CertSafari

    Free Microsoft Certified: Cloud and AI Security Engineer Associate (SC-500) Sample Questions

    35 free sample questions from our bank of 354+, covering every exam domain, with answers and detailed explanations. Updated September 2026.

    Practice all 354 questions in quiz mode

    Domain 1: Manage identity, access, and governance

    Subdomain 1.1: Secure access to resources by using Microsoft Entra ID

    1.A high-security team wants employees to sign in without ever typing a password, using a method resistant to remote phishing, and the credential must be tied to a physical hardware device the user carries. Which authentication method should be deployed?

    1. A.Microsoft Authenticator push notifications used for MFA
    2. B.FIDO2 security keys as a passwordless primary sign-in method
    3. C.SMS-based one-time passcodes for secondary authentication
    4. D.Temporary Access Pass for onboarding new employees
    Show answer & explanation

    Correct answer: B — FIDO2 security keys as a passwordless primary sign-in method

    • A. Push notifications through Microsoft Authenticator serve as a secondary MFA factor and still require a password for primary sign-in, so they do not remove passwords or use a physical hardware key.
    • B. FIDO2 security keys are a phishing-resistant, passwordless primary authentication method bound to a physical hardware device, which matches the requirement for hardware-backed, passwordless sign-in.
    • C. SMS one-time passcodes are a secondary authentication factor delivered over a phone network and are not phishing-resistant, so they do not meet the hardware-bound, phishing-resistant requirement.
    • D. A Temporary Access Pass is a time-limited passcode meant for onboarding or recovery scenarios, not a permanent hardware-bound passwordless credential for daily sign-in.

    Subdomain 1.1: Secure access to resources by using Microsoft Entra ID

    2.A phishing simulation shows that typed one-time codes are being relayed by attackers in real time. The security team wants to identify which currently deployed methods would have resisted the attack. Which of the following are considered phishing-resistant authentication methods in Microsoft Entra ID? (Select all that apply.)(Select 3)

    1. A.Windows Hello for Business
    2. B.FIDO2 security keys
    3. C.SMS-based one-time passcode
    4. D.Certificate-based authentication
    5. E.Email one-time passcode
    6. F.Voice call verification
    Show answer & explanation

    Correct answers: A, B, D — Windows Hello for Business; FIDO2 security keys; Certificate-based authentication

    • A. Windows Hello for Business binds a cryptographic credential to the user's device and is listed by Microsoft as a phishing-resistant authentication method.
    • B. FIDO2 security keys use public-key cryptography bound to a physical hardware token, making them resistant to remote phishing and credential relay.
    • C. SMS one-time passcodes are typed values that can be captured and relayed through a real-time phishing proxy, so they are not phishing-resistant.
    • D. Certificate-based authentication relies on a cryptographic certificate rather than a shared secret, which Microsoft classifies as phishing-resistant.
    • E. Email one-time passcodes are typed codes vulnerable to interception and relay, so they do not provide phishing resistance.
    • F. Voice call verification delivers a code or prompt over a phone call, which can still be socially engineered or relayed, so it is not phishing-resistant.

    Subdomain 1.1: Secure access to resources by using Microsoft Entra ID

    3.During an incident investigation, an analyst asserts that Conditional Access policies are enforced only after a user completes first-factor authentication, and therefore cannot serve as an organization's frontline defense against attacks like denial-of-service. Is this assertion accurate?

    1. A.True
    2. B.False
    Show answer & explanation

    Correct answer: A — True

    • A. Conditional Access policies are applied after first-factor authentication completes, and Microsoft documentation explicitly states Conditional Access is not intended as frontline defense against denial-of-service attacks, so this assertion is accurate.
    • B. This assertion matches documented Conditional Access behavior, so marking it false would be incorrect; policies genuinely are evaluated post-first-factor and are not a DoS defense.

    Subdomain 1.2: Secure secrets and keys by using Azure Key Vault

    4.A compliance auditor asks how the organization guarantees that keys used to encrypt production databases cannot be permanently destroyed by a single administrator who has delete permissions on the key vault, even if that administrator's account is compromised. Which Key Vault feature satisfies this requirement?

    1. A.Purge protection, which blocks permanent deletion of vault objects for the remainder of the retention period even after they are soft-deleted.
    2. B.Soft delete alone, which restores any object automatically the moment it is deleted, without requiring an explicit recovery action.
    3. C.Azure Policy audit mode, which reports noncompliant deletions after they occur without blocking the operation itself.
    4. D.Diagnostic logging, which records every deletion event so the security team can review who performed it afterward.
    Show answer & explanation

    Correct answer: A — Purge protection, which blocks permanent deletion of vault objects for the remainder of the retention period even after they are soft-deleted.

    • A. Correct — purge protection prevents anyone, including an administrator with delete rights, from permanently purging a soft-deleted key, secret, or certificate until the retention period elapses, which is exactly the guarantee the auditor is asking about.
    • B. Incorrect — soft delete moves an object into a recoverable state but, without purge protection enabled, still allows an authorized user to immediately and permanently purge it, so it alone does not block malicious destruction.
    • C. Incorrect — Azure Policy in audit mode only reports on noncompliant configurations after the fact; it does not intercept or prevent a permanent deletion from completing.
    • D. Incorrect — diagnostic logs provide a record for investigation after a deletion has already happened, but logging alone does not stop the deletion from succeeding.

    Subdomain 1.2: Secure secrets and keys by using Azure Key Vault

    5.A team stores a wildcard TLS certificate for its public website as a Key Vault secret containing the raw PFX data, rather than as a Key Vault certificate object. What is the main problem with this approach?

    1. A.The certificate cannot be enrolled for automatic renewal and rotation, which Key Vault certificate objects support natively.
    2. B.Secrets in Key Vault cannot be encrypted at rest, unlike certificate objects, exposing the private key.
    3. C.Access policies and RBAC roles cannot be applied to secrets, so the certificate would be unprotected.
    4. D.Key Vault imposes a lower maximum secret count than certificate count, risking storage capacity errors.
    Show answer & explanation

    Correct answer: A — The certificate cannot be enrolled for automatic renewal and rotation, which Key Vault certificate objects support natively.

    • A. Correct — Key Vault certificate objects support lifecycle management features like autorotation and integration with certificate authorities, while a certificate stored as a plain secret loses that automated renewal and must be tracked and rotated manually.
    • B. Incorrect — Key Vault encrypts all stored content, including secrets, at rest; the storage mechanism itself is not the issue with storing a certificate as a secret.
    • C. Incorrect — both secrets and certificates in a vault are governed by the same RBAC or access policy authorization model, so authorization is not lost by storing the certificate as a secret.
    • D. Incorrect — Key Vault does not impose a materially lower quota on secrets versus certificates that would cause capacity errors at typical usage volumes.

    Subdomain 1.2: Secure secrets and keys by using Azure Key Vault

    6.Microsoft Defender for Key Vault requires installing a software agent on the key vault resource in order to detect anomalous or malicious access attempts.

    1. A.True
    2. B.False
    Show answer & explanation

    Correct answer: B — False

    • A. Incorrect — this statement is false; Key Vault is a managed PaaS resource with no operating system to install an agent on, and Defender for Key Vault works by analyzing platform telemetry rather than agent-collected data.
    • B. Correct — Defender for Key Vault detects anomalous access by analyzing the vault's own access telemetry at the platform level, requiring no agent installation, since Key Vault has no underlying compute for an agent to run on.

    Subdomain 1.3: Implement governance to enforce security and regulatory compliance

    7.A policy that blocks all resource types except an approved list is assigned at the subscription level. A single resource group within that subscription hosts networking infrastructure that legitimately needs resource types outside the approved list. Without changing the assignment scope, how should the governance team let that resource group deploy the excluded resource types?

    1. A.Add the networking resource group to the assignment's exclusions, then assign a more permissive policy directly to it
    2. B.Change the effect of the subscription-level policy definition from Deny to Audit so the excluded resource types are only logged
    3. C.Apply a permanent policy exemption to every resource in the networking resource group so future evaluations are skipped
    4. D.Move the networking resource group into a separate subscription that has no policy assignments applied to it at all
    Show answer & explanation

    Correct answer: A — Add the networking resource group to the assignment's exclusions, then assign a more permissive policy directly to it

    • A. Excluding the resource group from the subscription-level assignment's notScopes and then assigning a more permissive policy directly to it lets the networking resources deploy while the rest of the subscription stays restricted.
    • B. Loosening the effect to Audit would remove enforcement for every resource in the entire subscription, not just the networking resource group, which is broader than intended.
    • C. A blanket, permanent exemption skips compliance evaluation entirely for that resource group rather than allowing specific resource types while still tracking the rest, which weakens governance more than necessary.
    • D. Relocating the resource group to an unmanaged subscription removes all policy coverage from it rather than selectively permitting the resource types it needs.

    Subdomain 1.3: Implement governance to enforce security and regulatory compliance

    8.Which of the following are valid effects that can be set in the policy rule of an Azure Policy definition? (Select all that apply.)(Select 3)

    1. A.Deny
    2. B.Append
    3. C.DeployIfNotExists
    4. D.Snapshot
    5. E.Rollback
    6. F.Restore
    Show answer & explanation

    Correct answers: A, B, C — Deny; Append; DeployIfNotExists

    • A. Deny is a valid effect that blocks a resource request that doesn't comply with the policy rule.
    • B. Append is a valid effect that adds additional fields, such as tags, to a resource during creation or update.
    • C. DeployIfNotExists is a valid effect that deploys a related resource when a triggering resource doesn't already have it in place.
    • D. Snapshot is not one of the effects defined in the Azure Policy effect basics; it is not something a policy rule can set.
    • E. Rollback is not a recognized Azure Policy effect; policy rules do not support reverting a resource to a prior state.
    • F. Restore is not a recognized Azure Policy effect; restoring resources is handled by services like Azure Backup, not by policy rule effects.

    Domain 2: Secure storage, databases, and networking

    Subdomain 2.1: Implement security for storage accounts

    9.A data engineering team runs an Azure Data Factory pipeline that must read from a storage account, but the storage account is restricted to selected networks and Data Factory's managed instance cannot be placed inside a specific subnet or given a stable IP range. Which network rule type should you configure?

    1. A.A resource instance network rule for the Data Factory instance
    2. B.An IP network rule for Data Factory's published IP range
    3. C.A virtual network rule for Data Factory's subnet
    4. D.A private endpoint on the storage account only
    Show answer & explanation

    Correct answer: A — A resource instance network rule for the Data Factory instance

    • A. A resource instance network rule is designed for Azure resources, like this Data Factory instance, that cannot be isolated through a virtual network or IP rule, and it uses the resource's role assignments to determine allowed operations.
    • B. Data Factory's managed compute does not expose a stable, dedicated IP range that customers can allow-list, so an IP network rule is not a reliable way to grant this access.
    • C. A virtual network rule requires the calling resource to sit inside a specific subnet with a service endpoint, which does not apply to a managed Data Factory instance that is not deployed into the customer's subnet.
    • D. Adding only a private endpoint changes how the storage account is reached but does not, by itself, grant Data Factory's managed instance access without also configuring managed private endpoints or another allow rule.

    Subdomain 2.1: Implement security for storage accounts

    10.A regulator requires that a storage account never negotiate connections using outdated TLS versions, even if a legacy client attempts to connect with an older protocol. Which storage account setting enforces this?

    1. A.Minimum TLS version
    2. B.Secure transfer required
    3. C.Default network action
    4. D.Blob soft delete retention period
    Show answer & explanation

    Correct answer: A — Minimum TLS version

    • A. The minimum TLS version setting rejects any connection attempt that negotiates a protocol version below the configured floor, which stops legacy clients from downgrading to an outdated TLS version.
    • B. Secure transfer required only distinguishes between HTTP and HTTPS; it does not control which TLS versions are accepted once a connection uses HTTPS.
    • C. The default network action determines whether unlisted networks can reach the storage endpoint at all, which is unrelated to the TLS protocol version used once a connection is permitted.
    • D. Blob soft delete retention controls how long deleted blobs are recoverable and has no relationship to the transport-layer encryption protocol used for connections.

    Subdomain 2.1: Implement security for storage accounts

    11.Under the default configuration, Defender for Storage malware scanning stops scanning new uploads for the rest of the month once a storage account reaches ___ GB of uploaded blobs scanned.

    1. A.10,000
    2. B.1,000
    3. C.100,000
    Show answer & explanation

    Correct answer: A — 10,000

    • A. The documented default cap is 10,000 GB of uploaded blobs scanned per storage account per month, after which scanning pauses until the next month or until the cap is raised.
    • B. 1,000 GB is well below the actual default cap and would cause scanning to stop far earlier than Defender for Storage's documented out-of-the-box behavior.
    • C. 100,000 GB is well above the actual default cap; administrators can raise the limit to values like this, but it is not the unmodified default.

    Subdomain 2.2: Implement security for databases

    12.A multi-tenant SaaS application stores all tenants' records in shared tables within a single Azure SQL database. The team needs each tenant's queries to automatically return only that tenant's rows, without changing application queries. Which feature should they implement?

    1. A.Row-Level Security, defining a security predicate function that filters rows based on the execution context of the querying user.
    2. B.Dynamic data masking, configuring masking rules so unauthorized users see obfuscated values instead of the real tenant data.
    3. C.Transparent data encryption, enabling encryption at rest so each tenant's data is protected from offline access to backup files.
    4. D.Always Encrypted, designating tenant identifier columns as encrypted so only authorized client applications can decrypt them.
    Show answer & explanation

    Correct answer: A — Row-Level Security, defining a security predicate function that filters rows based on the execution context of the querying user.

    • A. Row-Level Security uses a security predicate function tied to the execution context of the querying user to transparently filter which rows are returned, matching the requirement of per-tenant row filtering without changing application queries.
    • B. Dynamic data masking obfuscates the values shown in columns for nonprivileged users; it does not filter out entire rows belonging to other tenants.
    • C. Transparent data encryption protects the whole database from offline access to raw files or backups, but it does not restrict which rows a live query returns.
    • D. Always Encrypted protects specific column values from being read in plaintext by unauthorized parties, but it does not implement per-tenant row filtering.

    Subdomain 2.2: Implement security for databases

    13.A company runs SQL Server on a fleet of Azure virtual machines and wants Defender for Cloud threat protection for those instances, with the option to also enable monitoring at the Log Analytics workspace level for broader coverage. Which Defender for Databases plan applies?

    1. A.Microsoft Defender for SQL Servers on Machines, which can additionally be enabled on a Log Analytics workspace for enhanced monitoring.
    2. B.Microsoft Defender for Azure SQL Databases, which protects platform-as-a-service databases and has no virtual machine coverage option.
    3. C.Microsoft Defender for Open-Source Relational Databases, which covers PostgreSQL and MySQL but not SQL Server on virtual machines.
    4. D.Microsoft Defender for Azure Cosmos DB, which provides threat protection for Cosmos DB accounts rather than SQL Server workloads.
    Show answer & explanation

    Correct answer: A — Microsoft Defender for SQL Servers on Machines, which can additionally be enabled on a Log Analytics workspace for enhanced monitoring.

    • A. Microsoft Defender for SQL Servers on Machines offers security for SQL Server running on virtual machines or physical servers, and it can also be enabled on a Log Analytics workspace for enhanced monitoring and threat detection, matching both requirements.
    • B. Defender for Azure SQL Databases protects the platform-as-a-service offering; it is not the plan for SQL Server instances running inside virtual machines.
    • C. Defender for Open-Source Relational Databases covers engines such as PostgreSQL and MySQL, not SQL Server workloads running on virtual machines.
    • D. Defender for Azure Cosmos DB is scoped to Cosmos DB accounts and has no relevance to SQL Server running on virtual machines.

    Subdomain 2.2: Implement security for databases

    14.Viewing SQL audit logs inside a user database requires the `___` permission.

    1. A.VIEW DATABASE SECURITY AUDIT
    2. B.VIEW SERVER STATE
    3. C.ALTER ANY DATABASE AUDIT
    Show answer & explanation

    Correct answer: A — VIEW DATABASE SECURITY AUDIT

    • A. This permission is specifically required within the user database to view the audit logs generated by SQL auditing.
    • B. This permission grants visibility into server-level dynamic management views and state information; it is not the permission tied to viewing audit logs in a user database.
    • C. This is not a real SQL permission name and does not control access to audit log records.

    Subdomain 2.3: Implement security for Azure network services

    15.A global enterprise has hundreds of virtual networks across dozens of subscriptions and wants to enforce a baseline set of deny rules for a risky port across all of them from one place, without relying on each subnet owner to configure their own NSGs correctly. Which Azure capability should the security team use?

    1. A.Deploy a security admin configuration in Azure Virtual Network Manager and apply it to a network group containing the target virtual networks
    2. B.Ask every subnet owner to add an identical deny rule to their local network security group and audit compliance manually
    3. C.Create a single network security group in one subscription and attempt to associate it with subnets in every other subscription
    4. D.Configure Azure Firewall Manager policies and rely on user-defined routes to force all traffic through a central firewall instance
    Show answer & explanation

    Correct answer: A — Deploy a security admin configuration in Azure Virtual Network Manager and apply it to a network group containing the target virtual networks

    • A. Security admin configurations in Azure Virtual Network Manager are deployed once across a network group and enforce baseline rules across subscriptions and tenants, independent of local NSGs.
    • B. Relying on manual per-subnet configuration reintroduces the inconsistency and audit burden the team is trying to eliminate.
    • C. A network security group is associated with subnets or NICs within its own scope, not shared globally across subscriptions the way a network group configuration is.
    • D. Firewall Manager and forced routing add a central inspection point but do not directly enforce NSG-independent baseline rules the way security admin rules do.

    Subdomain 2.3: Implement security for Azure network services

    16.A company stores sensitive data in Azure SQL Database and wants clients inside its virtual network to reach the database over a private IP address while blocking all access over the database's public endpoint. What should they configure?

    1. A.A private endpoint for the SQL server, then disable public network access on the SQL server
    2. B.A service endpoint for Microsoft.Sql on the client subnet, leaving public network access enabled
    3. C.A virtual network peering connection between the client virtual network and the SQL server's managed network
    4. D.An application security group applied to the SQL server's network interface to filter inbound connections
    Show answer & explanation

    Correct answer: A — A private endpoint for the SQL server, then disable public network access on the SQL server

    • A. A private endpoint brings the SQL server into the virtual network with a private IP address, and disabling public network access ensures the public endpoint can no longer be used.
    • B. A service endpoint keeps the connection over the server's public IP and does not by itself block the public endpoint from being reached elsewhere.
    • C. Azure SQL Database is a managed platform service and does not expose a network to peer with directly, so peering does not apply here.
    • D. Application security groups are used within network security group rules for virtual machine NICs, not for filtering access to a managed SQL server.

    Subdomain 2.3: Implement security for Azure network services

    17.An ISV built its own multitenant service running behind a Standard Load Balancer in its own virtual network, and wants customers to connect to it privately from their own virtual networks without exposing it to the public internet. What should the ISV configure?

    1. A.An Azure Private Link service referencing the existing Standard Load Balancer, then share the generated alias with customers
    2. B.A Basic Load Balancer with a public frontend IP that customers can access through IP allowlisting
    3. C.A private endpoint pointed at each customer's own virtual network to pull their traffic into the ISV's network
    4. D.A site-to-site VPN gateway connecting the ISV's virtual network to every customer's on-premises network
    Show answer & explanation

    Correct answer: A — An Azure Private Link service referencing the existing Standard Load Balancer, then share the generated alias with customers

    • A. Azure Private Link service is created on top of a Standard Load Balancer and generates a shareable alias that customers use to request a private connection.
    • B. A Basic Load Balancer with a public frontend does not provide private, Private Link-based connectivity, and Private Link service does not support Basic Load Balancer anyway.
    • C. A private endpoint is created by the consumer in their own virtual network pointing at the provider's service, not the other way around.
    • D. A site-to-site VPN gateway connects whole networks and would need to be built per customer, which does not scale the way Private Link service does.

    Domain 3: Secure compute

    Subdomain 3.1: Implement security for AI

    18.An analyst in DSPM for AI wants to see prompts and responses along with sensitive information types detected, filtered by date, user, and AI app, across Copilot experiences, enterprise AI apps, and other AI apps. Which DSPM for AI page provides this detailed activity-level view?

    1. A.Activity explorer
    2. B.Data risk assessments
    3. C.Policies
    4. D.Recommendations
    Show answer & explanation

    Correct answer: A — Activity explorer

    • A. Activity explorer shows granular event data including activity type, user, timestamp, AI app category, sensitive information types, and referenced files, matching the detailed filtering described.
    • B. Data risk assessments focus on identifying oversharing risk in SharePoint or Fabric content rather than showing individual prompt-and-response activity records.
    • C. The Policies page tracks the status of default and custom policies created across Purview solutions, not per-event activity details like prompts and sensitive info types.
    • D. Recommendations lists suggested configuration actions for the tenant, such as creating sensitivity labels, rather than displaying individual activity records.

    Subdomain 3.1: Implement security for AI

    19.A security analyst suspects that a single compromised agent 'blueprint' could grant an attacker access to many linked agent identities and their combined permissions across Microsoft Graph and custom APIs. Which Defender XDR capability is designed to help analyze this kind of impact scope?

    1. A.Blast radius analysis with a graph-based view of agent interactions and data flow
    2. B.Azure Disk Encryption key rotation reporting
    3. C.Azure Web Application Firewall rule tuning recommendations
    4. D.Just-in-time VM access approval history
    Show answer & explanation

    Correct answer: A — Blast radius analysis with a graph-based view of agent interactions and data flow

    • A. Defender XDR can assess the blast radius of an agent identity and visualize, in a graph-based view, how agents interact, what dependencies exist, and where data flows, which is exactly the impact-scope analysis described.
    • B. Disk encryption key rotation reporting relates to protecting data at rest on virtual machine disks and has no connection to analyzing agent identity permission scope or blast radius.
    • C. WAF rule tuning addresses web application traffic filtering and is unrelated to analyzing how compromised agent identities and their permissions connect to other resources.
    • D. JIT VM access approval history tracks temporary elevated access requests to virtual machines and does not analyze the interconnected permission blast radius of AI agent identities.

    Subdomain 3.1: Implement security for AI

    20.Defender CSPM automatically discovers deployed generative AI workloads across several services to build an AI Bill of Materials. Which of the following services are included in this automatic discovery? (Choose 3.)(Select 3)

    1. A.Azure OpenAI Service
    2. B.Azure Machine Learning
    3. C.Amazon Bedrock
    4. D.Azure Bastion
    5. E.Azure Disk Encryption
    Show answer & explanation

    Correct answers: A, B, C — Azure OpenAI Service; Azure Machine Learning; Amazon Bedrock

    • A. Azure OpenAI Service is one of the services Defender for Cloud continuously and automatically discovers to build visibility into deployed AI workloads.
    • B. Azure Machine Learning is included in the automatic AI workload discovery, giving visibility into machine learning-based AI components across the environment.
    • C. Amazon Bedrock is included as a cross-cloud AI service that Defender for Cloud discovers when the AWS account is connected, reflecting the multicloud scope of AI security posture management.
    • D. Azure Bastion is a secure remote access service for virtual machines and is not part of the AI workload discovery that builds the AI Bill of Materials.
    • E. Azure Disk Encryption protects VM disk data at rest and is unrelated to the generative AI service discovery that populates the AI Bill of Materials.

    Subdomain 3.3: Implement security for application platform services

    21.A Logic Apps workflow exposes a Request trigger whose callback URL was accidentally posted in a public chat channel. Without disabling the trigger, what is the fastest way to invalidate the leaked URL while keeping the workflow available to legitimate callers?

    1. A.Regenerate the access key that signs the callback URL
    2. B.Enable Microsoft Entra ID OAuth policies on the trigger
    3. C.Add allowed caller IP address ranges
    4. D.Turn on Secure Inputs for the trigger
    Show answer & explanation

    Correct answer: A — Regenerate the access key that signs the callback URL

    • A. Request trigger callback URLs are signed with a shared access signature derived from the workflow's access keys. Regenerating the key immediately invalidates every previously issued URL, including the leaked one, while a fresh URL keeps the workflow reachable.
    • B. Configuring OAuth policies changes how future callers must authenticate, but the already-issued SAS-signed URL keeps working until the underlying key is rotated. This is a more involved change and does not by itself invalidate the leaked link fastest.
    • C. IP allow-listing restricts which networks can call the trigger, but the leaked URL would still work from within an allowed range if the caller's traffic can be routed through one. It does not invalidate the signature itself.
    • D. Secure Inputs hides sensitive data in the run history from viewers of the workflow, but it does not change or invalidate the trigger's signed callback URL. A caller with the leaked URL could still invoke the workflow.

    Subdomain 3.3: Implement security for application platform services

    22.A security operations team wants Defender for Containers to both surface Kubernetes misconfigurations before deployment and detect suspicious activity, such as an exposed dashboard, while workloads are running. Which two core capabilities together satisfy both needs? (Select all that apply.)(Select 2)

    1. A.Security posture management
    2. B.Run-time threat protection
    3. C.Geo-replication of container images
    4. D.Repository namespace isolation
    5. E.Retention policy on untagged manifests
    Show answer & explanation

    Correct answers: A, B — Security posture management; Run-time threat protection

    • A. Security posture management continuously monitors cloud and Kubernetes APIs, discovers misconfigurations, and provides mitigation guidance before workloads are compromised. This satisfies the requirement to surface misconfigurations before deployment.
    • B. Run-time threat protection detects suspicious activity such as exposed Kubernetes dashboards or exposed services while clusters, nodes, and workloads are actively running. This satisfies the requirement to detect suspicious runtime activity.
    • C. Geo-replication is a container registry feature for distributing images across regions to reduce latency. It is unrelated to detecting misconfigurations or runtime threats.
    • D. Repository namespace isolation organizes images within a registry for different teams or products. It provides no misconfiguration detection or runtime threat monitoring capability.
    • E. A retention policy on untagged manifests manages registry storage by cleaning up old image data over time. It performs no misconfiguration detection or runtime threat monitoring.

    Subdomain 3.3: Implement security for application platform services

    23.Enabling App Service authentication (Easy Auth) with the 'Allow unauthenticated requests' option automatically blocks all anonymous access to the application without any additional application code.

    1. A.True
    2. B.False
    Show answer & explanation

    Correct answer: B — False

    • A. This would be incorrect because the 'Allow unauthenticated requests' option specifically defers authorization decisions to the application code rather than blocking anonymous traffic at the platform level.
    • B. 'Allow unauthenticated requests' passes authentication information through in headers for authenticated callers but still lets anonymous requests reach the application, so blocking access requires the app's own authorization logic or the 'Require authentication' setting instead.

    Subdomain 3.2: Implement security for servers and virtual machines (VMs)

    24.A team must encrypt temp disks, disk caches, and the data flowing between compute and storage for a fleet of Azure VMs, but must not add CPU overhead inside the guest OS and must not depend on Key Vault-hosted secrets. Which option should they enable on the VMs?

    1. A.Encryption at host
    2. B.Azure Disk Encryption
    3. C.Platform-managed server-side encryption
    4. D.Confidential disk encryption
    Show answer & explanation

    Correct answer: A — Encryption at host

    • A. Encryption at host extends Azure Disk Storage server-side encryption to temp disks, caches, and data in transit to storage, using platform-managed keys by default and without consuming guest VM CPU cycles.
    • B. This relies on BitLocker or DM-Crypt running inside the guest OS and integrates with Azure Key Vault for key management, so it adds guest CPU overhead and a Key Vault dependency the requirement rules out.
    • C. Standard server-side encryption is always on for OS and data disks, but it does not cover temp disks or disk caches, so it does not meet the stated requirement on its own.
    • D. This protects the OS disk by binding keys to the VM's vTPM through a secure release protocol, which is a stronger guarantee than needed here and is scoped to confidential VM sizes rather than a general VM fleet.

    Subdomain 3.2: Implement security for servers and virtual machines (VMs)

    25.Which of the following are valid enforcement modes that can be assigned to an Azure Machine Configuration policy?(Select 3)

    1. A.Audit
    2. B.Apply and Monitor
    3. C.Apply and Autocorrect
    4. D.Deny
    5. E.Quarantine
    Show answer & explanation

    Correct answers: A, B, C — Audit; Apply and Monitor; Apply and Autocorrect

    • A. Audit is a valid enforcement mode that only reports on the machine's compliance state without changing any settings.
    • B. Apply and Monitor is a valid mode that applies the configuration once and then watches for subsequent changes.
    • C. Apply and Autocorrect is a valid mode that applies the configuration and automatically reapplies it whenever drift is detected.
    • D. Deny is an Azure Policy effect used to block noncompliant resource deployments; it is not one of Machine Configuration's enforcement modes.
    • E. Quarantine is not an enforcement mode offered by Machine Configuration for policy assignments.

    Subdomain 3.2: Implement security for servers and virtual machines (VMs)

    26.A multicloud security team is designing just-in-time access for both Azure VMs and AWS EC2 instances connected through Defender for Cloud. Which statements accurately describe how just-in-time access behaves in this setup?(Select 3)

    1. A.For Azure VMs, Defender for Cloud configures NSG and Azure Firewall rules to allow the approved port and IP.
    2. B.For AWS instances, Defender for Cloud creates a new EC2 security group to allow the approved inbound traffic.
    3. C.A requester must have Azure RBAC permissions on the VM before an access request can be approved.
    4. D.Connections already established before the access window expires are forcibly disconnected.
    5. E.Just-in-time access applies identically to every requester, regardless of their assigned RBAC role.
    Show answer & explanation

    Correct answers: A, B, C — For Azure VMs, Defender for Cloud configures NSG and Azure Firewall rules to allow the approved port and IP.; For AWS instances, Defender for Cloud creates a new EC2 security group to allow the approved inbound traffic.; A requester must have Azure RBAC permissions on the VM before an access request can be approved.

    • A. For Azure resources, approved just-in-time requests result in NSG and Azure Firewall rule changes that allow inbound traffic to the selected ports from the approved IP for the requested duration.
    • B. For AWS resources, Defender for Cloud creates a new EC2 security group to permit the approved inbound traffic rather than modifying NSGs, which don't exist in AWS.
    • C. Before approving an access request, Defender for Servers checks that the requesting user has Azure RBAC permissions for that specific VM.
    • D. Connections that are already established remain active and are not interrupted when the approved access period expires; only new connection attempts are blocked afterward.
    • E. Access approval depends on the requester's RBAC permissions for the target VM, so behavior is not identical for every requester regardless of role.

    Domain 4: Manage and monitor security posture

    Subdomain 4.1: Manage security posture by using Defender for Cloud

    27.A cloud security team enables Defender CSPM across their Azure, AWS, and GCP environments. They notice a critical finding highlighting an internet-exposed VM with a stored credential that grants access to a sensitive storage account, shown as a connected chain of exposure. Which Defender for Cloud capability generated this specific end-to-end exposure chain?

    1. A.Attack path analysis, which maps exploitable routes between internet-facing resources and sensitive data by correlating exposure, vulnerabilities, and lateral movement
    2. B.Secure score, which aggregates recommendation compliance into a single percentage without tracing resource-to-resource relationships
    3. C.Regulatory compliance dashboard, which tracks control status against standards like the Microsoft Cloud Security Benchmark
    4. D.Workflow automation, which triggers Logic Apps when a recommendation or alert changes state
    Show answer & explanation

    Correct answer: A — Attack path analysis, which maps exploitable routes between internet-facing resources and sensitive data by correlating exposure, vulnerabilities, and lateral movement

    • A. Attack path analysis, part of the paid Defender CSPM plan, correlates exposure, vulnerabilities, and lateral movement potential to surface exactly this kind of connected exposure chain from an internet-facing VM to sensitive data.
    • B. Secure score summarizes overall posture as a percentage based on recommendation completion, but it does not trace or visualize connections between individual resources.
    • C. The regulatory compliance dashboard reports control-by-control status against a chosen standard, not multi-hop exposure chains between resources.
    • D. Workflow automation reacts to state changes by triggering a Logic App; it does not compute or display exposure chains itself.

    Subdomain 4.1: Manage security posture by using Defender for Cloud

    28.A platform team manages all of its AWS infrastructure as Terraform code and wants the Defender for Cloud AWS connector's access permissions deployed the same way for a single AWS account, avoiding a manual CloudFormation stack. Which deployment method should they choose during onboarding?

    1. A.Terraform, selected as the deployment method during the configure access step
    2. B.AWS CloudFormation with an Amazon S3 URL template, since Terraform isn't supported for any AWS connector
    3. C.AWS Systems Manager Run Command, executed manually against each EC2 instance
    4. D.Azure Resource Manager templates, deployed directly into the AWS account through Azure Arc
    Show answer & explanation

    Correct answer: A — Terraform, selected as the deployment method during the configure access step

    • A. For a single AWS account connector, Terraform is offered as a deployment method alongside CloudFormation in the configure access step, matching the team's existing infrastructure-as-code workflow.
    • B. Terraform is supported for single-account onboarding, so this option incorrectly claims it is unsupported and forces an unnecessary CloudFormation stack.
    • C. Run Command executes operational scripts on instances; it does not deploy the IAM roles and permissions the connector needs.
    • D. Azure Resource Manager templates deploy Azure resources and cannot be used to create IAM permissions inside an AWS account.

    Subdomain 4.1: Manage security posture by using Defender for Cloud

    29.Agentless vulnerability scanning through Microsoft Defender Vulnerability Management is enabled by default when Defender for Servers ____ is turned on.

    1. A.Plan 1
    2. B.Plan 2
    3. C.the Foundational CSPM plan
    Show answer & explanation

    Correct answer: B — Plan 2

    • A. Plan 1 provides Defender for Endpoint integration but does not turn on agentless scanning by default.
    • B. Plan 2 is the tier where agentless vulnerability scanning is enabled by default, alongside the Defender for Servers CSPM plan.
    • C. The Foundational CSPM plan is a posture management plan unrelated to Defender for Servers scanning behavior.

    Subdomain 4.2: Implement activity and event collection in Microsoft Sentinel

    30.A Windows Security Events via AMA connector has been configured on a set of domain controllers. Where does this connector write the collected security events in the Log Analytics workspace?

    1. A.The SecurityEvent table
    2. B.The WindowsEvent table
    3. C.The CommonSecurityLog table
    4. D.The SigninLogs table
    Show answer & explanation

    Correct answer: A — The SecurityEvent table

    • A. The Windows Security Events via AMA connector writes collected events into the SecurityEvent table, which many built-in Windows security analytics rules query.
    • B. The WindowsEvent table is populated by the Windows Forwarded Events connector used with Windows Event Forwarding, not by the direct AMA security events connector.
    • C. CommonSecurityLog stores CEF-formatted data from network and security appliances, not Windows Security event log entries.
    • D. SigninLogs stores Microsoft Entra ID sign-in activity from the Entra connector, not on-premises Windows Security event log data.

    Subdomain 4.2: Implement activity and event collection in Microsoft Sentinel

    31.A SOC manager wants incidents automatically tagged and assigned to the right team without writing any Logic Apps workflow logic, while still keeping the option to later call a more complex remediation workflow if needed. Which Sentinel component should they configure first to achieve the no-code tagging and assignment behavior?

    1. A.An automation rule
    2. B.A playbook
    3. C.A hunting query
    4. D.A workbook
    Show answer & explanation

    Correct answer: A — An automation rule

    • A. Automation rules let an analyst tag, assign, or close incidents directly from a central rule configuration without needing a playbook, and can still invoke a playbook as one of their actions.
    • B. A playbook is a Logic Apps-based workflow; building one requires designing workflow logic, which is more effort than the no-code tagging and assignment the manager wants first.
    • C. A hunting query is used to proactively search data for threats and does not perform incident tagging, assignment, or automated response actions.
    • D. A workbook visualizes and reports on data through dashboards and does not perform incident-handling automation like tagging or assignment.

    Subdomain 4.2: Implement activity and event collection in Microsoft Sentinel

    32.A team is deciding between the Windows Security Events via AMA connector and the Windows Forwarded Events connector for a set of workstations. If they choose the Windows Forwarded Events connector because the workstations already forward events to a Windows Event Collector, which table receives the ingested data instead of SecurityEvent?

    1. A.WindowsEvent
    2. B.CommonSecurityLog
    3. C.Syslog
    4. D.OfficeActivity
    Show answer & explanation

    Correct answer: A — WindowsEvent

    • A. The Windows Forwarded Events connector, used with Windows Event Forwarding, writes ingested events into the WindowsEvent table rather than SecurityEvent.
    • B. CommonSecurityLog holds CEF-formatted data from network and security appliances, not events collected through Windows Event Forwarding.
    • C. Syslog holds raw Syslog messages from Linux and appliance sources and has no relationship to Windows Event Forwarding data.
    • D. OfficeActivity holds Microsoft 365 audit data from the Office 365 connector, unrelated to on-premises Windows event forwarding.

    Subdomain 4.3: Implement Microsoft Security Copilot

    33.A holding company with several independently managed business units wants separate Security Compute Unit allocations, isolated agent traffic, and distinct data storage locations per unit, all within the same overall tenant. What should the admin configure?

    1. A.Separate Security Copilot workspaces, each with its own capacity and data location settings
    2. B.A single workspace configured with multiple Microsoft Entra tenants attached to it
    3. C.Separate Copilot contributor role assignments for each business unit within one workspace
    4. D.Multiple preinstalled plugin configurations layered inside a single workspace
    Show answer & explanation

    Correct answer: A — Separate Security Copilot workspaces, each with its own capacity and data location settings

    • A. This is correct: workspaces are the scoped, tenant-bound boundary Security Copilot uses to segment capacity, agentic traffic, and data storage location per business unit.
    • B. A workspace doesn't attach multiple Entra tenants to itself; cross-tenant access is instead handled through tenant switching, GDAP, or Azure Lighthouse for MSSP-style scenarios.
    • C. Role assignments control who can act as owner or contributor, but they don't create separate capacity pools or separate data storage locations for each business unit.
    • D. Plugin configuration controls which data sources are available in prompts, but it doesn't provide the capacity isolation or per-unit data location separation the scenario requires.

    Subdomain 4.3: Implement Microsoft Security Copilot

    34.Security Copilot Owner and Contributor roles are Microsoft Entra ID roles that also appear in the Entra admin center's role list.

    1. A.True
    2. B.False
    Show answer & explanation

    Correct answer: B — False

    • A. This is incorrect: Security Copilot RBAC roles are defined and managed within Copilot itself, not as Microsoft Entra ID roles in the Entra admin center.
    • B. This is correct: Owner and Contributor function like access groups scoped to Security Copilot's own platform features, separate from Microsoft Entra ID's role system.

    Subdomain 4.3: Implement Microsoft Security Copilot

    35.Removing an agent from the Active agents list in Security Copilot automatically cancels any associated Security Store subscription billing.

    1. A.True
    2. B.False
    Show answer & explanation

    Correct answer: B — False

    • A. This is incorrect: Security Store purchases and subscriptions are managed and billed separately from the Security Copilot platform.
    • B. This is correct: removing an agent from Security Copilot doesn't end its subscription; billing must be managed directly in Security Store.

    Want the full experience?

    These are just samples. Practice the full Microsoft Certified: Cloud and AI Security Engineer Associate (SC-500) question bank in quiz mode — free, no signup, with domain practice and exam simulation.

    Practice all 354 questions in quiz mode