Microsoft SC-500 Practice Test 2

Question 10

An auditor asks who authorized a sensitive role activation yesterday. Which response correctly handles this condition?

Require approval by a configured approver before activating the role.
Inspect PIM activation and approval history rather than relying on the administrator's chat statement.
Resolve the approved authentication prerequisite, not disable the activation gate for all users.
Reassess who needs eligibility, role scope, and activation justification using access reviews.

Explanation

Correct Answer

Inspect the role activation request, approver decision and PIM audit history for the relevant time and principal. A chat assertion is not an authoritative record of who approved access.

Incorrect Answers

Requiring approval going forward cannot retrospectively prove that a named delegated approver approved a completed activation.

Authentication-strength verification establishes how the requester authenticated, not who authorized yesterday’s activation.

Access reviews assess whether eligibility remains appropriate over time; they are not the definitive record of an individual approval from yesterday.

Question 11

A team gives all shift workers permanent active Azure Owner access even though they perform only limited tasks intermittently. Which change addresses BOTH unnecessary role scope and standing privilege?

Replace persistent assignments with eligible, least-privilege access where operationally supported.
Assign a time-bound eligibility or active window and verify expiry instead of indefinite membership.
Require approval by a configured approver before activating the role.
Treat pending and approved/active states separately; verify activation outcome before administrative operations.

Explanation

Correct Answer

Use a task-specific Azure role at the narrowest resource scope and eligible activation rather than permanent Owner. This reduces both standing privilege and overbroad permissions.

Incorrect Answers

An expiration time can reduce duration but still leaves workers holding the excessive Owner role and may leave it active throughout the assignment window.

Approver sign-off adds oversight when a role activates, but does not by itself remove permanently active Owner access or narrow its permissions.

Checking pending versus active status does not replace the Owner role or change the workers’ authorization scope.

Question 12

A contractor needs temporary privileged access that must end with a fixed project term. Select THREE controls that establish least privilege, a bounded assignment and verifiable removal at project completion.

Limit its permissions to the role/scope required for the contract.
Resolve the approved authentication prerequisite, not disable the activation gate for all users.
Reassess who needs eligibility, role scope, and activation justification using access reviews.
Require approval by a configured approver before activating the role.
Verify access expires and revoke any remaining grants when the project ends.
Make the contractor's privilege assignment time-bound to the documented project period.

Explanation

Correct Answer

Grant only the project tasks and resource scope required. An overly broad administrative role would remain excessive even if it expires later.

At project completion, inspect effective assignments and inherited grants, revoke any remaining access and record evidence that the contractor no longer has privileges.

Make the privileged eligibility or assignment time-bound to the contract so the intended grant has a defined expiration.

Incorrect Answers

An authentication prerequisite may affect how a role activates; it does not independently enforce the project’s authorization scope or contract expiry.

Periodic access reviews help ongoing governance but cannot substitute for explicitly narrowing the contractor’s grant, bounding its project end date and verifying revocation.

An approval workflow can supplement privileged access but does not itself define a least-privilege role, project end date or proof of removal.

Question 13

A privileged role cannot activate because a strong authentication requirement is unmet. Which action should be selected for this deployment?

Assign a time-bound eligibility or active window and verify expiry instead of indefinite membership.
Inspect PIM activation and approval history rather than relying on the administrator's chat statement.
Resolve the approved authentication prerequisite, not disable the activation gate for all users.
Require approval by a configured approver before activating the role.

Explanation

Correct Answer

Complete the approved strong-authentication verification required by the PIM role settings. Disabling the gate tenant-wide would weaken privileged sign-ins.

Incorrect Answers

Shortening an assignment period limits privilege duration but cannot satisfy a required authentication method.

Approval history would help investigate a completed request, but this activation is blocked by the configured authentication requirement.

An approver cannot legitimately override an unmet authentication-strength gate merely by authorizing the request.

Question 14

A reviewer sees recurring unneeded role activations in audit records. Which remediation is the most relevant for this failure?

Assign a time-bound eligibility or active window and verify expiry instead of indefinite membership.
Inspect PIM activation and approval history rather than relying on the administrator's chat statement.
Resolve the approved authentication prerequisite, not disable the activation gate for all users.
Reassess who needs eligibility, role scope, and activation justification using access reviews.

Explanation

Correct Answer

Use access reviews and PIM evidence to determine whose eligibility is still required, whether role scope is excessive, and whether repeated activations have proper business justification.

Incorrect Answers

Expiring individual activations does not remove obsolete role eligibility that permits the same unnecessary access repeatedly.

Inspecting the audit trail supplies evidence for the review, but viewing records alone does not remediate the unnecessary eligible grants.

MFA may secure activation but does not resolve assignments being retained for users who no longer need the role.

Question 15

A delegated approver claims that a PIM request in Pending approval state is already granting administrative permissions. Which verification directly determines whether the role is active at this moment?

Assign a time-bound eligibility or active window and verify expiry instead of indefinite membership.
Treat pending and approved/active states separately; verify activation outcome before administrative operations.
Inspect PIM activation and approval history rather than relying on the administrator's chat statement.
Require approval by a configured approver before activating the role.

Explanation

Correct Answer

A request marked Pending approval is not active. Inspect the PIM request status and the actual active role assignment before allowing privileged work.

Incorrect Answers

A time-bounded eligibility setting controls duration, but the immediate question is whether the currently pending request has been activated at all.

Historical records help investigate prior approvals, but the operative evidence is this request’s current PIM state and effective active role assignment.

Configuring approver requirements is a policy prerequisite, not proof that this particular pending request produced an active assignment; inspect its current state.

Question 16

Administrators must meet phishing-resistant authentication for a privileged cloud app. Which control would most directly close the security gap?

Evaluate the policy with report-only and What If before enabling enforcement.
Scope Conditional Access to the relevant identity, application and compliant-device control.
Target the proper roles and app with a Conditional Access authentication-strength grant control.
Create an appropriate legacy-client Conditional Access block policy and verify sign-in logs.

Explanation

Correct Answer

Target the privileged identities and cloud app in a Conditional Access policy requiring a supported phishing-resistant authentication strength.

Incorrect Answers

Report-only and What If can estimate impact but do not enforce phishing-resistant authentication on an actual privileged-app sign-in.

A compliant-device grant can improve device trust, but it cannot prove that the authentication method used is phishing-resistant.

A legacy-client block policy closes a different authentication weakness; it does not impose phishing-resistant strength on all targeted modern privileged sign-ins.

Question 17

Before enforcing a new Conditional Access policy that might lock out tenant administrators, which evaluation step BEST estimates the actual sign-in impact without blocking anyone yet?

Scope Conditional Access to the relevant identity, application and compliant-device control.
Evaluate the policy with report-only and What If before enabling enforcement.
Evaluate guest/external-user inclusion and target-resource scope rather than assuming universal coverage.
Create an appropriate legacy-client Conditional Access block policy and verify sign-in logs.

Explanation

Correct Answer

Use the Conditional Access What If tool and report-only evaluation for representative administrator sign-ins before switching a risky policy to enforcement.

Incorrect Answers

Changing device/app scope may be needed later, but without testing it cannot establish whether administrators will be unintentionally locked out.

Guest resource targeting is not the stated lockout risk; changing those assignments would not simulate how the proposed admin rule evaluates.

Blocking legacy authentication may be worthwhile independently, but it does not validate the impact of the newly proposed admin policy.

Question 18

A contractor signing in from an unmanaged endpoint must not access sensitive SaaS data. Which control best addresses the actual risk described?

Scope Conditional Access to the relevant identity, application and compliant-device control.
Target the proper roles and app with a Conditional Access authentication-strength grant control.
Interpret the configured AND/OR grant operator and satisfy both required controls.
Evaluate the policy with report-only and What If before enabling enforcement.

Explanation

Correct Answer

Target the contractor and sensitive SaaS app, and require a compliant device. The unmanaged endpoint then fails the device grant instead of being admitted on authentication alone.

Incorrect Answers

A phishing-resistant sign-in strength verifies the authentication method; it does not establish Intune device compliance for this contractor.

Checking the AND/OR combination helps diagnose an existing grant, but no correctly targeted compliant-device rule has yet been configured.

Report-only evaluates proposed policy impact but never prevents this unmanaged-device access until a separate rule is enforced.

Question 19

A company needs to block legacy authentication clients that cannot satisfy MFA. Which configuration or verification action best fits the scenario?

Create an appropriate legacy-client Conditional Access block policy and verify sign-in logs.
Evaluate the policy with report-only and What If before enabling enforcement.
Interpret the configured AND/OR grant operator and satisfy both required controls.
Target the proper roles and app with a Conditional Access authentication-strength grant control.

Explanation

Correct Answer

Block the legacy-authentication client-app types with Conditional Access and verify the enforced result using sign-in logs.

Incorrect Answers

Report-only tests a proposed rule but leaves legacy client connections possible until a block policy is enabled.

An MFA-and-compliance grant cannot reliably challenge clients that use legacy authentication; explicitly target legacy clients for blocking.

Phishing-resistant authentication strength applies to supported modern authentication; it does not directly stop legacy clients that cannot complete it.

Question 20

A policy protects all users but inadvertently includes emergency access identities. Which response correctly handles this condition?

Define reviewed emergency-account exclusions and monitor their use.
Evaluate the policy with report-only and What If before enabling enforcement.
Evaluate guest/external-user inclusion and target-resource scope rather than assuming universal coverage.
Create an appropriate legacy-client Conditional Access block policy and verify sign-in logs.

Explanation

Correct Answer

Use carefully scoped emergency-access account exclusions, control their credentials and alert on every exceptional sign-in so recovery remains possible.

Incorrect Answers

What If can expose lockout before rollout, but does not itself exclude a separately protected emergency identity from an enforced policy.

Guest-user targeting addresses external identities rather than the designated emergency accounts that must remain usable during normal-policy failure.

Blocking legacy clients is an independent hardening measure; it does not prevent the broad policy from trapping emergency recovery accounts.

Implementing End-to-End Security Controls for Cloud and AI Workloads (SC-500) Practice Tests

Microsoft SC-500 Practice Test 1 - 10 Questions (Last Reviewed 13-Nov-2026)
Microsoft SC-500 Practice Test 2 - 10 Questions (Last Reviewed 12-Nov-2026)
Microsoft SC-500 Practice Test 3 - 10 Questions (Last Reviewed 11-Nov-2026)
Microsoft SC-500 Practice Test 4 - 10 Questions (Last Reviewed 10-Nov-2026)

Pass Your Microsoft SC-500 Exam Easy!

Question 10

Explanation

Correct Answer

Incorrect Answers

Question 11

Explanation

Correct Answer

Incorrect Answers

Question 12

Explanation

Correct Answer

Incorrect Answers

Question 13

Explanation

Correct Answer

Incorrect Answers

Question 14

Explanation

Correct Answer

Incorrect Answers

Question 15

Explanation

Correct Answer

Incorrect Answers

Question 16

Explanation

Correct Answer

Incorrect Answers

Question 17

Explanation

Correct Answer

Incorrect Answers

Question 18

Explanation

Correct Answer

Incorrect Answers

Question 19

Explanation

Correct Answer

Incorrect Answers

Question 20

Explanation

Correct Answer

Incorrect Answers

Implementing End-to-End Security Controls for Cloud and AI Workloads (SC-500) Practice Tests