Microsoft SC-500 Practice Test 11

Question 100

A custom role grants write access when its NotActions list appears to exclude everything. Which response correctly handles this condition?

Use the appropriate Entra directory role model rather than Azure resource RBAC.
Validate effective actions and inherited roles; NotActions is not a deny assignment.
Simulate and review new permissions before rollout to affected assignees.
Review its assignableScopes and role-definition propagation before re-creating it.

Explanation

Correct Answer

NotActions subtracts permissions only from its own custom role definition; another inherited role can still grant the action. Check effective combined access and any real deny assignment.

Incorrect Answers

Entra directory roles govern users/groups in the directory; the problem here is the effective Azure resource role Actions/NotActions evaluation.

A rollout simulation is good prevention, but cannot explain existing effective permissions without evaluating all assigned roles.

AssignableScopes controls where a role definition can be assigned, not whether an action excluded in one role is granted by another role.

Question 101

An administrator attempts to use an Azure resource custom role to manage Entra users. Which implementation decision is most appropriate here?

Review its assignableScopes and role-definition propagation before re-creating it.
Simulate and review new permissions before rollout to affected assignees.
Define and validate a narrow Azure custom role with required Actions and assignable scopes.
Use the appropriate Entra directory role model rather than Azure resource RBAC.

Explanation

Correct Answer

Use the appropriate Microsoft Entra built-in or custom directory role and scoped directory permissions for user management.

Incorrect Answers

Expanding AssignableScopes in an Azure resource role cannot create Microsoft Graph/Entra user-management permissions.

Predeployment simulation is a process check, but does not fix the directory-versus-ARM authorization-plane mismatch.

An Azure custom role cannot substitute for a Microsoft Entra directory role when the operations act on directory users rather than Azure Resource Manager resources.

Question 102

An existing custom Azure role is available in one subscription but cannot be assigned in a NEW subscription. What property should be examined FIRST, before creating a duplicate role definition?

Define and validate a narrow Azure custom role with required Actions and assignable scopes.
Review its assignableScopes and role-definition propagation before re-creating it.
Validate effective actions and inherited roles; NotActions is not a deny assignment.
Simulate and review new permissions before rollout to affected assignees.

Explanation

Correct Answer

Inspect the role definition’s assignableScopes, actual assignment scope and propagation; update approved scopes if supported rather than duplicating the definition blindly.

Incorrect Answers

Recreating the role without first checking assignableScopes can produce another role that is equally unavailable in that subscription.

NotActions and role inheritance affect operation permissions, not whether a custom role definition is assignable to a subscription.

Checking simulated permission expansion is unrelated to a role definition that is not available for assignment in the new subscription.

Question 103

A privileged operator requests both security policy authoring and the power to approve own exceptions. Which action should be selected for this deployment?

Review its assignableScopes and role-definition propagation before re-creating it.
Use the appropriate Entra directory role model rather than Azure resource RBAC.
Separate duties across appropriate roles and approvals rather than one self-approving role.
Validate effective actions and inherited roles; NotActions is not a deny assignment.

Explanation

Correct Answer

Assign policy-writing and exception-approval authority to distinct governed principals/workflows, with traceable independent approval.

Incorrect Answers

Making a custom role available at a different assignable scope does not prevent a single operator exercising both duties.

Directory roles are separate from Azure resource roles but choosing a role namespace alone does not prevent self-approval of policy exceptions.

A NotActions exclusion cannot enforce separation of duty if the same operator has another role that permits exception approvals.

Question 104

A custom role change expands management-plane permissions across child resources. Which remediation is the most relevant for this failure?

Assume adding a custom-role NotActions exclusion blocks the same action even when another inherited role allows it.
Simulate and review new permissions before rollout to affected assignees.
Use the appropriate Entra directory role model rather than Azure resource RBAC.
Validate effective actions and inherited roles; NotActions is not a deny assignment.

Explanation

Correct Answer

Review proposed effective Actions/DataActions and inherited assignments before enabling an expanded custom role at high-level scopes.

Incorrect Answers

NotActions on one custom role does not override Allow permissions granted by another role to the same operator.

Switching to an Entra directory role is inappropriate for the Azure resource management-plane permissions described.

NotActions alone is not an explicit deny; assuming it constrains all other inherited roles misses the new permission footprint.

Question 105

A service only needs a storage data operation not covered by Actions. What should the security engineer do first to resolve this case?

Check DataActions and the target service's data-plane RBAC requirements.
Validate effective actions and inherited roles; NotActions is not a deny assignment.
Define and validate a narrow Azure custom role with required Actions and assignable scopes.
Use the appropriate Entra directory role model rather than Azure resource RBAC.

Explanation

Correct Answer

Inspect the resource provider’s data-plane RBAC actions, including DataActions/NotDataActions and scoped Storage data roles, before granting access.

Incorrect Answers

NotActions affects control-plane effective actions and cannot grant the missing blob/queue data-plane operation.

Changing Actions alone does not authorize Azure Storage object data operations that are classified as DataActions.

Entra directory roles manage tenant objects and are not interchangeable with Azure Storage data access permissions.

Question 106

A backup vault resource was accidentally deleted via Azure Resource Manager. The team must prevent another deletion while still allowing approved management updates. Which lock should be used?

Distinguish ReadOnly from CanNotDelete and select the least restrictive protection matching requirements.
Review lock scope and controlled change procedures rather than removing all locks permanently.
Require authorized change, logging, narrow removal and restoration of the lock.
Apply a CanNotDelete lock at an appropriate scope and test permitted operations.

Explanation

Correct Answer

A CanNotDelete lock at the vault or appropriate parent resource scope blocks Azure Resource Manager deletion while allowing supported updates.

Incorrect Answers

ReadOnly can unnecessarily block valid configuration changes; the requirement is specifically to prevent deletion, not all updates.

A lock review procedure may catch a bad deletion but will not enforce protection against future accidental vault deletion.

Approval logging for deliberate lock removal is operational governance, not the preventative lock that must be installed first.

Question 107

A ReadOnly Azure management lock is blocking legitimate configuration updates. Which statement correctly distinguishes this from a CanNotDelete lock when edits must remain possible?

Keep the existing ReadOnly lock and grant Owner to the administrators so they can override its modification restriction.
Distinguish ReadOnly from CanNotDelete and select the least restrictive protection matching requirements.
Require authorized change, logging, narrow removal and restoration of the lock.
Verify data-plane protection separately; resource management locks do not universally protect blob operations.

Explanation

Correct Answer

ReadOnly blocks management writes; select CanNotDelete if updates must continue but accidental resource deletion must be prohibited.

Incorrect Answers

A CanNotDelete lock allows management updates while preventing deletion; keeping the existing ReadOnly lock and simply raising RBAC to Owner does not override it.

Approval for temporary lock removal is useful, but does not explain why normal updates are blocked by an overly restrictive lock kind.

Protecting blobs at the data plane is a different question from the ReadOnly ARM lock blocking resource configuration updates.

Question 108

A developer assumes an Azure resource lock blocks blob data deletion. Which control best addresses the actual risk described?

Apply a CanNotDelete lock at an appropriate scope and test permitted operations.
Distinguish ReadOnly from CanNotDelete and select the least restrictive protection matching requirements.
Review lock scope and controlled change procedures rather than removing all locks permanently.
Verify data-plane protection separately; resource management locks do not universally protect blob operations.

Explanation

Correct Answer

Management locks govern ARM requests, not normal blob data-plane Delete operations. Use Storage-specific versioning, soft delete, immutability and data RBAC as applicable.

Incorrect Answers

CanNotDelete protects the storage account resource itself, not every blob object stored inside it.

Both ReadOnly and CanNotDelete lock modes are scoped to ARM management operations; neither universally blocks authenticated blob deletion.

Lock-change process review does not transform a control-plane protection into a blob data-plane deletion safeguard.

Question 109

A legitimate infrastructure deployment is blocked by a management lock on a production network resource. Select TWO steps that diagnose the blocked management operation and execute an authorized, time-limited change without permanently removing protection.

Verify data-plane protection separately; resource management locks do not universally protect blob operations.
Apply a CanNotDelete lock at an appropriate scope and test permitted operations.
Remove the lock on the entire subscription and leave it disabled after deployment to avoid future template failures.
Inspect the management lock and the exact deployment operation it prevents.
Use an authorized, temporary change procedure instead of permanently removing every resource lock.

Explanation

Correct Answer

Inspect effective inherited and local ReadOnly/CanNotDelete locks and the exact ARM control-plane operation rejected by the deployment.

Use the authorized change process to remove or adjust only the blocking lock temporarily, apply the change and restore the required protection.

Incorrect Answers

Resource locks protect control-plane operations; checking data-plane protection is useful but does not identify the deployment operation that is denied.

Adding CanNotDelete may be suitable protection in another case; it does not diagnose or unblock the already-failing management operation.

Removing subscription-wide locks indefinitely is disproportionate to one authorized change and leaves unrelated production resources exposed.

Question 110

An emergency restoration runbook needs a temporary lock exception. Which response correctly handles this condition?

Distinguish ReadOnly from CanNotDelete and select the least restrictive protection matching requirements.
Apply a CanNotDelete lock at an appropriate scope and test permitted operations.
Require authorized change, logging, narrow removal and restoration of the lock.
Remove the subscription-wide resource locks permanently so the emergency restoration runbook never encounters one again.

Explanation

Correct Answer

Approve and log a narrowly scoped temporary lock removal for the restoration, then restore the required lock and verify protection.

Incorrect Answers

Changing permanently from ReadOnly to CanNotDelete may change operational rights but is not necessarily the authorized temporary restoration exception requested.

Adding a deletion lock does not resolve an authorized restore operation that is already blocked by an existing lock.

Permanently removing every subscription lock sacrifices ongoing protections and violates the temporary, scoped exception requirement.

Implementing End-to-End Security Controls for Cloud and AI Workloads (SC-500) Practice Tests

Microsoft SC-500 Practice Test 9 - 10 Questions (Last Reviewed 05-Nov-2026)
Microsoft SC-500 Practice Test 10 - 10 Questions (Last Reviewed 04-Nov-2026)
Microsoft SC-500 Practice Test 11 - 10 Questions (Last Reviewed 03-Nov-2026)
Microsoft SC-500 Practice Test 12 - 10 Questions (Last Reviewed 02-Nov-2026)
Microsoft SC-500 Practice Test 13 - 10 Questions (Last Reviewed 01-Nov-2026)

Pass Your Microsoft SC-500 Exam Easy!

Question 100

Explanation

Correct Answer

Incorrect Answers

Question 101

Explanation

Correct Answer

Incorrect Answers

Question 102

Explanation

Correct Answer

Incorrect Answers

Question 103

Explanation

Correct Answer

Incorrect Answers

Question 104

Explanation

Correct Answer

Incorrect Answers

Question 105

Explanation

Correct Answer

Incorrect Answers

Question 106

Explanation

Correct Answer

Incorrect Answers

Question 107

Explanation

Correct Answer

Incorrect Answers

Question 108

Explanation

Correct Answer

Incorrect Answers

Question 109

Explanation

Correct Answer

Incorrect Answers

Question 110

Explanation

Correct Answer

Incorrect Answers

Implementing End-to-End Security Controls for Cloud and AI Workloads (SC-500) Practice Tests