Microsoft SC-500 Practice Exam

• A. Enable the policy for a small pilot group first
• B. Turn on security defaults and review the sign-in logs
• C. Run the What If tool against a sample of pilot users
• D. Set the policy state to Report-only Correct answer

Option D is correct because Report-only mode evaluates the policy at every real sign-in and logs what it would have enforced, without blocking or challenging anyone. Option A would affect pilot users immediately, option B replaces the policy with security defaults, and option C (What If) only simulates hypothetical sign-ins rather than reporting on real ones.

• A. Require a ticket number on activation and have the team check each one
• B. Add an authentication context to the role, enforced by a Conditional Access policy
• C. Require approval to activate in the role settings and name the team members as approvers Correct answer
• D. Schedule a recurring access review of the role, with the team members as reviewers

Option C is correct because the PIM role settings include Require approval to activate, where you name the approvers who must approve each activation. Option A only collects a ticket number, option B adds a Conditional Access requirement but no human approval, and option D is an after-the-fact access review, not an approval gate.

• A. The user is outside the pass's scope in the authentication methods policy Correct answer
• B. The user has no Microsoft Entra ID P2 license, which Temporary Access Pass depends on
• C. The pass was created by an Authentication Administrator, not a Global Administrator
• D. The user has not registered for self-service password reset in the tenant

Option A is correct because a Temporary Access Pass can be created for any user, but only users in scope of the Temporary Access Pass method in the authentication methods policy are offered the prompt at sign-in. TAP does not require Microsoft Entra ID P2, any Authentication Administrator can create one for a member, and SSPR registration is not a prerequisite.

• A. Enable the admin consent workflow and choose reviewers who can grant the consent Correct answer
• B. Allow user consent for apps from verified publishers with low-impact permissions
• C. Make the affected users owners of the enterprise application
• D. Assign the Application Administrator role to the affected users

Option A is correct because the admin consent workflow lets users submit a request for apps they cannot consent to, and the designated reviewers approve or deny it. Option B changes what users can consent to without a review step, option C gives users ownership rights instead of a request flow, and option D grants a powerful role that defeats the control.

• A. Leave the policy Off and review the audit log
• B. Assign the policy to a pilot group with Block access
• C. Add a named location for the corporate egress addresses
• D. Check the Report-only results in sign-in log details Correct answer
• E. Create the policy in the Report-only state Correct answer

Options D and E are correct because report-only mode evaluates a Conditional Access policy at every sign-in without enforcing grant controls, and the results are logged on the Report-only tab of the sign-in log details. A policy left Off is not evaluated at all, so the audit log shows nothing about its effect. Assigning Block access to a pilot group blocks users, and a named location does not show which sign-ins the policy would affect.

• A. Set Allow storage account key access to Disabled Correct answer
• B. Disable Allow Blob anonymous access
• C. Enable Secure transfer required
• D. Enable Default to Microsoft Entra authorization in the Azure portal

Option A is correct because Conditional Access is evaluated only for requests authorized with Microsoft Entra tokens. Setting Allow storage account key access to Disabled blocks Shared Key (and account-key-signed SAS) requests that would bypass it. Anonymous access and secure transfer do not route requests through Entra authorization, and the portal default only affects portal behavior.

• A. With the VirtualNetwork service tag for both
• B. With the subnet address prefix for both
• C. With one application security group per tier Correct answer
• D. With the private IP address of each current VM

Option C is correct because application security groups let the NSG rule reference the web tier as source and the database tier as destination, so VMs that are added or replaced pick up the rule when their NICs join the group. Service tags and subnet prefixes would cover every VM in the shared subnet, and per-VM IP addresses break as VMs change.

• A. On-upload malware scanning Correct answer
• B. On-demand malware scanning
• C. Activity monitoring
• D. Sensitive data threat detection

Option A is correct because on-upload malware scanning in Defender for Storage scans each blob as it is uploaded or modified. On-demand scanning runs only when you trigger it, activity monitoring analyzes access patterns, and sensitive data threat detection looks for exposed sensitive data rather than malware.

• A. Open-source relational databases Correct answer
• B. Azure Cosmos DB
• C. SQL servers on machines
• D. Azure SQL Databases

Option A is correct because the Open-source relational databases plan in Defender for Databases covers Azure Database for PostgreSQL and MySQL flexible servers. The Azure SQL Databases and SQL servers on machines plans cover SQL Server engines, and the Cosmos DB plan covers Cosmos DB.

• A. Service SAS tokens issued for a container Correct answer
• B. Microsoft Entra tokens used with Storage Blob Data Reader
• C. User delegation SAS tokens issued for a container
• D. Account SAS tokens issued for the whole account Correct answer
• E. Anonymous reads of blobs in a public container

Options A and D are correct because service SAS and account SAS tokens are authorized with the account key (Shared Key), so every request that uses them is denied once Allow storage account key access is Disabled. Option C keeps working because a user delegation SAS is authorized with Microsoft Entra ID, option B is Entra authorization, and option E is anonymous access, which is not Shared Key authorization.

• A. Add an exclusion for the request attribute
• B. Enable the Bot Manager rule set
• C. Associate the policy with the listener
• D. Change the policy mode to Prevention Correct answer

Option D is correct because a WAF policy in Detection mode only logs matches and lets requests through. Switching the policy to Prevention mode makes the WAF block requests that match the rules. Exclusions reduce false positives, bot rules address different threats, and the policy is already evaluating the traffic.

• A. Azure Standard Load Balancer
• B. Azure Application Gateway Correct answer
• C. Azure Firewall Standard
• D. Azure Traffic Manager

Option B is correct because Azure Application Gateway is the regional layer 7 load balancer that hosts a WAF policy for a virtual network. Standard Load Balancer works at layer 4, Azure Firewall Standard does not provide a web application firewall, and Traffic Manager is DNS-based routing.

• A. Add an exclusion for the Authorization header Correct answer
• B. Switch the policy to Detection mode
• C. Disable the managed rule
• D. Add a custom Allow rule for the sign-in URI

Option A is correct because a WAF exclusion for the Authorization request header stops the managed rule from inspecting that one attribute while it keeps inspecting every other part of every request. Detection mode, disabling the rule or a custom allow rule would remove inspection far more broadly.

• A. A custom rule that blocks when geo-match is not CA or US Correct answer
• B. The Bot Manager rule set with a country category
• C. A custom rule that allows geo-match for CA and US
• D. A managed rule exclusion for non-US countries

Option A is correct because a custom rule that blocks when the geo-match condition is not CA or US (a negated geo-match) blocks every other country. An allow rule for CA and US does not block anything else, because requests that match no rule are still evaluated against the default behavior. Bot Manager and managed rule exclusions do not filter by country.

• A. Annotate only
• B. Medium Correct answer
• C. High Correct answer
• D. Off
• E. Low

Options B and C are correct because a Foundry guardrail blocking level of Medium blocks medium- and high-severity content, and a level of High blocks low-, medium- and high-severity content, so both block content the classifier rates as medium. Low blocks only high-severity content and Off blocks nothing. Annotate only is a response action rather than a blocking level, and it blocks nothing.

• A. Foundational CSPM
• B. Defender for Resource Manager
• C. Defender for Servers Plan 2
• D. Defender CSPM Correct answer

Option D is correct because attack path analysis, which chains exploitable weaknesses toward critical targets, requires the Defender CSPM plan with agentless scanning enabled. Foundational CSPM is the free baseline and does not include attack paths, and Defender for Resource Manager and Defender for Servers Plan 2 are workload protection plans, not posture analysis plans.

• A. Monitor Only
• B. Candidate Correct answer
• C. Dependency
• D. Approved Inventory

Option B is correct because Defender EASM labels an asset Candidate when it has some relationship to known seed assets but not a strong enough one to be Approved Inventory, and it must be reviewed manually to determine ownership. Approved Inventory is for assets you own, Dependency is third-party infrastructure that supports your assets, and Monitor Only is for related but uncontrolled assets.

• A. Endpoint protection
• B. Agentless scanning for machines
• C. File Integrity Monitoring
• D. Vulnerability assessment for machines Correct answer

Option D is correct because the vulnerability assessment setting in the Defender for Servers plan settings is where you choose the scanner for machines, Microsoft Defender Vulnerability Management or the Qualys option. Endpoint protection controls Defender for Endpoint integration, agentless scanning controls snapshot-based scanning, and File Integrity Monitoring tracks file and registry changes.

• A. Resolved through third-party service (mitigated) Correct answer
• B. Compensating control documented
• C. Remediation scheduled with the resource owner
• D. Reported as a false positive
• E. Risk accepted (waiver) Correct answer

Options A and E are correct because the exemption rule offers two categories: Resolved through third-party service (mitigated) and Risk accepted (waiver). Compensating control, scheduled remediation and false positive are not categories in the exemption dialog.

• A. Deny prevents resources that do not meet the recommendation from being deployed Correct answer
• B. Deny remediates existing noncompliant resources across the subscription at the next evaluation
• C. Enforce uses the DeployIfNotExists effect to remediate noncompliant resources when they are created Correct answer
• D. Deny and Enforce apply to recommendations for Azure, AWS and GCP resources alike
• E. Enforce blocks the creation of resources that do not meet the recommendation

Options A and C are correct because Deny prevents the deployment of resources that don't comply with the recommendation, and Enforce uses the DeployIfNotExist effect in Azure Policy to automatically remediate noncompliant resources when they are created. Neither option fixes existing resources retroactively, and Deny and Enforce apply to Azure recommendations only, not to AWS or GCP. Enforce remediates rather than blocks creation, so it is Deny that blocks.