Microsoft SC-500 Actual Exam Questions
207 Questions & Answers
Practice free SC-500 questions and answers covering Azure identity, Key Vault, AKS and cloud workload security. Review questions 6–10 and check your understanding. Select Reveal Solution after choosing your answer.
Group1 needs to assign roles across resources in two subscriptions beneath management group MG1, with least privilege. Which role and scope should be used?
Reveal Solution
User Access Administrator permits role assignment management without general resource modification rights. At MG1, it is inherited by both subscriptions.
Key Vault KV1 uses RBAC. App1 must read secret values, while User1 may manage vault settings without reading secrets. Which roles should be assigned?
Reveal Solution
Key Vault Contributor manages the vault resource but does not grant access to secret values. Key Vault Secrets User allows App1 to read secret contents.
Defender for Cloud must detect exposed plaintext tokens and SSH private keys on Azure VMs while minimizing changes to those VMs. Which plan and feature should be enabled?
Reveal Solution
Agentless machine scanning under Defender CSPM analyzes VM disks for exposed secrets without requiring software changes on each VM.
An Azure Policy must install a custom security extension on new VMs and create remediation tasks for existing noncompliant VMs. What should the policy use?
Reveal Solution
DeployIfNotExists can deploy the extension and support remediation. The assigned managed identity needs permission to perform the deployment.
A user must sign in to an Azure Arc-enabled Windows Server over RDP with the least privilege, without administrative rights. Which role should be assigned?
Reveal Solution
Virtual Machine User Login grants sign-in access without administrative privileges, satisfying least privilege.
Get all 207 questions and answers in the Premium PDF.