10 beginner questions on the SC-500 skills measured: PIM, managed identities, resource locks and Azure Policy (Manage identity, access, and governance); network security groups and private endpoints (Secure storage, databases, and networking); Azure Bastion, Trusted launch VMs and AI threat protection (Secure compute); and Microsoft Defender for Cloud (Manage and monitor security posture).

Ready to test yourself? Take the graded Beginner test (free; sign in with Google, one click) to get your score.

  1. A company wants administrators to hold privileged Microsoft Entra roles only when needed: they must activate the role for a limited time, give a justification and get approval. Which feature should the company use?

    • A. Microsoft Entra Connect Sync
    • B. Microsoft Entra Privileged Identity Management (PIM) ✔ correct
    • C. Conditional Access named locations
    • D. Azure Policy guest configuration

    Answer: B. PIM provides just-in-time, time-bound privileged access with approval, justification and access reviews. Entra Connect synchronizes identities, and named locations only describe network locations for Conditional Access.

    Source: learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim · Domain: Manage identity, access, and governance

  2. A developer team runs an application on an Azure virtual machine that must read secrets from Azure Key Vault. The team does not want to store any credentials in code or configuration files. What should they use?

    • A. A managed identity for the virtual machine ✔ correct
    • B. A shared access signature stored in the app settings
    • C. A service principal client secret copied into the code
    • D. A local administrator account on the virtual machine

    Answer: A. A managed identity gives the VM an automatically managed identity in Microsoft Entra ID, so the app gets tokens for Key Vault without handling credentials. A client secret or SAS in code or settings can leak, and a local VM account cannot authenticate to Key Vault.

    Source: learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/over · Domain: Manage identity, access, and governance

  3. A CanNotDelete resource lock lets authorized users read and modify a resource, but prevents them from deleting it.

    • A. True ✔ correct
    • B. False

    Answer: A. True. CanNotDelete blocks deletion but allows reads and changes. A ReadOnly lock is stricter: users can read the resource but cannot update or delete it.

    Source: learn.microsoft.com/en-us/azure/azure-resource-manager/management/lock-resources · Domain: Manage identity, access, and governance

  4. A security engineer must make sure that new Azure resources can be deployed only in approved regions, and that noncompliant deployments are denied. Which service should the engineer use?

    • A. Azure Monitor alerts
    • B. Microsoft Entra access reviews
    • C. Azure Policy ✔ correct
    • D. Azure Advisor cost recommendations

    Answer: C. Azure Policy evaluates resources against rules and can deny noncompliant deployments; the built-in Allowed locations definition covers this case. Alerts and Advisor only report, and access reviews manage who has access.

    Source: learn.microsoft.com/en-us/azure/governance/policy/overview · Domain: Manage identity, access, and governance

  5. Which Azure feature filters inbound and outbound traffic for a subnet or network interface by using rules based on source, destination, port and protocol?

    • A. Azure DNS private zone
    • B. Network security group (NSG) ✔ correct
    • C. Azure Load Balancer health probe
    • D. Virtual network peering

    Answer: B. An NSG contains prioritized security rules that allow or deny traffic by source, destination, port and protocol, and is associated with subnets or network interfaces. Peering connects networks but does not filter traffic.

    Source: learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview · Domain: Secure storage, databases, and networking

  6. An organization wants applications in its virtual network to reach an Azure Storage account over a private IP address, so the traffic never uses the storage account's public endpoint. What should it configure?

    • A. A public IP prefix
    • B. An application security group
    • C. A NAT gateway
    • D. A private endpoint ✔ correct

    Answer: D. A private endpoint is a network interface with a private IP from your virtual network that connects privately to a service such as Azure Storage through Private Link. A NAT gateway handles outbound internet traffic instead.

    Source: learn.microsoft.com/en-us/azure/private-link/private-endpoint-overview · Domain: Secure storage, databases, and networking

  7. Administrators need RDP and SSH access to Azure virtual machines from the Azure portal over TLS, without giving the virtual machines public IP addresses. Which service meets this need?

    • A. Azure Bastion ✔ correct
    • B. Azure Front Door
    • C. Azure Traffic Manager
    • D. Azure Application Gateway

    Answer: A. Azure Bastion is a managed service that provides secure RDP and SSH connectivity to VMs over TLS, so the VMs need no public IP. Front Door, Traffic Manager and Application Gateway deliver web traffic, not admin sessions.

    Source: learn.microsoft.com/en-us/azure/bastion/bastion-overview · Domain: Secure compute

  8. Which two security features are part of Trusted launch for Azure virtual machines? (Select TWO)

    • A. Secure Boot ✔ correct
    • B. Azure DDoS Network Protection
    • C. Virtual Trusted Platform Module (vTPM) ✔ correct
    • D. Application security groups
    • E. Azure Firewall Premium

    Answer: A, C. Trusted launch protects VMs against boot kits and rootkits with Secure Boot, a vTPM and boot integrity monitoring. DDoS Protection, application security groups and Azure Firewall are network controls, not VM security types.

    Source: learn.microsoft.com/en-us/azure/virtual-machines/trusted-launch · Domain: Secure compute

  9. A company wants one service that gives a secure score and security recommendations for its resources in Azure, AWS and Google Cloud. Which service should it use?

    • A. Microsoft Entra ID Protection
    • B. Azure Monitor Logs
    • C. Microsoft Defender for Cloud ✔ correct
    • D. Azure Key Vault

    Answer: C. Microsoft Defender for Cloud assesses resources against security standards, shows a secure score and gives prioritized recommendations, including for connected AWS and GCP environments. Entra ID Protection focuses on identity risk.

    Source: learn.microsoft.com/en-us/azure/defender-for-cloud/secure-score-security-control · Domain: Manage and monitor security posture

  10. A company runs generative AI applications on Azure OpenAI models and wants security alerts for threats such as jailbreak attempts and data leakage. What should the security team enable?

    • A. Azure DDoS Protection on the virtual network
    • B. Threat protection for AI services in Defender for Cloud ✔ correct
    • C. Soft delete on the Azure Key Vault
    • D. Azure Backup for the application servers

    Answer: B. Defender for Cloud threat protection for AI services works with Prompt Shields and Microsoft threat intelligence to raise alerts for jailbreak, data leakage and other AI threats. The other options do not inspect AI prompts.

    Source: learn.microsoft.com/en-us/azure/defender-for-cloud/ai-threat-protection · Domain: Secure compute

Original practice questions written by xOps School (DevOpsSchool Private Limited) from the public Microsoft exam objectives (SC-500 study guide (skills measured, updated 2026-07-31); replaces retired AZ-500), checked 2026-10-25. They are not actual exam questions. xOps School is not affiliated with or endorsed by Microsoft; exam names are trademarks of their owners. Official exam page: learn.microsoft.com/en-us/credentials/certifications/cloud-and-ai-secu.

Last modified: Sunday, 25 October 2026, 9:57 PM