PracticeVideosBlogFlashcardsEspañol
All Practice Exams

Free Practice Questions for SC-500

Exam-style questions and explanations by OpenExamPrep.

✓ No registration✓ No credit card
116+ Questions
100% Free

Loading practice questions...

Same family resources

Explore More Microsoft Azure Certifications

Continue into nearby exams from the same family. Each card keeps practice questions, study guides, flashcards, videos, and articles in one place.

Azure AI-900

Practice QuestionsStudy GuideCheat SheetFlashcards4 videos5 blogs

Azure AZ-104

Practice QuestionsStudy GuideCheat SheetFlashcards4 videos5 blogs

Azure AZ-900

Practice QuestionsStudy GuideCheat SheetFlashcards4 videos5 blogs

Azure DP-700

Practice QuestionsStudy GuideCheat SheetFlashcards3 videos4 blogs

Microsoft Azure AI App and Agent Developer (AI-103)

Practice QuestionsStudy GuideCheat SheetFlashcards3 videos3 blogs

Azure AI-102

Practice QuestionsStudy GuideCheat SheetFlashcards2 videos2 blogs

More From This Family

Videos and articles for deeper review.

VideoAI-102 vs AI-103 in 2026: Which Azure AI Exam, Foundry Shift, and Study MigrationVideoAI-200 Study Guide 2026: Build One Project Across All 4 DomainsVideoAI-900 Exam Guide 2026: FREE Azure AI Fundamentals Study PlanVideoAWS AI Practitioner vs Azure AI Fundamentals: Which AI Certification in 2026ArticleFREE DP-300 Exam Guide 2026: 5-Domain Skills Outline + Pass on First Try16 min readArticleAzure vs AWS Certification 2026: Which Cloud Cert Should You Get First?18 min readArticleAZ-104 Study Guide 2026: Pass the Azure Administrator Exam19 min readArticleFREE AZ-700 Exam Guide 2026: 5 Domains, $165, Pass Score 700/100017 min read
Exam Review

Key Facts: SC-500 Exam

$165

Exam Fee (USD)

Microsoft

120 min

Exam Duration

Microsoft

700/1000

Passing Score

Microsoft

40-60

Approximate Questions

Microsoft

Associate

Certification Level

Microsoft

Successor to AZ-500

Replaces AZ-500

Microsoft

As of May 2026, Microsoft lists SC-500: Implementing End-to-End Security Controls for Cloud and AI Workloads as a role-based associate exam costing $165 USD, lasting 120 minutes, with roughly 40-60 questions and a 700 out of 1000 passing score delivered through Pearson VUE. The four skills-measured areas are Manage identity, access, and governance (20-25%), Secure storage, databases, and networking (25-30%), Secure compute (20-25%, including security for AI), and Manage and monitor security posture (20-25%). SC-500 is the successor to AZ-500 and left beta in 2026 and is generally available.

Sample SC-500 Practice Questions

Try these sample questions to review concepts for the SC-500 exam. Each question includes a detailed explanation. Start the interactive quiz above for the full 116+ question experience with AI tutoring.

1Which Microsoft Entra ID feature provides just-in-time, time-bound activation of privileged role assignments with approval workflows and access reviews?
A.Privileged Identity Management (PIM)
B.Conditional Access
C.Entra ID Protection
D.Managed identities
Explanation: Privileged Identity Management (PIM) lets you make role assignments eligible rather than permanent, so users activate roles just-in-time for a limited window. PIM also supports approval workflows, MFA on activation, justification, and recurring access reviews to reduce standing privileged access.
2A Conditional Access policy must require multifactor authentication only when a user's sign-in is flagged as high risk. Which condition should the policy use?
A.User risk
B.Sign-in risk
C.Device platform
D.Named locations
Explanation: Sign-in risk represents the probability that a specific authentication request is not authorized, calculated in real time by Entra ID Protection. Targeting the sign-in risk condition lets the policy require MFA only for that risky sign-in. User risk instead reflects the probability the account itself is compromised over time.
3Which authentication method offers the strongest, phishing-resistant passwordless sign-in for Microsoft Entra ID?
A.SMS one-time passcode
B.Security questions
C.FIDO2 security keys
D.Email one-time passcode
Explanation: FIDO2 security keys are phishing-resistant because the credential is bound to the legitimate domain and never leaves the hardware key, defeating replay and credential-phishing attacks. SMS and email one-time passcodes are vulnerable to interception and phishing, so they are weaker methods.
4You want an Azure virtual machine to read secrets from Azure Key Vault without storing any credentials in code. What should you configure?
A.A service principal with a client secret stored in app settings
B.A shared access signature token embedded in the VM image
C.A user account with the Key Vault Administrator role
D.A system-assigned managed identity granted access to the vault
Explanation: A system-assigned managed identity gives the VM an Entra identity managed by Azure, so it can authenticate to Key Vault without any stored secret. You grant that identity access through a Key Vault access policy or Azure RBAC, eliminating credentials in code.
5Which setting in Microsoft Entra ID limits which applications users can consent to and lets admins require admin approval for risky permission requests?
A.User consent settings and the admin consent workflow
B.Cross-tenant access settings
C.Authentication strength policies
D.Token lifetime policies
Explanation: User consent settings control whether and to which apps users may grant OAuth permissions, and the admin consent workflow lets users request admin approval for permissions they cannot self-consent to. Together they reduce illicit consent grant attacks where attackers trick users into authorizing malicious apps.
6Which Key Vault configuration restricts vault access to specific virtual networks and trusted Azure services while blocking all other public traffic?
A.Soft-delete and purge protection
B.Key Vault firewall with network rules and the trusted services exception
C.Role-based access control assignments
D.Key rotation policies
Explanation: The Key Vault firewall lets you deny public network access by default and allow only selected virtual networks, IP ranges, and trusted Microsoft services. This network-layer control complements data-plane authorization so that even authenticated requests must originate from approved networks.
7An administrator must enforce that all new storage accounts are deployed with secure transfer (HTTPS) required. Which service provides built-in policy definitions to audit or deny noncompliant deployments?
A.Azure Blueprints export
B.Microsoft Sentinel
C.Azure Policy
D.Azure Advisor
Explanation: Azure Policy provides built-in definitions that can audit or deny resource configurations such as storage accounts that do not require secure transfer. Assigning these policies enforces governance at deployment time and continuously evaluates existing resources for compliance.
8Which Microsoft Defender for Cloud capability maps your environment against frameworks such as PCI DSS, ISO 27001, and the Microsoft cloud security benchmark?
A.Secure Score
B.Workflow automation
C.Attack path analysis
D.Regulatory compliance dashboard
Explanation: The regulatory compliance dashboard in Defender for Cloud assesses your resources against built-in compliance standards such as PCI DSS, ISO 27001, and the Microsoft cloud security benchmark. It shows passed and failed controls so teams can track and remediate compliance gaps.
9What is the purpose of an Azure resource lock set to CanNotDelete?
A.It allows reading and modifying the resource but prevents its deletion
B.It prevents all read access to the resource
C.It encrypts the resource at rest
D.It removes all role assignments on the resource
Explanation: A CanNotDelete lock allows authorized users to read and modify a resource but blocks deletion, protecting against accidental removal. A ReadOnly lock is more restrictive, allowing reads but blocking modifications and deletions.
10Which Azure RBAC concept allows you to assign a built-in role at the resource group scope so it applies to all current and future resources within that group?
A.Management group inheritance only
B.Role assignment scope inheritance
C.Conditional Access scoping
D.Policy initiative assignment
Explanation: Azure RBAC role assignments are inherited downward through the scope hierarchy: a role granted at a resource group applies to that group and every resource it contains, including resources created later. This inheritance model lets you grant access efficiently while keeping least privilege in mind by choosing the narrowest workable scope.

About the SC-500 Exam

Microsoft's SC-500 exam earns the Cloud and AI Security Engineer Associate certification, validating that you can implement end-to-end security controls across cloud and AI workloads. The skills span Microsoft Entra ID, Azure Key Vault, storage, databases, networking, compute, security for AI, and security posture management with Microsoft Defender for Cloud, Microsoft Sentinel, and Microsoft Security Copilot. SC-500 is the successor to AZ-500 and adds explicit coverage of securing AI solutions.

Exam sponsor: Microsoft. The requirements and fees below concern the certification or admission exam, separate from our free practice resources.

Assessment

Question count not published by the exam provider

Time Limit

120 minutes

Passing Score

700/1000

Exam / Certification Fees

$165

Exam sponsor website

Fees, eligibility, and exam policies can change. Confirm them with the exam sponsor before applying or paying.

Our practice resources: topics covered

We aim to reflect publicly available exam outlines and topic information in our study resources. Coverage, format, and difficulty may differ from the actual exam, and we cannot guarantee that every detail is accurate or current. Confirm exam requirements, fees, and policies with the official exam sponsor.

20-25%

Manage identity, access, and governance

Secure access with Microsoft Entra ID, PIM, Conditional Access, MFA and passwordless, app registrations and consent, and managed identities. Protect secrets in Azure Key Vault and enforce governance with Azure Policy, RBAC, resource locks, and Defender for Cloud regulatory compliance.

25-30%

Secure storage, databases, and networking

Harden storage accounts and storage firewalls with Defender for Storage, secure Azure SQL with platform configurations, auditing, and Defender for Databases, and protect networks with NSGs, ASGs, Virtual Network Manager, private endpoints and Private Link, Azure Firewall, and Web Application Firewall.

20-25%

Secure compute

Implement security for AI with Purview DSPM for AI, Copilot Studio real-time protection, Entra Agent ID, Defender for AI, and Foundry guardrails. Secure servers and VMs with disk encryption, Azure Bastion, JIT access, Azure Arc, Defender for Servers, and trusted launch, plus container and app platform protections.

20-25%

Manage and monitor security posture

Manage posture with Defender CSPM, multicloud connectors, and Defender EASM. Implement Microsoft Sentinel workspaces, connectors, data collection rules, automation rules and playbooks, and retention, and use Microsoft Security Copilot for investigation.

Preparing for the SC-500 Exam

What You Need to Know

  • Passing score: 700/1000
  • Assessment: Question count not published by the exam provider
  • Time limit: 120 minutes
  • Exam / certification fees: $165 Official sources

Using Our Practice Resources

  • Work through all 116 available questions
  • Review every answer and explanation
  • Track weak areas and revisit them
  • Use our AI tutor for tough concepts

SC-500: Suggested Study Strategy

1Spend the largest share of study time on Secure storage, databases, and networking because it is the heaviest area at 25-30% of the exam.
2Master Microsoft Entra ID controls: PIM eligible assignments, Conditional Access conditions versus grant controls, MFA and passwordless methods, managed identities, and OAuth consent settings.
3Learn the security for AI tasks thoroughly, including Purview DSPM for AI, Entra Agent ID with Conditional Access, Defender for AI Services, prompt injection and content safety, and Foundry guardrails, since this is what differentiates SC-500 from AZ-500.
4Know when to use private endpoints, Private Link service, Azure Firewall Premium TLS inspection, NSGs versus ASGs, and Virtual Network Manager security admin rules.
5Practice Microsoft Sentinel workflows end to end: workspace setup, data connectors, data collection rules for Windows and syslog/CEF, analytics, automation rules, playbooks, and retention.
6Understand Defender for Cloud features such as CSPM, Secure Score, the regulatory compliance dashboard, workload protection plans, multicloud connectors, and how Security Copilot plugins extend investigation.

Frequently Asked Questions

What are the current official exam facts for SC-500?

Microsoft lists SC-500 as a role-based associate exam costing $165 USD, lasting 120 minutes, with roughly 40-60 questions and a passing score of 700 out of 1000. It is delivered through Pearson VUE and left beta in 2026 and is generally available.

Is SC-500 the replacement for AZ-500?

Yes. SC-500 is the successor to AZ-500, which retired on August 31, 2026. SC-500 keeps core Azure security skills and adds explicit coverage of securing AI workloads such as Microsoft Copilot, Entra Agent ID, and Defender for AI.

What skills are weighted most heavily on SC-500?

Secure storage, databases, and networking is the largest area at 25-30%. The other three areas each carry 20-25%: Manage identity, access, and governance; Secure compute, which includes security for AI; and Manage and monitor security posture.

What AI security topics does SC-500 cover?

SC-500 covers identifying data overexposure for Microsoft Copilot using Purview DSPM, Entra Agent ID and Conditional Access for agents, Defender for AI in Defender for Cloud, prompt injection and content safety guardrails, AI Gateway in API Management, and Foundry agent guardrails.

What experience does Microsoft recommend before taking SC-500?

Microsoft recommends practical experience administering Azure and hybrid environments, including compute, network, and storage, along with strong familiarity with Microsoft Entra ID and familiarity with Microsoft 365 administration.

How long is the SC-500 certification valid?

The Cloud and AI Security Engineer Associate certification is valid for one year and can be renewed for free through an online assessment on Microsoft Learn before it expires.