I85PREP
⌘ K
SC-500 study materials
SC-500 study resources

SC-500 practice questions

One question at a time. Build your SC-500 understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Describe the concepts of security, compliance, and identity

Which model treats identity as the primary security perimeter, rather than the corporate network boundary?

  1. The shared responsibility model
  2. The perimeter defense model
  3. The castle-and-moat model
  4. The Zero Trust model Correct answer.

Explanation

Zero Trust assumes no implicit trust based on network location and verifies every request explicitly, so identity becomes the control plane. Perimeter and castle-and-moat models rely on a trusted internal network. The shared responsibility model divides duties between cloud provider and customer.

Question 2Describe the concepts of security, compliance, and identity

Under the shared responsibility model for a SaaS application such as Microsoft 365, which responsibility always remains with the customer?

  1. Maintaining the hypervisor layer
  2. Protecting the physical datacenter
  3. Patching the application servers
  4. Managing user accounts and access permissions Correct answer.

Explanation

Data, identities, and access governance stay with the customer in every cloud service model. Physical security, hosts, and the application platform shift to the provider as you move from IaaS to SaaS.

Question 3Describe the concepts of security, compliance, and identity

An organization wants to require phishing-resistant sign-in for administrators. Which authentication method best meets this goal?

  1. SMS one-time passcode
  2. Email one-time passcode
  3. Security questions
  4. FIDO2 security key Correct answer.

Explanation

FIDO2 security keys bind authentication to the origin and resist real-time phishing because there is no shared secret to intercept. SMS, email codes, and knowledge-based questions can be relayed or guessed by an attacker.

Question 4Describe the concepts of security, compliance, and identity

What is the primary purpose of Microsoft Entra ID Conditional Access?

  1. To back up directory objects to another region
  2. To encrypt data at rest in storage accounts
  3. To scan email attachments for malware
  4. To evaluate signals and enforce access decisions at sign-in Correct answer.

Explanation

Conditional Access evaluates signals such as user, device, location, and risk, then applies grant or session controls. It is an if-then policy engine evaluated when a resource is requested. Encryption, mail filtering, and backup are separate capabilities.

Question 5Describe the concepts of security, compliance, and identity

Which term describes the practice of granting users only the permissions required to perform their job tasks?

  1. Separation of duties
  2. Defense in depth
  3. Least privilege access Correct answer.
  4. Just-in-time elevation

Explanation

Least privilege means assigning the minimum rights needed for the role and no more. Separation of duties splits sensitive tasks among people, and just-in-time elevation is a technique to temporarily grant rights.

Question 6Describe the concepts of security, compliance, and identity

Which Microsoft cloud service is the primary identity provider for authenticating users to Microsoft 365 and Azure resources?

  1. Microsoft Entra ID Correct answer.
  2. Microsoft Defender for Identity
  3. Microsoft Purview
  4. Azure Key Vault

Explanation

Microsoft Entra ID is the cloud directory and identity provider that issues tokens for Microsoft cloud services and integrated applications. Defender for Identity monitors on-premises domain controllers, Purview governs data, and Key Vault stores secrets.

Question 7Describe the concepts of security, compliance, and identity

A regulation requires an organization to keep records proving who approved changes to financial reports. Which concept does this requirement describe?

  1. Confidentiality
  2. Data residency
  3. Auditability Correct answer.
  4. Availability

Explanation

Auditability is the ability to demonstrate, through retained evidence, that controls operated as intended. Data residency concerns where data is stored, while confidentiality and availability are pillars of the CIA triad.

Question 8Describe the concepts of security, compliance, and identity

Which statement best describes the function of a managed identity in Azure?

  1. It enforces multi-factor authentication for end users.
  2. It provides an automatically managed credential for a resource to authenticate to other services. Correct answer.
  3. It stores application secrets in an encrypted vault.
  4. It defines the network boundary for a virtual network.

Explanation

A managed identity is a service principal whose credentials Azure creates and rotates, letting a resource obtain tokens without embedded secrets. Key Vault stores secrets, MFA applies to users, and network boundaries are defined by segmentation controls.

Question 9Describe the concepts of security, compliance, and identity

An administrator wants to block legacy authentication protocols that cannot enforce multi-factor authentication. Which control should be used?

  1. A Conditional Access policy targeting client apps Correct answer.
  2. A named location for the office IP range
  3. A self-service password reset policy
  4. A password expiration policy

Explanation

Conditional Access can target legacy client app types and block them while requiring modern authentication elsewhere. Password policies and named locations do not distinguish protocol type, and SSPR only governs password reset.

Question 10Describe the concepts of security, compliance, and identity

A company must ensure that only compliant, managed devices can read confidential files in SharePoint Online. Which combination of features accomplishes this?

  1. Azure Firewall rules plus network security groups
  2. Data Loss Prevention policies plus retention labels
  3. Conditional Access grant controls plus device compliance state from Intune Correct answer.
  4. Privileged Identity Management plus access reviews

Explanation

Conditional Access can require a device to be compliant or hybrid-joined, and Intune supplies that compliance signal. Network controls cannot see device health, and DLP or PIM govern data handling and roles rather than device trust.

Question 11Describe the concepts of security, compliance, and identity

Which Entra ID feature lets a user request temporary membership in a privileged role with approval and time limits?

  1. Privileged Identity Management Correct answer.
  2. Conditional Access
  3. Entitlement management
  4. Access reviews

Explanation

Privileged Identity Management provides just-in-time role activation with approval, justification, and duration limits. Access reviews recertify existing access, entitlement management handles access packages, and Conditional Access makes sign-in decisions.

Question 12Describe the concepts of security, compliance, and identity

What distinguishes Microsoft Entra ID Governance access reviews from standard role assignments?

  1. They replicate directory objects to a second region.
  2. They periodically require reviewers to confirm or remove existing access. Correct answer.
  3. They automatically enable multi-factor authentication.
  4. They encrypt directory data at rest.

Explanation

Access reviews create recurring attestation campaigns where reviewers certify continued need, and unreviewed or denied access is removed. They do not encrypt data, enforce MFA, or handle replication.

Question 13Describe the concepts of security, compliance, and identity

A security team wants to detect sign-ins from unusual locations and impossible travel. Which capability provides this signal?

  1. Application Insights availability tests
  2. Network Watcher flow logs
  3. Azure Service Health alerts
  4. Identity Protection risk detections Correct answer.

Explanation

Identity Protection evaluates signals such as anonymous IP use, atypical travel, and leaked credentials to produce risk detections and risk levels. Service Health reports platform incidents, flow logs record network traffic, and availability tests monitor web endpoints.

Question 14Describe the concepts of security, compliance, and identity

Which control most directly reduces the impact of a compromised administrator credential?

  1. Requiring phishing-resistant MFA with just-in-time role activation Correct answer.
  2. Configuring a custom sign-in banner
  3. Enabling self-service password reset
  4. Increasing password length to 16 characters

Explanation

Phishing-resistant MFA blocks credential replay, and just-in-time activation limits how long privileged access exists if a session is compromised. Longer passwords and banners do not stop token theft, and SSPR only affects recovery.

Question 15Describe the concepts of security, compliance, and identity

Which Microsoft Purview capability classifies content by using built-in or custom patterns such as credit card or national ID numbers?

  1. Insider risk policies
  2. Retention labels
  3. Sensitivity labels
  4. Sensitive information types Correct answer.

Explanation

Sensitive information types define the patterns and confidence levels used to detect regulated data, and they underpin DLP and auto-labeling. Sensitivity labels apply protection, retention labels manage lifecycle, and insider risk policies detect risky user behavior.

Question 16Describe the concepts of security, compliance, and identity

An organization must prevent sensitive documents from being shared with external recipients while still allowing internal collaboration. Which solution addresses this requirement?

  1. A Conditional Access named location
  2. An Azure Policy deny assignment
  3. A network security group on the virtual network
  4. A Data Loss Prevention policy in Purview Correct answer.

Explanation

DLP policies inspect content and enforce actions such as blocking external sharing when sensitive information types are detected. Network and sign-in controls cannot inspect document content, and Azure Policy governs resource configuration.

Question 17Describe the concepts of security, compliance, and identity

Which statement accurately describes encryption in transit versus encryption at rest?

  1. Encryption in transit protects data on storage media, while encryption at rest protects network packets.
  2. Both terms describe hashing of credentials during sign-in.
  3. Encryption in transit protects data moving across networks, while encryption at rest protects stored data. Correct answer.
  4. Both terms apply only to data held in on-premises datacenters.

Explanation

Encryption in transit secures data as it moves between systems, typically with TLS, while encryption at rest secures data on disks and in storage services. The two protect different states of data and are used together.

Question 18Describe the concepts of security, compliance, and identity

Which Azure capability lets an application retrieve secrets at runtime without storing them in code or configuration files?

  1. Azure Storage shared key
  2. Azure Bastion
  3. Azure Key Vault with managed identity Correct answer.
  4. Azure Policy

Explanation

Key Vault stores secrets and keys, and a managed identity lets the app authenticate to the vault without embedded credentials. Shared keys are themselves long-lived secrets, Bastion provides remote access, and Azure Policy enforces configuration rules.

Question 19Describe the concepts of security, compliance, and identity

Which Microsoft framework organizes security controls into functions such as Identify, Protect, Detect, Respond, and Recover?

  1. MITRE ATT&CK
  2. Microsoft Security Benchmark
  3. NIST Cybersecurity Framework Correct answer.
  4. Center for Internet Security Benchmarks

Explanation

The NIST Cybersecurity Framework groups outcomes into Identify, Protect, Detect, Respond, and Recover functions. The Microsoft Security Benchmark is a set of Azure configuration recommendations, ATT&CK catalogs adversary tactics, and CIS Benchmarks provide hardening baselines.

Question 20Describe the concepts of security, compliance, and identity

A tenant enables security defaults. What effect does this have on users?

  1. It requires all users to register for and use multi-factor authentication and blocks legacy authentication. Correct answer.
  2. It disables Conditional Access policies in the tenant.
  3. It forces all administrators to use password-only sign-in.
  4. It removes the ability to use self-service password reset.

Explanation

Security defaults are a baseline set of protections that require MFA registration and use, block legacy authentication, and protect privileged actions. They are intended for tenants without Conditional Access policies.

Question 21Describe the concepts of security, compliance, and identity

Which scenario best illustrates the principle of defense in depth?

  1. Relying on a single strong firewall at the network edge
  2. Granting administrators permanent global access for convenience
  3. Layering identity verification, network filtering, and data encryption controls Correct answer.
  4. Disabling audit logging to reduce storage costs

Explanation

Defense in depth assumes any single control can fail, so multiple independent layers protect the same asset. A single firewall, permanent broad access, and disabled logging all reduce resilience rather than add layers.

Question 22Describe the concepts of security, compliance, and identity

An organization must prove to auditors that only authorized personnel accessed a confidential repository during a specific quarter. Which two capabilities are most relevant?

  1. Backup frequency and geo-redundancy
  2. Password complexity and account lockout
  3. Audit log retention and access reviews Correct answer.
  4. Network segmentation and DDoS protection

Explanation

Audit logs record who accessed what and when, and access reviews demonstrate that membership was authorized and recertified. Password policy, segmentation, and backup settings do not produce evidence of authorized access over time.

Question 23Describe the concepts of security, compliance, and identity

A user signs in successfully from a new country minutes after signing in from another continent. Identity Protection raises the sign-in as risky. Which response best aligns with a risk-based policy?

  1. Reset the password of every user in the tenant
  2. Ignore the signal because the password was correct
  3. Permanently disable the account without investigation
  4. Require MFA or block the session based on the configured risk level Correct answer.

Explanation

Risk-based Conditional Access maps risk levels to controls such as requiring MFA or blocking access, allowing legitimate travel while challenging anomalies. Permanent disablement without investigation or tenant-wide resets are disproportionate and disruptive.

Question 24Describe the concepts of security, compliance, and identity

An application must access Azure Storage without any secret stored in code, and access must be revocable centrally. Which approach satisfies both requirements?

  1. Use a system-assigned managed identity with an Azure role assignment Correct answer.
  2. Store the connection string in a public repository variable
  3. Distribute a shared access signature with no expiry to each user
  4. Embed a storage account key in the application configuration

Explanation

A system-assigned managed identity obtains tokens from Entra ID, and role assignment scopes can be removed centrally to revoke access, with no secret to rotate. Embedded keys and non-expiring SAS tokens are long-lived secrets, and public storage of connection strings exposes credentials.

Question 25Describe the concepts of security, compliance, and identity

A multinational company must keep European customer data within the European Union while allowing global staff to collaborate. Which combination addresses the requirement?

  1. A single tenant with data stored only in the home region
  2. Global administrator assignment for all staff
  3. Disabling audit logging in non-EU regions
  4. Multi-geo data residency configuration with region-scoped access controls Correct answer.

Explanation

Multi-geo capabilities let content be stored in specified geographies while users work from a single tenant, and scoped access controls limit who can reach each region. Broad admin assignment, single-region storage, and disabled logging conflict with residency and accountability goals.

Question 26Describe the concepts of security, compliance, and identity

Which term describes the process of verifying that a user or device is who or what it claims to be?

  1. Authorization
  2. Accounting
  3. Authentication Correct answer.
  4. Auditing

Explanation

Authentication establishes and verifies an identity claim, typically through credentials such as a password, certificate, or token. Authorization happens only after identity is established.

Question 27Describe the concepts of security, compliance, and identity

What is the primary purpose of single sign-on (SSO) in an identity platform?

  1. Letting a user authenticate once and then access multiple applications without re-entering credentials Correct answer.
  2. Encrypting all traffic between the user's browser and each application
  3. Requiring a separate strong password for every application
  4. Replacing the need for any authorization decisions

Explanation

SSO centralizes authentication so that one successful sign-in produces a session or token trusted by many applications. Authorization decisions still occur per application.

Question 28Describe the concepts of security, compliance, and identity

Which statement best describes the difference between a security principal and a security group?

  1. A principal is a container of permissions, while a group is a single user account
  2. A principal is an identity that can be granted access, while a group is a container used to grant access to many principals at once Correct answer.
  3. A principal is only used for devices, while a group is only used for users
  4. A principal stores audit logs, while a group stores encryption keys

Explanation

Principals such as users, service principals, and managed identities can be assigned permissions. Groups aggregate principals so that access can be managed collectively.

Question 29Describe the concepts of security, compliance, and identity

In the Zero Trust model, what is the guiding assumption about network location?

  1. A request originating inside the corporate network is trusted by default
  2. Trust is granted permanently after the first successful sign-in
  3. Only requests from mobile devices require verification
  4. No location is inherently trusted, so every request must be verified Correct answer.

Explanation

Zero Trust assumes breach and verifies explicitly, so being on an internal network confers no implicit trust. Each request is evaluated on identity, device, and context signals.

Question 30Describe the concepts of security, compliance, and identity

Which term describes a law or standard that an organization is obliged to follow, such as a data protection regulation?

  1. Service level agreement
  2. Threat model
  3. Security baseline
  4. Compliance requirement Correct answer.

Explanation

Compliance requirements are external or internal obligations an organization must satisfy and evidence. Security baselines, threat models, and SLAs are supporting artifacts rather than the obligation itself.

Question 31Describe the concepts of security, compliance, and identity

What does data residency refer to in a cloud compliance context?

  1. The physical or geographic location where data is stored at rest Correct answer.
  2. The permission model applied to a storage account
  3. The retention period applied to backup copies
  4. The format used to serialize data during transmission

Explanation

Data residency concerns the geographic placement of stored data, often driven by legal or regulatory obligations. Serialization, retention, and permissions are separate concerns.

Question 32Describe the concepts of security, compliance, and identity

Which concept describes granting a user only the permissions needed to perform their job and nothing more?

  1. Privilege escalation
  2. Least privilege Correct answer.
  3. Role explosion
  4. Separation of duties

Explanation

Least privilege limits access rights to the minimum required for the task. Separation of duties instead divides sensitive tasks among different people.

Question 33Describe the concepts of security, compliance, and identity

Which type of identity is created automatically for an Azure resource so it can authenticate to other services without stored credentials?

  1. A local administrator account on a virtual machine
  2. A managed identity Correct answer.
  3. A shared service account with a static password
  4. A guest user account in the directory

Explanation

A managed identity is a directory identity tied to an Azure resource whose credentials are managed by the platform. No secret is stored or rotated by the developer.

Question 34Describe the concepts of security, compliance, and identity

An administrator must ensure that a departing employee's access to all applications is removed at the end of their last working day. Which identity lifecycle activity does this describe?

  1. Mover access adjustment
  2. Joiner provisioning
  3. Leaver deprovisioning Correct answer.
  4. Self-service password reset

Explanation

Deprovisioning is the lifecycle stage that removes access when an identity no longer requires it. Joiner and mover stages handle onboarding and role changes.

Question 35Describe the concepts of security, compliance, and identity

A security architect needs a control that verifies a device meets encryption and patch requirements before it is allowed to access email. Which concept is being applied?

  1. Directory synchronization filtering
  2. Password hash synchronization
  3. Federated authentication
  4. Conditional access based on device compliance Correct answer.

Explanation

Conditional Access evaluates signals such as device compliance state before granting access to a resource. Password synchronization and federation concern how credentials are validated, not device health.

Question 36Describe the concepts of security, compliance, and identity

An organization wants users to authenticate with a hardware key that proves possession without transmitting a reusable secret. Which authentication approach fits?

  1. Password with complexity requirements
  2. Security questions
  3. FIDO2 security key Correct answer.
  4. SMS one-time passcode

Explanation

FIDO2 security keys use public-key cryptography bound to the origin, so no reusable secret is transmitted. Passwords, SMS codes, and knowledge-based questions rely on shared or interceptable factors.

Question 37Describe the concepts of security, compliance, and identity

Which statement correctly distinguishes encryption at rest from encryption in transit?

  1. Encryption at rest protects stored data from unauthorized reading of the storage medium, while encryption in transit protects data moving across a network Correct answer.
  2. Encryption in transit is only relevant for backup tapes, while encryption at rest applies to internet traffic
  3. Encryption at rest and encryption in transit both protect data only while it is being processed in memory
  4. Encryption at rest protects network packets, while encryption in transit protects disk volumes

Explanation

At-rest encryption addresses data on disks and backups, whereas in-transit encryption protects data on the wire from interception. They address different threat surfaces and are usually applied together.

Question 38Describe the concepts of security, compliance, and identity

A compliance officer needs a consolidated view of how well the tenant meets a specific regulatory standard, with improvement actions. Which Microsoft Purview capability provides this?

  1. Records management
  2. Data Explorer
  3. eDiscovery
  4. Compliance Manager Correct answer.

Explanation

Compliance Manager assesses posture against standards and offers recommended improvement actions with a compliance score. The other capabilities focus on investigation, search, and retention.

Question 39Describe the concepts of security, compliance, and identity

Which principle requires that an organization be able to demonstrate how controls operate, not merely state that they exist?

  1. Accountability Correct answer.
  2. Confidentiality
  3. Availability
  4. Non-repudiation

Explanation

Accountability requires evidence and traceability showing that controls operate as described. Confidentiality, availability, and non-repudiation are separate security objectives.

Question 40Describe the concepts of security, compliance, and identity

A team needs to record every administrative change to a resource group with who made it, when, and what changed, and retain it for audit. Which concept does this describe?

  1. Network segmentation
  2. Activity logging Correct answer.
  3. Data classification
  4. Key rotation

Explanation

Activity logging captures control-plane operations with actor, timestamp, and change details, supporting audit evidence. Classification, key rotation, and segmentation serve different purposes.

Question 41Describe the concepts of security, compliance, and identity

Which identity concept allows an application to act on behalf of a signed-in user while receiving only a scoped token rather than the user's password?

  1. Directory federation
  2. Delegated authorization Correct answer.
  3. Password vaulting
  4. Implicit trust

Explanation

Delegated authorization issues a token scoped to specific permissions for the signed-in user, so the application never handles the password. The other options do not describe scoped user-context access.

Question 42Describe the concepts of security, compliance, and identity

An organization must ensure that deleted content cannot be recovered by ordinary users before the retention period expires, even if the user empties the recycle bin. Which control applies?

  1. A retention label with preservation settings Correct answer.
  2. A conditional access policy
  3. A sensitivity label with encryption
  4. A data loss prevention policy

Explanation

Retention labels with preservation settings keep content for a defined period and can prevent user deletion from taking effect. Sensitivity labels, DLP, and Conditional Access do not govern retention.

Question 43Describe the concepts of security, compliance, and identity

What is the role of a shared responsibility model in cloud security?

  1. It applies only to on-premises deployments
  2. It divides security duties between the cloud provider and the customer depending on the service model Correct answer.
  3. It guarantees that the provider secures all customer data regardless of service type
  4. It requires customers to manage physical datacenter access

Explanation

The shared responsibility model allocates duties such as physical security, patching, and data classification between provider and customer, shifting with IaaS, PaaS, and SaaS. Customers always retain responsibility for their data and identities.

Question 44Describe the concepts of security, compliance, and identity

A user reports that their account is repeatedly locked after entering the wrong password. Which identity protection control most directly addresses repeated failed sign-ins from a single source?

  1. Self-service password reset
  2. Access reviews
  3. Privileged identity management
  4. Smart lockout Correct answer.

Explanation

Smart lockout blocks sign-in attempts from malicious sources while still allowing legitimate users to sign in, distinguishing familiar and unfamiliar locations. The other features address recovery, entitlement review, and just-in-time roles.

Question 45Describe the concepts of security, compliance, and identity

Which practice best supports the principle of separation of duties in an identity system?

  1. Sharing one administrator account among the operations team
  2. Granting permanent global administrator rights to a single operations team
  3. Requiring two different administrators to approve and then execute a privileged change Correct answer.
  4. Disabling logging for administrative actions to protect privacy

Explanation

Separation of duties ensures no single person can complete a sensitive action alone, typically by splitting approval and execution. Shared accounts and permanent broad rights undermine accountability.

Question 46Describe the concepts of security, compliance, and identity

An auditor asks how the organization proves that an external partner could read a specific document only during a two-week engagement. Which combination of evidence is most relevant?

  1. Access logs showing the partner's reads with timestamps and the guest account's lifecycle dates Correct answer.
  2. The document's sensitivity label and the tenant's default retention period
  3. The number of sign-in attempts from the partner's country and the tenant's password policy
  4. The storage account's encryption type and the key rotation schedule

Explanation

Proving time-bound access requires records of actual access events plus evidence of when the guest identity existed. Labels, password policy, and encryption settings do not demonstrate who read the document or when access existed.

Question 47Describe the concepts of security, compliance, and identity

A tenant's Conditional Access policy requires compliant devices for all cloud apps. A legacy client that cannot report compliance attempts to connect. What outcome should be expected?

  1. The connection is blocked because the client cannot satisfy the device compliance requirement Correct answer.
  2. The connection is redirected to a self-service group management portal
  3. The connection is allowed after the user resets their password
  4. The connection is allowed because legacy clients are exempt from device conditions

Explanation

A policy requiring compliant devices cannot be satisfied by a client that cannot report device state, so the request is denied. Exemptions must be explicitly configured and are not automatic.

Question 48Describe the concepts of security, compliance, and identity

Which reasoning best explains why storing application secrets in source code is considered a compliance failure rather than only a security weakness?

  1. It forces the use of managed identities, which regulators prohibit
  2. It prevents the application from using encryption in transit
  3. It breaks the ability to demonstrate controlled access to credentials, undermining audit and accountability obligations Correct answer.
  4. It increases compilation time, which violates service level agreements

Explanation

Regulations typically require demonstrable control over access to systems and credentials. Secrets in source code are broadly readable and untracked, so the organization cannot evidence who accessed them or when they changed.

Question 49Describe the concepts of security, compliance, and identity

An organization wants a token issued to an application that represents the application's own identity rather than a user. Which OAuth 2.0 grant type fits this requirement?

  1. Implicit
  2. Authorization code
  3. Client credentials Correct answer.
  4. Resource owner password credentials

Explanation

The client credentials grant obtains a token for the application itself and involves no user. The other grants issue tokens in the context of a signed-in user.

Question 50Describe the concepts of security, compliance, and identity

A multinational firm must keep customer records in the region of origin while allowing analysts worldwide to query aggregated results. Which design decision addresses the compliance requirement?

  1. Pin data storage to the required geography and expose only aggregated outputs to analysts Correct answer.
  2. Store raw records in the lowest-cost region regardless of customer location
  3. Allow analysts to download raw records and rely on contractual restrictions
  4. Replicate raw records to every analyst's local region for performance

Explanation

Residency obligations apply to where the underlying records are stored, so keeping raw data in the required geography while sharing derived aggregates satisfies both compliance and analytical needs.