Microsoft SC-500 Practice Test 12

Question 110

An emergency restoration runbook needs a temporary lock exception. Which response correctly handles this condition?

Distinguish ReadOnly from CanNotDelete and select the least restrictive protection matching requirements.
Apply a CanNotDelete lock at an appropriate scope and test permitted operations.
Require authorized change, logging, narrow removal and restoration of the lock.
Remove the subscription-wide resource locks permanently so the emergency restoration runbook never encounters one again.

Explanation

Correct Answer

Approve and log a narrowly scoped temporary lock removal for the restoration, then restore the required lock and verify protection.

Incorrect Answers

Changing permanently from ReadOnly to CanNotDelete may change operational rights but is not necessarily the authorized temporary restoration exception requested.

Adding a deletion lock does not resolve an authorized restore operation that is already blocked by an existing lock.

Permanently removing every subscription lock sacrifices ongoing protections and violates the temporary, scoped exception requirement.

Question 111

A compromised vault operator is trying to erase RETAINED Azure Backup recovery points. Which preventative backup-specific protection makes retained recovery data resistant to destructive changes rather than merely restricting who may restore?

Enable soft delete and lock supported Azure Backup immutability and guarded deletion safeguards for the protected recovery data.
Use time-limited and monitored recovery rights with explicit approval.
Reconcile resource coverage, backup policy association and retention after changes.
Separate or restrict destructive recovery operations and require stronger authorization.

Explanation

Correct Answer

Enable supported protected backups, soft-delete/immutability safeguards and guarded destructive operations before an attack, with locked settings where appropriate.

Incorrect Answers

Time-bound restoration rights control who can restore but do not by themselves make stored recovery points resistant to deletion.

Reconfirming policy assignment verifies coverage but cannot stop a privileged actor erasing or tampering with existing recovery copies.

Separating deletion authority reduces insider risk, but the specific need is to prevent tampering with protected retained recovery points.

Question 112

A backup administrator can disable protection and delete recovery data without any second-person authorization. Which change introduces an INDEPENDENT authorization boundary for destructive backup operations?

Rely on daily backup schedules while letting the same backup administrator approve and carry out destructive operations.
Separate or restrict destructive recovery operations and require stronger authorization.
Perform an isolated restoration test and verify the recovered workload data.
Use time-limited and monitored recovery rights with explicit approval.

Explanation

Correct Answer

Separate Resource Guard/MUA authorization for destructive backup operations, preferably outside the backup administrator’s permission boundary.

Incorrect Answers

Basic backup scheduling/protection does not alone provide separation of destructive operations from the compromised backup operator.

A test restore proves recoverability but does not prevent a privileged operator from deleting recovery points after the test.

Temporary recovery privileges govern access duration but are insufficient when the same operator can authorize and erase all protected data.

Question 113

A backup job reports success but restoration was never tested. Which action should be selected for this deployment?

Use time-limited and monitored recovery rights with explicit approval.
Reconcile resource coverage, backup policy association and retention after changes.
Perform an isolated restoration test and verify the recovered workload data.
Separate or restrict destructive recovery operations and require stronger authorization.

Explanation

Correct Answer

Perform an isolated test restore and validate boot/application state, files and integrity against the defined recovery objectives.

Incorrect Answers

Temporary recovery permissions are a role-security practice but provide no evidence that a completed backup can be restored correctly.

Reviewing policy association and retention confirms configuration, not that restored data is consistent and usable.

Resource Guard can prevent unauthorized deletion but cannot establish actual recovery completeness without a restoration test.

Question 114

A protected VM is moved to another subscription and backup policy stops applying. Which remediation is the most relevant for this failure?

Reconcile resource coverage, backup policy association and retention after changes.
Reconcile approved retention requirements before deleting recovery data.
Enforce supported backup protection and guarded deletion controls before attack.
Separate or restrict destructive recovery operations and require stronger authorization.

Explanation

Correct Answer

Verify support for the move, new scope permissions, protection policies and retention/coverage state, and reestablish supported backup protection where required.

Incorrect Answers

Retention reconciliation is not equivalent to verifying that the moved VM is associated with a supported protection configuration in its new subscription.

Ransomware deletion protection remains valuable but does not repair a broken VM protection association after moving scope.

Separating destructive authorization does not create the missing backup policy relationship for the relocated VM.

Question 115

A recovery administrator needs emergency restoration without exposing all production credentials. What should the security engineer do first to resolve this case?

Perform an isolated restoration test and verify the recovered workload data.
Use time-limited and monitored recovery rights with explicit approval.
Separate or restrict destructive recovery operations and require stronger authorization.
Reconcile approved retention requirements before deleting recovery data.

Explanation

Correct Answer

Use approved least-privilege recovery roles with time limits, auditable approval and access to only necessary resources; do not distribute master production secrets.

Incorrect Answers

A recovery test may verify backups in advance but does not grant appropriately bounded emergency access to the current operator.

Separating destructive operators is important, but this request specifically needs controlled restore rights without exposing unrelated credentials.

Adjusting retention is unrelated to safely delegating short-lived emergency restore authorization.

Question 116

A business asks to shorten backup retention even though a mandatory regulated preservation requirement has NOT been released. What must be resolved before reducing retention or deleting protected recovery points?

Reconcile approved retention requirements before deleting recovery data.
Use time-limited and monitored recovery rights with explicit approval.
Reconcile resource coverage, backup policy association and retention after changes.
Separate or restrict destructive recovery operations and require stronger authorization.

Explanation

Correct Answer

Confirm the approved mandatory retention/legal preservation obligations and obtain authorized release before reducing retention or deleting recoverable backup data.

Incorrect Answers

Time-limited recovery roles concern operator access, not whether a business can legally shorten protected retention.

Rechecking VM-to-policy associations does not resolve a conflict between the requested shorter schedule and an active retention hold.

More stringent destructive-operation controls help prevent unauthorized deletion, but do not decide whether the active preservation requirement permits retention changes.

Question 117

A Terraform plan contains an NSG rule that would expose a protected service to the internet. Which PRE-APPLY security control prevents the unsafe change from reaching production?

Validate only that Terraform syntax is well formed and defer security policy assessment until after the internet-facing NSG rule has been applied.
Detect drift against desired configuration and reconcile through controlled IaC changes.
Replace with appropriate workload identity and least-privilege deployment permissions.
Scan the plan and enforce policy checks before applying infrastructure changes.

Explanation

Correct Answer

Inspect the Terraform plan and enforce policy-as-code controls for NSG exposure so a noncompliant network change fails before deployment.

Incorrect Answers

Checking only template syntax or merely noting that deployed-state verification can happen later does not block this unsafe internet NSG change before apply.

Drift detection compares current state with managed configuration after deployment; it does not screen the pending change before apply.

Deployment identity privilege is a separate authorization risk and does not correct the unsafe NSG rule in the Terraform plan.

Question 118

A reused Bicep module deploys Key Vault instances without required network restrictions. Select THREE IaC remediation and validation steps that close the specific missing-network-policy defect.

Run only Bicep syntax validation and allow the vault deployment without inspecting network properties or policy effects.
Release the unchanged reusable module to every repository because a new version number alone guarantees network restrictions.
Verify the deployed vault's actual network configuration before promotion.
Replace with appropriate workload identity and least-privilege deployment permissions.
Test the resulting deployment against the security baseline.
Update the reusable Bicep vault module with approved network restrictions.

Explanation

Correct Answer

Inspect the deployed vault’s network ACLs, public-access setting and private endpoint configuration; a successful template build does not prove secure deployed state.

Run approved Azure Policy/compliance checks or equivalent deployment assertions on the actual result to validate the network baseline.

Correct the shared Bicep module so future vaults consistently receive the approved public-network and firewall/private endpoint configuration.

Incorrect Answers

Bicep syntax validation verifies template structure, not that the resulting Key Vault enforces the required network boundary.

Changing a module version number without changing its network properties merely republishes the same insecure deployment.

Workload identity and deployment rights are important but cannot supply missing firewall/private access properties in the reusable Key Vault module.

Question 119

A manual hotfix changed production firewall rules outside of version control. Which configuration or verification action best fits the scenario?

Version a reusable tested IaC module and roll out approved updates systematically.
Replace with appropriate workload identity and least-privilege deployment permissions.
Scan the plan and enforce policy checks before applying infrastructure changes.
Detect drift against desired configuration and reconcile through controlled IaC changes.

Explanation

Correct Answer

Compare live firewall rules with approved IaC state, investigate the manual change and reconcile through reviewed version-controlled deployment.

Incorrect Answers

Updating a shared module helps future deployments but leaves the production resource drift undetected until actual state is compared.

Rotating the pipeline identity does not reconcile the already deployed firewall rules with source-controlled desired state.

Scanning a future deployment plan does not detect a current firewall setting modified manually after its last controlled deployment.

Question 120

An IaC pipeline has subscription Owner credentials in plaintext. Which response correctly handles this condition?

Replace with appropriate workload identity and least-privilege deployment permissions.
Detect drift against desired configuration and reconcile through controlled IaC changes.
Scan the plan and enforce policy checks before applying infrastructure changes.
Update the reusable module with a compliant default and add deployment tests.

Explanation

Correct Answer

Use federated workload identity or a protected managed identity with only the deployment permissions required; revoke the exposed subscription-Owner secret.

Incorrect Answers

Drift detection compares infrastructure configuration and cannot remove credential material from the build definition.

Security scanning can identify exposed credentials but does not replace or revoke the current broad plaintext pipeline secret.

Changing module defaults leaves the pipeline’s high-privilege exposed secret usable for unrelated resource operations.

Implementing End-to-End Security Controls for Cloud and AI Workloads (SC-500) Practice Tests

Microsoft SC-500 Practice Test 10 - 10 Questions (Last Reviewed 04-Nov-2026)
Microsoft SC-500 Practice Test 11 - 10 Questions (Last Reviewed 03-Nov-2026)
Microsoft SC-500 Practice Test 12 - 10 Questions (Last Reviewed 02-Nov-2026)
Microsoft SC-500 Practice Test 13 - 10 Questions (Last Reviewed 01-Nov-2026)
Microsoft SC-500 Practice Test 14 - 10 Questions (Last Reviewed 31-Oct-2026)

Pass Your Microsoft SC-500 Exam Easy!

Question 110

Explanation

Correct Answer

Incorrect Answers

Question 111

Explanation

Correct Answer

Incorrect Answers

Question 112

Explanation

Correct Answer

Incorrect Answers

Question 113

Explanation

Correct Answer

Incorrect Answers

Question 114

Explanation

Correct Answer

Incorrect Answers

Question 115

Explanation

Correct Answer

Incorrect Answers

Question 116

Explanation

Correct Answer

Incorrect Answers

Question 117

Explanation

Correct Answer

Incorrect Answers

Question 118

Explanation

Correct Answer

Incorrect Answers

Question 119

Explanation

Correct Answer

Incorrect Answers

Question 120

Explanation

Correct Answer

Incorrect Answers

Implementing End-to-End Security Controls for Cloud and AI Workloads (SC-500) Practice Tests