Microsoft SC-500 Practice Test 1

Question 1

A tenant uses permanent Global Administrator for an engineer who only changes Exchange settings monthly. Which implementation decision is most appropriate here?

Replace standing tenant-wide privilege with an eligible, narrower Exchange administrator assignment activated when needed.
Activate the eligible role and complete configured requirements before expecting active privileges.
Configure time-limited activation and require reactivation for later administrative work.
Maintain and test documented emergency access controls without making routine roles permanently privileged.

Explanation

Correct Answer

Exchange Administrator eligibility limits the role to the needed service, while PIM activation grants it only for approved work periods. Remove the permanent Global Administrator assignment.

Incorrect Answers

Activation requirements alone do not remove the existing permanent Global Administrator grant, and activating the same broad role would not implement Exchange-specific least privilege.

A maximum activation duration is useful, but it does not by itself replace the existing overpowered permanent role with an appropriate service-scoped role.

Testing emergency access does not reduce this engineer’s standing Global Administrator privilege; that is a separate break-glass control.

Question 2

A PIM eligible security operator cannot execute admin actions immediately after assignment. Which change most directly addresses the described security requirement?

Activate the eligible role and complete configured requirements before expecting active privileges.
Replace standing tenant-wide privilege with an eligible, narrower Exchange administrator assignment activated when needed.
Request reduced activation scope where supported rather than unnecessarily expanding privileges.
Investigate application token/session caching and validate the effective role after deactivation.

Explanation

Correct Answer

An eligible PIM assignment is not active by itself. The operator must activate it and complete any configured MFA, justification or approval requirements before privileged operations work.

Incorrect Answers

Replacing a permanent Global Administrator grant addresses excessive privilege, but this operator already has an eligible assignment and needs to activate it.

Reducing an assignment’s scope is a least-privilege measure, not a means to turn an existing eligible assignment into an active one.

Token and application-session caching can delay observed deactivation; it does not explain an operator who has never activated an eligible role.

Question 3

An on-call team keeps an activated privileged role for several days after an emergency. Which action should be selected for this deployment?

Replace standing tenant-wide privilege with an eligible, narrower Exchange administrator assignment activated when needed.
Maintain and test documented emergency access controls without making routine roles permanently privileged.
Require a justification at activation and retain activity records for review.
Configure time-limited activation and require reactivation for later administrative work.

Explanation

Correct Answer

Configure PIM’s maximum activation duration so the privileged role automatically deactivates. A later incident requires a new activation rather than leaving administrative access continuously active.

Incorrect Answers

Replacing a tenant-wide role with a narrower service role reduces reach but does not correct the several-day active duration of the existing role.

Break-glass accounts are for exceptional tenant recovery when ordinary administration fails; they do not set the on-call operator’s activation expiry.

A justification records the reason for activation but does not enforce an end time or automatically revoke a role after the incident.

Question 4

A privileged role activation lacks a documented business reason. Which remediation is the most relevant for this failure?

Request reduced activation scope where supported rather than unnecessarily expanding privileges.
Maintain and test documented emergency access controls without making routine roles permanently privileged.
Require a justification at activation and retain activity records for review.
Configure time-limited activation and require reactivation for later administrative work.

Explanation

Correct Answer

Configure PIM activation to require a reason and retain the request/activation audit trail. Reviewers can then link elevated access to a documented task.

Incorrect Answers

Choosing a narrower scope limits permission reach, not the absence of a documented reason for the activation.

Emergency accounts need dedicated protection and monitoring, but the missing evidence here concerns ordinary role activation justifications.

Shortening activation duration controls how long privileges remain active but does not produce the missing business justification.

Question 5

An admin says a PIM role still grants access even after the active assignment expires. What should the security engineer do first to resolve this case?

Maintain and test documented emergency access controls without making routine roles permanently privileged.
Activate the eligible role and complete configured requirements before expecting active privileges.
Request reduced activation scope where supported rather than unnecessarily expanding privileges.
Investigate application token/session caching and validate the effective role after deactivation.

Explanation

Correct Answer

PIM removes the active assignment on expiry, but an application may still use cached token or role/session data. Inspect the assignment and token/session behavior, then retest after refreshing the session.

Incorrect Answers

Emergency access accounts protect against lockout; they do not explain why an expired PIM role is still honored by an application.

Activating the role again would extend access rather than diagnose why the application appears to honor an expired active grant.

Reducing future activation scope would not establish whether the current residual access comes from a cached session or another active grant.

Question 6

An engineer needs to manage just one resource group but PIM eligibility covers a subscription. Which control would most directly close the security gap?

Activate the eligible role and complete configured requirements before expecting active privileges.
Request reduced activation scope where supported rather than unnecessarily expanding privileges.
Require a justification at activation and retain activity records for review.
Investigate application token/session caching and validate the effective role after deactivation.

Explanation

Correct Answer

Constrain the eligible assignment or its supported activation scope to the resource group needed. A subscription-wide grant permits unnecessary changes outside that resource group.

Incorrect Answers

Activation makes the existing assignment effective; it does not automatically narrow a subscription-level role to one resource group.

Requiring a reason improves accountability but does not technically prevent operations against unrelated resource groups.

Session caching after deactivation is a separate state-propagation question, not a remedy for overly broad role scope.

Question 7

An emergency administrator cannot use the normal PIM approval chain because every designated approver is unavailable. Select TWO controls that together keep an emergency access route usable and accountable without turning ordinary access into standing privilege.

Require a justification at activation and retain activity records for review.
Investigate application token/session caching and validate the effective role after deactivation.
Configure time-limited activation and require reactivation for later administrative work.
Test emergency access periodically and audit its exceptional use.
Maintain a separately protected emergency-access route that does not depend on normal PIM approvers.

Explanation

Correct Answer

Periodically exercise the protected break-glass route and alert on exceptional sign-ins. An untested emergency credential or an unnoticed emergency login undermines recovery and accountability.

Keep separately protected emergency access accounts with an authentication path that does not depend on the unavailable approval chain; reserve them for tenant recovery.

Incorrect Answers

Ordinary PIM justification and approval settings still depend on that approval workflow, so they cannot be the sole route during an approver outage.

Investigating cached privilege after deactivation does not make an emergency route independent of absent PIM approvers.

Time-bound activation is appropriate for normal privileged work but still leaves the emergency request blocked if every configured approver is unavailable.

Question 8

A Privileged Role Administrator has an eligible PIM assignment. Their activation request is Pending approval, and no designated approver has approved it. What must happen before the role can become active?

Ask the requester to submit an identical activation request without obtaining the pending designated-approver decision.
Inspect PIM activation and approval history rather than relying on the administrator's chat statement.
Require approval by a configured approver before activating the role.
Resolve the approved authentication prerequisite, not disable the activation gate for all users.

Explanation

Correct Answer

With approval required, eligibility plus a pending activation request is insufficient: an authorized delegated approver must approve before PIM can activate the role.

Incorrect Answers

Submitting a duplicate request does not bypass the approval requirement; the eligible user must obtain the configured approver decision.

Viewing PIM history can confirm a request’s state, but it does not approve it or create the required active role assignment.

MFA and authentication-strength prerequisites are separate from the explicitly pending approver decision in this scenario.

Question 9

A PIM approval process sends requests to a departed employee. Which configuration or verification action best fits the scenario?

Inspect PIM activation and approval history rather than relying on the administrator's chat statement.
Require approval by a configured approver before activating the role.
Treat pending and approved/active states separately; verify activation outcome before administrative operations.
Maintain delegated approvers and test coverage before a privileged incident.

Explanation

Correct Answer

Update PIM role settings to assign current delegated approvers or an appropriate group, confirm notifications reach them, and test a request before an emergency.

Incorrect Answers

Historical activation records may reveal past approvals but do not replace departed approvers or restore present approval coverage.

Keeping the approval requirement enabled does not solve a stale approver assignment whose notification goes to a departed employee.

Distinguishing a pending request from an active role prevents false assumptions, but the root failure is that no available approver receives the requests.

Question 10

An auditor asks who authorized a sensitive role activation yesterday. Which response correctly handles this condition?

Require approval by a configured approver before activating the role.
Inspect PIM activation and approval history rather than relying on the administrator's chat statement.
Resolve the approved authentication prerequisite, not disable the activation gate for all users.
Reassess who needs eligibility, role scope, and activation justification using access reviews.

Explanation

Correct Answer

Inspect the role activation request, approver decision and PIM audit history for the relevant time and principal. A chat assertion is not an authoritative record of who approved access.

Incorrect Answers

Requiring approval going forward cannot retrospectively prove that a named delegated approver approved a completed activation.

Authentication-strength verification establishes how the requester authenticated, not who authorized yesterday’s activation.

Access reviews assess whether eligibility remains appropriate over time; they are not the definitive record of an individual approval from yesterday.

Implementing End-to-End Security Controls for Cloud and AI Workloads (SC-500) Practice Tests

Microsoft SC-500 Practice Test 1 - 10 Questions (Last Reviewed 13-Nov-2026)
Microsoft SC-500 Practice Test 2 - 10 Questions (Last Reviewed 12-Nov-2026)
Microsoft SC-500 Practice Test 3 - 10 Questions (Last Reviewed 11-Nov-2026)

Pass Your Microsoft SC-500 Exam Easy!

Question 1

Explanation

Correct Answer

Incorrect Answers

Question 2

Explanation

Correct Answer

Incorrect Answers

Question 3

Explanation

Correct Answer

Incorrect Answers

Question 4

Explanation

Correct Answer

Incorrect Answers

Question 5

Explanation

Correct Answer

Incorrect Answers

Question 6

Explanation

Correct Answer

Incorrect Answers

Question 7

Explanation

Correct Answer

Incorrect Answers

Question 8

Explanation

Correct Answer

Incorrect Answers

Question 9

Explanation

Correct Answer

Incorrect Answers

Question 10

Explanation

Correct Answer

Incorrect Answers

Implementing End-to-End Security Controls for Cloud and AI Workloads (SC-500) Practice Tests