SC-500 Microsoft · Cloud and AI Security Engineer

SC-500 practice test

Implementing End-to-End Security Controls for Cloud and AI Workloads. A full SC-500 practice exam across the skills outline: identity and governance, storage, databases and networking, compute and AI workloads, and security posture, with a case study and exhibits.

  • 2 practice tests + challenge test
  • 150 questions
  • 40 questions, 100 min per test
  • Pass at 70%

Take the free SC-500 diagnostic10 questions, no card needed

Free SC-500 sample questions

3 questions from the free diagnostic, with answers and explanations.

Question 1 · Secure access to resources by using Microsoft Entra ID

A VM needs an identity to read from a key vault, and the identity must be deleted automatically when the VM is deleted. Which identity type fits?

  1. A system-assigned managed identity
  2. A user-assigned managed identity
  3. An app registration with a secret
  4. A guest user account from a partner tenant
Show answer

Answer: A (A system-assigned managed identity)

A system-assigned identity is tied to the life cycle of its Azure resource and is deleted with it.

Question 2 · Secure secrets and keys by using Azure Key Vault

After the key vault firewall is enabled to allow only the hospital's network, an admin at home can still change the vault's tags and diagnostic settings in the Azure portal. Why?

  1. Firewall rules cover the data plane only
  2. The firewall needs an hour to take effect
  3. Tags are stored outside the vault
  4. The admin has Key Vault Secrets User
Show answer

Answer: A (Firewall rules cover the data plane only)

Azure Key Vault firewall rules apply only to data-plane operations.

Question 3 · Implement governance to enforce security and regulatory compliance

A ReadOnly lock is placed on a resource group. What happens when an engineer tries to move a storage account into that resource group?

  1. The move is blocked
  2. The move succeeds, but keys are hidden
  3. The lock is removed automatically
  4. The move succeeds after approval
Show answer

Answer: A (The move is blocked)

A read-only lock on a resource group prevents you from moving existing resources in or out of the resource group.

Try the full diagnostic free

What the SC-500 practice covers

Share of practice questions per skill area.

  • Implement security for Azure network services14%
  • Secure access to resources by using Microsoft Entra ID10%
  • Implement security for AI10%
  • Manage security posture by using Defender for Cloud10%
  • Secure secrets and keys by using Azure Key Vault8%
  • Implement governance to enforce security and regulatory compliance8%
  • Implement security for storage accounts8%
  • Implement security for servers and virtual machines (VMs)8%
  • Implement activity and event collection in Microsoft Sentinel8%
  • Implement security for databases6%
  • Implement security for application platform services6%
  • Implement Microsoft Security Copilot4%

Question formats

  • Single choice
  • Multiple select
  • Hotspot (drop-down and yes/no)
  • Case studies
  • Exhibits (screenshots, diagrams and code)

Career path: Cloud and AI Security Engineer

Secure Azure and AI workloads end to end: identity and Key Vault, storage, databases and networks, VMs, containers and AI agents, and posture with Defender for Cloud and Microsoft Sentinel.

  1. SC-900
  2. SC-500

Guides

SC-500 practice test FAQ

Is there a free SC-500 practice test?

Yes. Create a free account and take the SC-500 free diagnostic: 10 questions across every skill area of the exam, with a study plan for the topics to work on. You can retake it as often as you like.

How many questions are in each ExamKite SC-500 practice test?

Each full practice test has 40 questions with a 100-minute timer, and you pass at 70%. There are 2 practice tests plus a harder challenge test, with 150 questions in total.

Which question formats does the SC-500 practice include?

Single choice, multiple select, hotspot (drop-down and yes/no), case studies and exhibits (screenshots, diagrams and code), the same formats you meet on the real exam.

Are these real SC-500 exam questions?

No. They are original questions written for ExamKite and mapped to the Microsoft skills outline, never copied from the real exam. Using leaked exam questions breaks the certification provider's exam rules and can get your certification revoked.

More answers in the full FAQ.

Ready to practice for SC-500?

Start with the free diagnostic and get a study plan for the topics you miss.

Create a free account