SC-500 Cloud and AI Security Engineer Practice Questions with Explanations

Free SC-500 Cloud and AI Security Engineer practice questions with an explanation for every answer. Covers cloud security posture, Microsoft Defender for Cloud, network and data security, Key Vault, and securing AI workloads.

145 questions · Cybersecurity · by Study Foxy

Study these questions free

Questions

  1. Admins should hold the Owner role only when needed, activating it for a few hours with MFA and justification. What should you configure?

    • An eligible assignment in Privileged Identity Management
    • A permanent active Owner assignment at the subscription for each admin
    • A Conditional Access policy for the Azure portal only
    • A Delete lock on every resource group

  2. Which authentication method is considered phishing-resistant?

    • FIDO2 security keys
    • SMS one-time codes
    • Voice call verification
    • Email one-time passcodes

  3. A Conditional Access policy must require phishing-resistant MFA for admins, while other users can use any MFA. What should you use?

    • Authentication strengths
    • Security defaults
    • Named locations only
    • Sign-in frequency settings

  4. You want to see the impact of a new Conditional Access policy before enforcing it. Which mode should you use?

    • Report-only
    • On
    • Off
    • Audit-and-block

  5. Which accounts should normally be excluded from Conditional Access policies that could lock everyone out?

    • Emergency access (break-glass) accounts
    • All guest user accounts in the tenant and their sponsors
    • Every member of the help desk team
    • All service principals for apps

  6. Legacy authentication protocols such as POP and IMAP should no longer be usable. What should you do?

    • Block legacy authentication with Conditional Access
    • Require SMS MFA for legacy apps
    • Add legacy apps to a dynamic group
    • Lengthen the password expiry period for accounts using legacy apps

  7. An app registration needs to read all users' profiles with no signed-in user present. Which permission type is required?

    • Application permissions with admin consent
    • Delegated permissions granted with each user's individual consent
    • Delegated permissions with no consent
    • A user delegation SAS token

  8. An app must read secrets from Key Vault but must not change them. Which built-in role fits?

    • Key Vault Secrets User
    • Key Vault Administrator
    • Key Vault Secrets Officer
    • Key Vault Crypto Officer

  9. Deleted Key Vault keys must not be permanently erasable until the retention period ends, even by admins. What should you enable?

    • Purge protection
    • A ReadOnly lock
    • Network access via all networks
    • Access policies instead of RBAC

  10. Encryption keys in Key Vault must rotate automatically every 90 days. What should you configure?

    • A key rotation policy
    • A certificate issuance policy
    • A new vault every 90 days
    • A budget alert on the vault

  11. TLS certificates in Key Vault should renew automatically with a public certificate authority. What should you configure?

    • An integrated CA issuer such as DigiCert or GlobalSign
    • Self-signed certificates with manual renewal
    • A storage account to hold PFX files
    • A Conditional Access policy on the vault

  12. Which Defender plan alerts on unusual access patterns to secrets, such as access from a suspicious IP?

    • Defender for Key Vault
    • Defender for DNS
    • Defender for App Service
    • Defender for Storage

  13. Key Vault must be reachable only from your VNet, not the internet. What should you configure?

    • A private endpoint and disable public network access
    • A user-assigned managed identity attached to the vault and its keys
    • A longer soft delete retention period
    • A Delete lock on the vault resource

  14. Which Azure Policy effect automatically deploys a missing configuration, such as diagnostic settings, on resources?

    • DeployIfNotExists
    • Audit
    • Deny
    • Disabled

  15. Which policy initiative does Defender for Cloud assign by default to assess security posture?

    • Microsoft cloud security benchmark
    • ISO 27001 only
    • CIS benchmarks only
    • NIST 800-53 only

  16. A review shows many users hold Contributor at the subscription scope but only manage one resource group. What is the best fix?

    • Reassign narrower roles at the resource group scope
    • Give them Owner so access is consistent
    • Add a Delete lock to the subscription
    • Move all resources into one resource group so the role covers less

  17. Backups must be protected so that disabling protection or deleting data requires a second person's approval. What should you configure?

    • Multi-user authorization with Resource Guard
    • A longer backup retention period with geo-redundant vault storage
    • An LRS backup vault
    • A budget on the vault

  18. Recovery points must not be deletable before they expire, even by a vault admin. What should you enable?

    • Immutable vault (locked)
    • Cross Region Restore
    • Instant restore snapshots
    • Selective disk backup

  19. Bicep templates should be scanned for security misconfigurations before deployment. Where is the best place to do this?

    • In the CI/CD pipeline before deployment
    • Only after deployment, in production
    • Only during an annual audit
    • Only on developers' laptops, checked by memory before each commit

  20. What is the difference between Microsoft Entra ID roles and Azure RBAC roles?

    • Entra roles govern the directory; Azure roles govern resources
    • Entra roles govern resources; Azure roles govern the directory
    • They are two names for the same role system
    • Azure roles only apply to Microsoft 365 apps

  21. Which Conditional Access control requires users to sign in from Intune-managed, compliant devices?

    • Require device to be marked as compliant
    • Require password change
    • Block access from all locations
    • Require terms of use acceptance

  22. A Global Administrator can manage Azure subscriptions they don't have access to only after which step?

    • Elevating access to User Access Administrator at root
    • Joining the subscription's resource group as a guest member account
    • Activating Defender for Cloud
    • Creating a new management group first

  23. A resource must keep running even if someone with Owner tries to delete it by mistake. What should you add?

    • A CanNotDelete resource lock
    • An Audit policy
    • A dynamic group
    • A PIM approval rule

  24. What does Microsoft Entra ID Protection evaluate to trigger risk-based Conditional Access?

    • User risk and sign-in risk
    • Storage account risk only
    • Disk encryption status only
    • Network latency between regions

  25. How should an AI agent be given its own identity that can be governed with Conditional Access and access reviews?

    • Microsoft Entra Agent ID
    • A shared admin user account
    • A storage account access key
    • An anonymous SAS token

  26. Report-only Conditional Access policies block sign-ins that don't meet their conditions.

    True or false

  27. All access to a storage account must use Microsoft Entra identities, not account keys. What should you disable?

    • Shared key authorization
    • Soft delete for blobs
    • Blob versioning
    • The hot access tier

  28. Which storage setting stops anyone from reading blobs without authentication?

    • Disallow anonymous (public) blob access
    • Enable the archive access tier
    • Enable blob versioning
    • Enable change feed

  29. Which storage account settings help ensure data in transit is protected?

    • Require secure transfer and set minimum TLS 1.2
    • Enable soft delete and versioning
    • Enable the cool tier and lifecycle rules for all containers
    • Enable large file shares

  30. Uploaded blobs must be scanned for malware as soon as they arrive. What should you enable?

    • Defender for Storage malware scanning
    • Blob lifecycle management with a scan action on new blobs
    • Storage account failover
    • Object replication

  31. Policy requires two layers of encryption at rest for a storage account. What should you enable when creating it?

    • Infrastructure encryption
    • Secure transfer required
    • Blob soft delete
    • Hierarchical namespace

  32. Azure SQL logins should use only Microsoft Entra identities, with SQL authentication turned off. What should you enable?

    • Microsoft Entra-only authentication
    • Dynamic data masking
    • Transparent data encryption
    • Elastic pool auto-scaling

  33. The security team must control the key that protects an Azure SQL database at rest. What should you configure?

    • TDE with a customer-managed key in Key Vault
    • Always Encrypted with a server-side key only
    • Dynamic data masking on all columns
    • Row-level security on all tables

  34. Database admins must never see plaintext Social Security numbers stored in a column. What should you use?

    • Always Encrypted
    • Transparent data encryption
    • Dynamic data masking
    • SQL auditing

  35. A sales rep should only see rows for their own region in a shared table. What should you implement?

    • Row-level security
    • Dynamic data masking
    • Transparent data encryption
    • Always Encrypted

  36. Where can Azure SQL auditing logs be sent?

    • Storage, Log Analytics, or Event Hubs
    • Only to the database itself, in a hidden system table
    • Only to an email address
    • Only to Azure Boards

  37. Which Defender for SQL capability alerts on suspected SQL injection attacks?

    • Advanced Threat Protection
    • Vulnerability assessment only
    • Transparent data encryption
    • Elastic jobs

  38. Why is the Azure SQL setting 'Allow Azure services and resources to access this server' considered risky?

    • It allows connections from any Azure customer's resources
    • It blocks all Microsoft-managed backups and geo-replication links
    • It disables Entra authentication
    • It turns off TDE for the server

  39. You need tamper-evident records proving that rows in a table were never secretly changed. What should you use?

    • Ledger tables
    • Dynamic data masking
    • Read scale-out
    • Elastic pools

  40. A PaaS database must have no public internet exposure at all. What should you do?

    • Add a private endpoint and disable public network access
    • Add a server firewall rule for 0.0.0.0 to 255.255.255.255 with auditing
    • Enable dynamic data masking on every column
    • Use the serverless compute tier

  41. Which feature lets you write NSG rules using groups like 'WebServers' instead of IP addresses?

    • Application security groups
    • Service tags
    • Route tables
    • Private DNS zones

  42. Outbound traffic from all spokes must be inspected centrally with TLS inspection and IDPS. What should you deploy?

    • Azure Firewall Premium in the hub with UDRs
    • An NSG on each spoke subnet
    • Azure Firewall Basic in each spoke with no central routing
    • Application security groups

  43. Remote users need access to private apps without a traditional VPN, using identity-based, per-app access. What should you implement?

    • Microsoft Entra Private Access
    • A point-to-site VPN for all users
    • A public IP on each app server
    • Azure DNS public zones

  44. A public web app needs protection from common attacks such as SQL injection and cross-site scripting. What should you deploy?

    • A web application firewall
    • A network security group only
    • A NAT gateway
    • A private DNS zone

  45. Which service provides enhanced, tuned mitigation of volumetric attacks against public IPs, with cost protection?

    • Azure DDoS Protection
    • Azure Firewall Basic
    • A network security group
    • Azure Bastion

  46. A storage account's service endpoint traffic should be limited to approved storage accounts to stop data exfiltration. What should you use?

    • Service endpoint policies
    • NSG flow logs
    • A user-defined route
    • A DDoS Protection plan

  47. Central IT must enforce network rules across many VNets that local NSG owners can't override. What should you use?

    • Azure Virtual Network Manager security admin rules
    • An application security group in each VNet managed by local owners
    • A route table per subnet
    • Azure Private Link service

  48. Admins need RDP and SSH to VMs without exposing management ports or public IPs. What should you deploy?

    • Azure Bastion
    • A public IP with an NSG for 3389
    • A NAT gateway on the subnet
    • An internal load balancer

  49. Which Azure Firewall Premium feature can decrypt outbound HTTPS to inspect it for threats?

    • TLS inspection
    • DNS proxy
    • Threat intelligence in Alert mode
    • FQDN tags

  50. Which Defender plan detects threats such as unusual access patterns on storage accounts?

    • Defender for Storage
    • Defender for SQL
    • Defender for Resource Manager
    • Defender for DNS

Showing 50 of 145. Open the quiz to study them all.