About these questions
These five questions are original. We wrote them in the style of the SC-500 skills measured, covering all four domains. They are not real exam questions, and the real exam will word things differently and may use other question formats.
How to use these
Try each question without looking at your notes, and pick an answer before you open the explanation. Then read the explanation even when you were right, because the reason the closest wrong option fails is where the learning is. Note any domain where you slipped, and revisit it on the domains explained page.
Question 1 (Manage identity, access, and governance)
A company is about to require compliant devices for sign-ins to all cloud apps. Before enforcing anything, the identity team wants to see how many sign-ins would have been blocked, without affecting any user. What should the team do?
- A. Create the policy in the off state and read the audit logs.
- B. Create the policy in report-only mode and review the sign-in logs.
- C. Enable the policy and exclude everyone except a pilot group.
- D. Enable the policy and review the audit logs for policy changes.
Show the answer and explanation
Correct answer: B. Report-only mode evaluates the policy at every sign-in and records what would have happened, but it enforces no controls, so no user is blocked. The closest wrong option is A. A policy that is off is not evaluated at all, so there is no data to read, and audit logs record configuration changes rather than sign-in outcomes. Option C enforces the policy for the pilot group and shows nothing about the rest of the company. Option D enforces the policy for everyone.
Question 2 (Secure storage, databases, and networking)
A central security team manages dozens of virtual networks through Azure Virtual Network Manager. It must block inbound SSH from the internet on all of them, and application teams who can edit their own network security groups must not be able to reopen it. What should the security team deploy?
- A. A Deny security admin rule in Azure Virtual Network Manager
- B. A network security group with a deny rule on every subnet
- C. An Azure Firewall network rule that denies the port
- D. An Azure Policy assignment with the audit effect
Show the answer and explanation
Correct answer: A. Security admin rules are applied at the virtual network level and are evaluated before network security group rules. A Deny rule stops the traffic before any network security group is consulted, so application teams cannot override it with their own rules. Option B is the closest wrong answer: it blocks the port, but anyone with write access to the group can change or delete the rule. Option C only affects traffic routed through the firewall. Option D reports non-compliance and blocks nothing.
Question 3 (Secure compute)
A team runs workloads on an Azure Kubernetes Service cluster and wants runtime threat detection for activity inside the cluster nodes. Which component of Microsoft Defender for Containers provides this?
- A. Agentless container vulnerability assessment
- B. Azure Policy for Kubernetes
- C. Agentless discovery for Kubernetes
- D. The Defender sensor deployed on the cluster nodes
Show the answer and explanation
Correct answer: D. The Defender sensor runs on the nodes of the cluster and provides runtime threat detection. Agentless discovery for Kubernetes is the closest wrong answer: it reads cluster information through the API to build a picture of posture and does not watch runtime activity. Agentless vulnerability assessment scans container images for known weaknesses. Azure Policy for Kubernetes enforces rules when workloads are admitted to the cluster instead of detecting threats while they run.
Question 4 (Manage and monitor security posture)
A branch office has a Linux machine that receives Common Event Format messages from a network firewall appliance. The machine is not in Azure. The messages must flow into Microsoft Sentinel. In addition to the syslog daemon, what must be installed on the machine?
- A. The Azure Connected Machine agent and the Azure Monitor Agent
- B. The Azure Diagnostics extension
- C. The legacy Log Analytics agent
- D. Microsoft Defender for Endpoint only
Show the answer and explanation
Correct answer: A. A machine outside Azure is first onboarded with the Azure Connected Machine agent (Azure Arc). That lets you deploy the Azure Monitor Agent and attach a data collection rule that selects what to forward to the workspace. The Azure Diagnostics extension is built for Azure virtual machines, so it is the closest wrong answer for a machine that lives elsewhere. The legacy Log Analytics agent has been replaced by the Azure Monitor Agent for this purpose. Defender for Endpoint does endpoint detection and does not forward CEF messages.
Question 5 (Manage identity, access, and governance)
A finance team fears that a compromised backup administrator could shorten retention or delete recovery points in a Recovery Services vault. Which two measures protect against this? Choose two.
- A. Switch the vault to geo-redundant storage.
- B. Enable and lock the immutable vault setting.
- C. Turn on cross-region restore.
- D. Require multi-user authorization with a Resource Guard that another administrator controls.
- E. Switch the vault to zone-redundant storage.
Show the answer and explanation
Correct answers: B and D. An immutable vault that is enabled and locked blocks operations that would reduce retention or remove backup data early, and the locked state cannot be reversed. Multi-user authorization adds a second person: critical operations need approval through a Resource Guard that a different administrator controls. Options A, C, and E are the closest wrong answers, because they protect against outages and regional failure, not against a malicious administrator. The vault can be geo-redundant, zone-redundant, or restorable in another region and still lose its data to an administrator with delete rights.
More guides for SC-500
- SC-500 Study Plan: 4-Week and 8-Week
- Is SC-500 Hard? An Honest Difficulty Check
- SC-500 Prerequisites and Skills Self-Check
- SC-500 Renewal and Retakes Explained
- Is SC-500 Worth It? An Honest Look
- SC-500 Cheat Sheet: Key Facts to Review
- SC-300 vs SC-500: Which Exam First?
Next step
If these felt comfortable, check the exam format and plan your booking. If a domain felt shaky, try more questions in the SC-500 practice tests.