Microsoft SC-500 Practice Test 10

Question 90

A multi-subscription audit is missing results from one subscription. Which response correctly handles this condition?

Review resource applicability and exemption rationale before marking it complete.
Export or retain control-specific resource evidence instead of citing only a dashboard summary.
Confirm Defender onboarding, permissions, plan coverage and assessment ingestion.
Interpret assessment status and supporting evidence without asserting automatic regulator approval.

Explanation

Correct Answer

Verify Defender for Cloud coverage, plan and regulatory standard assignments, role visibility and whether resources have been assessed/ingested in that subscription.

Incorrect Answers

Marking resources not applicable without checking missing onboarding can conceal an actual coverage gap.

Exporting existing assessment evidence cannot recover findings that were never evaluated or visible for that subscription.

A high dashboard score elsewhere does not explain why the particular subscription has no reported assessments.

Question 91

A team wants to prove encryption controls at audit time. Which implementation decision is most appropriate here?

Export or retain control-specific resource evidence instead of citing only a dashboard summary.
Update mappings and compare deltas without hiding newly assessed noncompliance.
Review resource applicability and exemption rationale before marking it complete.
Inspect the exact recommendation and remediate the affected resource configuration.

Explanation

Correct Answer

Preserve the relevant encryption settings, key/rotation state, assessment details, scope, timestamps and any required manual attestation as audit evidence.

Incorrect Answers

Updating standard mappings changes how controls are evaluated but does not substantiate the deployed encryption property.

Applicability review addresses exceptions and is not the configuration/log evidence that an encryption control requires.

Remediating an unhealthy recommendation may be needed but does not by itself produce a dated proof of encryption configuration at audit time.

Question 92

A newly assigned regulatory baseline introduces controls that were not measured before. Select TWO reporting steps that accurately reflect the newly assessed controls and their changed compliance findings.

Keep using the prior regulatory baseline mapping and assume its existing recommendation labels already cover every newly introduced control.
Publish only a resource inventory with no per-control evidence and treat that inventory as proof that newly added requirements passed.
Update the compliance mapping to account for newly assessed controls.
Confirm Defender onboarding, permissions, plan coverage and assessment ingestion.
Compare changed control findings without hiding the newly identified noncompliance.

Explanation

Correct Answer

Reconcile the selected regulatory standard and its control-to-assessment mapping so newly added requirements appear in the compliance report.

Compare the before-and-after assessed control results, including new noncompliance and changes in scope, without suppressing adverse findings.

Incorrect Answers

The previous control mapping is not sufficient evidence that newly introduced controls have been evaluated.

A resource list lacks control-by-control assessment evidence and cannot establish compliance with the changed benchmark.

Plan onboarding and ingestion checks can explain missing evidence, but alone they neither update the new control map nor report the changed compliance findings.

Question 93

An organization has both custom security standards and built-in compliance frameworks. Which action should be selected for this deployment?

Interpret assessment status and supporting evidence without asserting automatic regulator approval.
Update mappings and compare deltas without hiding newly assessed noncompliance.
Inspect the exact recommendation and remediate the affected resource configuration.
Select correct standard assignments and interpret each recommendation's mapping separately.

Explanation

Correct Answer

Assign the intended standard or custom initiative to its proper scope and assess each recommendation/control mapping independently.

Incorrect Answers

A compliance score is not a legal certificate and does not answer which distinct built-in/custom frameworks have actually been assigned.

Comparing assessment deltas is downstream analysis; it does not ensure the correct framework was selected and assigned initially.

Remediating an individual finding can improve posture but does not reconcile custom controls with built-in standard coverage.

Question 94

A reader needs visibility of one resource group but was assigned subscription Owner. Which remediation is the most relevant for this failure?

Separate the power to assign access from ordinary resource deployment rights.
Replace with the least-privileged built-in role at the resource-group scope.
Recognize RBAC inheritance and review blast radius before changing scope.
Inspect actual principal, inherited assignments, deny assignments and scope.

Explanation

Correct Answer

Remove the broad Owner assignment and grant a Reader or narrowly suitable built-in monitoring role at the required resource-group scope.

Incorrect Answers

Separating access assignment power is an additional governance principle, not the direct replacement of this user’s excessive Owner grant.

Inherited role evaluation shows exposure but cannot remove subscription-wide Owner rights the read-only viewer does not need.

Inspecting effective assignments helps verify the fix, but a diagnostic inventory does not itself reduce privileges.

Question 95

A monitoring service holds Contributor on a VM resource group even though it only needs to observe metrics and alerts. Which change removes its unnecessary VM configuration WRITE ability?

Move the same Contributor role to the VM resource-group scope while leaving resource write actions enabled.
Separate the power to assign access from ordinary resource deployment rights.
Limit the role to monitoring/read functions and verify write denial.
Inspect actual principal, inherited assignments, deny assignments and scope.

Explanation

Correct Answer

Replace Contributor with the minimum read/monitor role supported for the requested telemetry and verify VM write operations are denied.

Incorrect Answers

Moving the same Contributor role to a narrower scope would still allow writes to VMs inside that scope when the service needs monitoring only.

The authority to grant RBAC roles is a different risk than the service’s currently unnecessary VM configuration write permissions.

Effective-principal inspection identifies where the write grant came from but does not itself revoke those excessive actions.

Question 96

A principal appears in a role assignment but an Azure resource operation is denied. Which diagnostic check identifies the effective authorization outcome for the exact principal and target resource?

Inspect actual principal, inherited assignments, deny assignments and scope.
Separate the power to assign access from ordinary resource deployment rights.
Recognize RBAC inheritance and review blast radius before changing scope.
Limit the role to monitoring/read functions and verify write denial.

Explanation

Correct Answer

Inspect the exact identity/object ID, assigned and inherited roles, scope, role conditions and any applicable deny assignments for the failed operation.

Incorrect Answers

Separating the ability to assign RBAC roles addresses governance risk, not the specific access denial for this principal.

Understanding inheritance is helpful but insufficient unless the failed principal, resource scope and any overriding Deny are checked.

Narrowing Contributor to monitoring access is inappropriate before identifying the attempted operation and actual effective permission.

Question 97

An operations team grants User Access Administrator to every deployer. What is the best next security action?

Limit the role to monitoring/read functions and verify write denial.
Recognize RBAC inheritance and review blast radius before changing scope.
Give every deployer subscription Owner so that separate role-assignment permissions are unnecessary.
Separate the power to assign access from ordinary resource deployment rights.

Explanation

Correct Answer

Reserve role-assignment permissions for authorized access administrators; ordinary deployment principals should have only the resource actions they need.

Incorrect Answers

Read-only monitoring roles cannot replace resource deployment duties, and do not directly address separating deployment from RBAC grant authority.

Reviewing inherited scope is useful, but the root issue is that all deployers can change other users’ access assignments.

Owner has even broader authorization and access-management rights than User Access Administrator; blanket assignment increases risk.

Question 98

A role assigned at a management group unexpectedly appears in child subscriptions. What authorization behavior explains this, and what scope risk must be reviewed?

Recognize RBAC inheritance and review blast radius before changing scope.
Replace with the least-privileged built-in role at the resource-group scope.
Inspect actual principal, inherited assignments, deny assignments and scope.
Limit the role to monitoring/read functions and verify write denial.

Explanation

Correct Answer

RBAC roles assigned at a management group inherit into covered subscriptions/resource groups; assess downstream privilege before changing parent scope.

Incorrect Answers

Replacing a specific user with a resource-group Reader does not explain why a separate group-scoped role assignment reaches its child subscriptions.

A detailed principal/effective-role investigation could help but first recognize the defined parent-to-child inheritance of the known assignment.

Changing a monitoring role does not undo the inherited management-group assignment that is appearing in child subscriptions.

Question 99

A team needs only restart and read actions for VMs but no full Contributor role. Which configuration or verification action best fits the scenario?

Use the appropriate Entra directory role model rather than Azure resource RBAC.
Review its assignableScopes and role-definition propagation before re-creating it.
Validate effective actions and inherited roles; NotActions is not a deny assignment.
Define and validate a narrow Azure custom role with required Actions and assignable scopes.

Explanation

Correct Answer

Define the supported Azure RBAC Actions for VM read/restart and an appropriate assignable scope, then assign that narrow role instead of broad Contributor.

Incorrect Answers

Microsoft Entra directory roles govern tenant objects, not Azure VM restart and read operations at resource scopes.

Examining a custom role’s assignableScopes matters when an already-created role cannot be assigned, not when a role must first be designed to minimize VM privileges.

Effective-role and NotActions checks help audit assignments; they are not the required act of defining a least-privilege VM operations role.

Question 100

A custom role grants write access when its NotActions list appears to exclude everything. Which response correctly handles this condition?

Use the appropriate Entra directory role model rather than Azure resource RBAC.
Validate effective actions and inherited roles; NotActions is not a deny assignment.
Simulate and review new permissions before rollout to affected assignees.
Review its assignableScopes and role-definition propagation before re-creating it.

Explanation

Correct Answer

NotActions subtracts permissions only from its own custom role definition; another inherited role can still grant the action. Check effective combined access and any real deny assignment.

Incorrect Answers

Entra directory roles govern users/groups in the directory; the problem here is the effective Azure resource role Actions/NotActions evaluation.

A rollout simulation is good prevention, but cannot explain existing effective permissions without evaluating all assigned roles.

AssignableScopes controls where a role definition can be assigned, not whether an action excluded in one role is granted by another role.

Implementing End-to-End Security Controls for Cloud and AI Workloads (SC-500) Practice Tests

Microsoft SC-500 Practice Test 8 - 10 Questions (Last Reviewed 06-Nov-2026)
Microsoft SC-500 Practice Test 9 - 10 Questions (Last Reviewed 05-Nov-2026)
Microsoft SC-500 Practice Test 10 - 10 Questions (Last Reviewed 04-Nov-2026)
Microsoft SC-500 Practice Test 11 - 10 Questions (Last Reviewed 03-Nov-2026)
Microsoft SC-500 Practice Test 12 - 10 Questions (Last Reviewed 02-Nov-2026)

Pass Your Microsoft SC-500 Exam Easy!

Question 90

Explanation

Correct Answer

Incorrect Answers

Question 91

Explanation

Correct Answer

Incorrect Answers

Question 92

Explanation

Correct Answer

Incorrect Answers

Question 93

Explanation

Correct Answer

Incorrect Answers

Question 94

Explanation

Correct Answer

Incorrect Answers

Question 95

Explanation

Correct Answer

Incorrect Answers

Question 96

Explanation

Correct Answer

Incorrect Answers

Question 97

Explanation

Correct Answer

Incorrect Answers

Question 98

Explanation

Correct Answer

Incorrect Answers

Question 99

Explanation

Correct Answer

Incorrect Answers

Question 100

Explanation

Correct Answer

Incorrect Answers

Implementing End-to-End Security Controls for Cloud and AI Workloads (SC-500) Practice Tests