Free Microsoft SC-500 Practice Exam with Questions & Answers

Approval before elevation is implemented by requiring approval to activate the PIM role. Automatic removal after a fixed active period is controlled by the activation maximum duration. Expiring active or eligible assignments governs the assignment lifecycle, not the duration of each activation session. Requiring justification can improve audit quality, but it does not ensure that another administrator evaluates the request or that access ends after the configured active window. This domain is tested through precise scope control: tenant, subscription, resource, application, and data-plane authorization are not interchangeable. The correct choice applies the smallest identity or governance control that enforces the stated requirement. Options that only add users, create registrations, or provide broad administrator access fail because they do not directly enforce the requested access behavior. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > Privileged Identity Management; Microsoft Learn > configure role activation settings.

==============================================================

Microsoft Entra-only authentication at the logical server level disables SQL authentication for all databases on that server while leaving existing SQL principals in place. That matches the requirement to deny SQL authentication without removing legacy logins. Creating external-provider users adds Entra users; it does not block SQL logins. Conditional Access can govern Entra sign-ins but cannot disable SQL authentication. SQL Server Contributor is an Azure management role, not an authentication mode. The exam objective emphasizes practical identity enforcement rather than cosmetic configuration. A valid answer must identify who authenticates, what permission is granted, where the scope is applied, and whether the method continues to work without passwords or secrets. That is why the selected answer is preferred over broader administrative roles or unrelated access settings. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > Azure SQL platform security; Microsoft Learn > Microsoft Entra-only authentication.

==============================================================

VNet1: An Azure Private Link service; VNet2: A private endpoint

Private Link service and private endpoint provide one-way, explicitly scoped private connectivity. VNet1 hosts the target VMs and should expose only the intended service through an Azure Private Link service. VNet2, where VM3 runs, consumes that service through a private endpoint. VNet peering or VPN would create broader network reachability between the networks and would not inherently deny VM3 access to other resources in Sub1. Microsoft platform security questions usually hinge on where enforcement occurs: at the resource, server, subnet, firewall policy, private endpoint, or subscription level. The selected answer uses the control plane that owns that enforcement point. Other options are rejected when they only log activity, broaden network access, or protect a different service category. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > Private Link services and private endpoints; Microsoft Learn > Azure Private Link architecture.

==============================================================

The first step is to create a custom log table in Workspace1 . Microsoft Sentinel uses the underlying Log Analytics workspace as its data platform. When ingesting security events that have a custom JSON schema, the destination table must exist so Azure Monitor can map and store the incoming fields correctly. Microsoft documentation for custom tables explicitly states that custom schemas are used for data that does not fit predefined Azure tables, and the table is created before configuring the collection flow that sends records to it.

For modern custom ingestion, a Data Collection Rule (DCR) defines how incoming records are collected, optionally transformed, and routed to the custom table. Microsoft also documents that a custom table receiving JSON data must exist before the corresponding DCR is created in applicable collection scenarios.

A diagnostic setting is intended primarily for supported Azure resource platform logs and is not the prerequisite for ingesting arbitrary SaaS JSON events. A built-in Sentinel connector would contradict the requirement to build a custom connector . An analytics rule is configured only after data is being ingested because it queries stored events to detect suspicious activity.

Therefore, preparing the workspace begins by defining the custom log table and schema that will receive the SaaS security data.

A SharePoint Advanced Management Data access governance report is specifically designed to identify SharePoint content that is broadly accessible across the organization. In particular, SharePoint provides reports for content shared with Everyone except external users (EEEU) and Everyone . EEEU automatically includes all internal users, making this report directly applicable when investigating content that Microsoft 365 Copilot could surface to employees because of overly broad SharePoint permissions.

Microsoft states that Data access governance reports help organizations detect oversharing , analyze permission exposure, and identify sites and files whose current permissions allow excessive internal access. This is especially relevant before or during Copilot adoption because Copilot honors existing user permissions: broadly accessible SharePoint content can therefore appear in Copilot-powered experiences for users who already have permission to access it.

A Purview DLP policy detects and governs sensitive-data handling but does not provide the required inventory of content shared with all internal users. A DSPM remediation action is intended to remediate identified risks rather than produce this specific SharePoint permission report. Conditional Access controls authentication conditions and does not analyze SharePoint permissions.

The SC-500 study guide explicitly includes identifying overexposure of data in SharePoint under Secure compute and AI security.

===============

Authentication method: The Microsoft identity provider; Access control method: Enterprise app assignment required

Built-in authentication for App Service should use the Microsoft identity provider for Microsoft Entra sign-in. To restrict access to selected users and groups, require enterprise app assignment on the corresponding enterprise application. IP restrictions only filter network source and cannot identify assigned corporate users. Local authentication and broad admin consent do not implement assigned-user enforcement for the backend API. This domain is tested through precise scope control: tenant, subscription, resource, application, and data-plane authorization are not interchangeable. The correct choice applies the smallest identity or governance control that enforces the stated requirement. Options that only add users, create registrations, or provide broad administrator access fail because they do not directly enforce the requested access behavior. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > App Service authentication; Microsoft Learn > App Service built-in authentication and enterprise app assignment.

==============================================================

Passwordless sign-in: Microsoft Authenticator; First-time sign-in for new users: Temporary Access Pass

Microsoft Authenticator supports passwordless phone sign-in, allowing users to authenticate from a mobile device without typing a password. Temporary Access Pass is a time-limited, helpdesk-issued credential designed for onboarding or recovery, so it fits first-time sign-in for new users. SMS and voice call are authentication methods but are not passwordless sign-in methods in the same strong sense, and hardware OATH tokens are not the requested mobile-device experience. For SC-500, the decisive distinction is whether the control authenticates an identity, grants authorization, or merely changes configuration visibility. The incorrect choices generally either grant excessive privilege, change the application model, or operate at the wrong scope. Microsoft expects the least-privilege identity path that satisfies the scenario without introducing shared secrets or unnecessary tenant-wide rights. The result is a direct exam-style implementation choice: it changes the required security behavior without relying on unrelated monitoring, manual cleanup, or excessive privilege. Official Microsoft source/topic: SC-500 Study Guide > passwordless authentication methods; Microsoft Learn > Microsoft Authenticator and Temporary Access Pass.

==============================================================

The correct configuration is the Secrets Store CSI Driver. The planned change requires AKS1 to integrate with Vault1, which is an Azure Key Vault. Microsoft provides the Azure Key Vault Provider for Secrets Store CSI Driver specifically for this scenario. It enables an AKS cluster to consume Key Vault objects—such as secrets, keys, and certificates—by mounting them into Kubernetes pods through a CSI volume. Microsoft explicitly describes this driver as providing integration between Azure Key Vault and AKS.

A workload identity can be used as an authentication mechanism that allows Kubernetes workloads to authenticate to Azure resources, including Key Vault, but it is not by itself the feature that performs the Key Vault integration requested by the question. In fact, Workload ID is one of several supported identity methods that can be used with the Secrets Store CSI Driver.

Application scaling controls workload capacity and does not provide secret-store integration. Kubernetes RBAC controls authorization to Kubernetes resources but does not connect AKS to Azure Key Vault.

This maps directly to the SC-500 Secure compute domain, which includes implementing and configuring security controls for Azure Kubernetes Service (AKS).