Are these real exam questions?

Our Microsoft SC-500 questions are based on real exam experiences and are continuously updated to match the current exam format. Most candidates who study with us report passing on their first attempt, based on a self reported post exam survey.

What happens if I don't pass the exam?

With our Premium package, you get a 100% money back guarantee. If you don't pass your exam after studying with our materials, simply contact us with your exam results and we'll refund your purchase. Terms and conditions apply, read our full refund policy to learn more.

How often are the questions updated?

Our question bank is updated regularly based on feedback from recent exam takers. We typically review and update our content every week with reports about new questions or changes to the exam format.

Can I extend my access period?

Yes. When your access is close to expiring, you can renew it for another 30 days directly from the exam page. If you need more time while you are still preparing, reach out and we will help.

Is this a single payment or a subscription?

This is a single payment with no recurring charges. Once you purchase, you get full access to all exam questions for the duration of your package (30 days for Standard, 90 days for Premium). No hidden fees or automatic renewals.

How many questions are included?

You get access to all 67 questions in our database for the Microsoft SC-500 exam. This includes detailed explanations and answer justifications to help you understand the concepts thoroughly.

Do you offer technical support?

Yes. Email us at hello@examice.com for help with access, billing, or the platform. We read every message and typically reply within 24 hours on business days.

Is my payment secure?

Absolutely! We use industry standard SSL encryption and process all payments through Stripe, a trusted payment processor used by millions of businesses worldwide. Your payment and personal information are completely secure.

Implementing End-to-End Security Controls for Cloud and AI Workloads

Here you have the best Microsoft SC-500 practice exam questions

Preview the first 5 of 67 questions for free
These questions were last updated on July 14, 2026
This site is not affiliated with or endorsed by Microsoft.

Question 1 of 67

You have two management groups named MG1 and MG2 that contain multiple Azure subscriptions. The subscriptions are linked to a Microsoft Entra tenant.
You have a user named User1 and a global administrator named Admin1.
You are informed that User1 created an Azure subscription named Sub1 under the MG2 management group and is the only owner of the subscription.
You need to ensure that Admin1 can remove the Owner role from User1 for Sub1.
What should you do first?

Move Sub1 to MG1.

Assign Admin1 the User Access Administrator role for Sub1.

Instruct Admin1 to use Privileged Identity Management (PIM) to request the Security Administrator role.

Instruct Admin1 to enable Access management for Azure resources.

Question 2 of 67

DRAG DROP -
You have a Microsoft Entra tenant.
You need to implement passwordless authentication. The solution must meet the following requirements:
Users can sign in without a password by using a mobile device.
New users that sign in for the first time must use a helpdesk-issued sign-in method that expires.
Which authentication method should you enable for each requirement? To answer, drag the appropriate methods to the correct requirements. Each method may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Exam SC-500: Image 1

Question 3 of 67

You have an Azure management group named MG1 that contains two subscriptions named Sub1 and Sub2. Both subscriptions are linked to a Microsoft Entra tenant that contains a security group named Group1.
You need to ensure that the members of Group1 can assign roles to the resources in Sub1 and Sub2. The solution must follow the principle of least privilege.
Which role should you assign to Group1?

Contributor at the MG1 scope

Contributor at the Sub1 and Sub2 scopes

User Access Administrator at the MG1 scope

Owner at the MG1 scope

Question 4 of 67

HOTSPOT -
You have an Azure subscription named Sub1 that contains 50 virtual machines. Sub1 has Microsoft Defender for Cloud enabled.
Sub1 contains an Azure key vault named KV1 and an Azure policy that enforces storing all secrets in KV1.
Occasionally, the developers at your company store plaintext tokens and SSH private keys on the virtual machines.
You need to configure Defender for Cloud to detect plaintext secrets on the virtual machines. The solution must minimize administrative changes to the virtual machines.
How should you configure Defender for Cloud? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Exam SC-500: Image 1

Question 5 of 67

Overview -
Fabrikam, Inc. is a consulting company. The company has a main office in New York City and branch offices in Amsterdam and Singapore.
Existing Environment. Network environment
The on-premises network contains a datacenter in each office.
Existing Environment. Cloud environment
Fabrikam has two Azure subscriptions named Sub1 and Sub2 and a Microsoft 365 subscription that includes Microsoft 365 E5 licenses.
All the subscriptions are linked to a Microsoft Entra tenant named fabrikam.com that contains the identities shown in the following table.
Exam SC-500: Image 1

The tenant contains the groups shown in the following table.
Exam SC-500: Image 2

All devices are enrolled in Microsoft Intune.
Existing Environment. Sub1 Resources
Sub1 contains a resource group named RG1 that contains the resources shown in the following table.
Exam SC-500: Image 3

SQLServer1 uses Microsoft SQL Server authentication.
Sub1 has an Azure Web Application Firewall (WAF) named WAF1 that has the following types of rule sets:

Bot Manager 1.1 -
Azure-managed Default Rule Set (DRS)
Sub1 has the following compliance standards assigned in Microsoft Defender for Cloud:

NIST SP 800-53 Rev. 4 -
Microsoft cloud security benchmark (MCSB)
System and Organization Controls (SOC) 2 Type 2
Existing Environment. Sub2 Resources
Sub2 contains a resource group named RG2.
Planned Changes and Requirements. Planned Changes
Fabrikam plans to implement the following changes:
Deploy the following key vaults to RG1:
AKV2 in the West Europe Azure region
AKV3 in the Central US Azure region
AKV4 in the East US Azure region
Deploy the following key vaults to RG2:

AKV5 in the East US region -
Configure VM1 to read data from storage1.
Create function apps that have the following hosting plans:
Fa1: Flex Consumption hosting plan

Fa2: Consumption hosting plan -

Fa3: Dedicated hosting plan -
For WAF1, implement rate limiting rules based on the request location.
Enable the NIST SP 800-53 Rev. 5 compliance standard in Defender for Cloud.
Create a new storage account named storage2 that supports Azure Table storage.
Enforce multifactor authentication (MFA) when database administrators access SQLdb1.
Implement ExpressRoute circuits to the on-premises network as shown in the following table.
Exam SC-500: Image 4

For RG1, create a new Privileged Identity Management (PIM) eligible role assignment that assigns the Contributor role to supported groups.
Planned Changes and Requirements. Technical Requirements
Fabrikam has the following technical requirements:
If VM1 is deleted, the permissions for VM1 must be removed automatically.
The AKS1 managed identity must only be able to pull images from Registry1.
The ID1 managed identity must be able to push images to and pull images from Registry1.
All the data in the storage accounts must be encrypted by using Fabrikam-managed keys.
All outbound traffic from the function apps to the on-premises network must use ExpressRoute circuits.
ExpressRoute connectivity between the on-premises network and the Azure environment must be encrypted by using Layer 2 or Layer 3 encryption.
You need to implement the planned change for SQLdb1.
Which two actions should you perform? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.

Create a compliance policy.

Configure Microsoft Entra authentication for SQLServer1.

Create a Conditional Access policy.

Configure Federated client identity for SQLdb1.

Configure a user-assigned managed identity for SQLdb1.

Implementing End-to-End Security Controls for Cloud and AI Workloads

62 more questions await

Choose your plan

Trusted by thousands of professionals

Frequently Asked Questions

Pass on your first try