Vault->>Storage: Block deletion (Locked Immutability)
A security engineer is evaluating the soft delete capabilities of Azure Backup for a newly provisioned Recovery Services vault. The engineer must ensure that soft delete protection cannot be disabled by a compromised administrative identity, and that deleted backup items are retained beyond the default window. Which configuration achieves this protection?
6 more free samples are waiting
Create a free account to unlock the whole SC-500 sample bank, or get full access to all 150 practice questions in the simulator.